diff options
41 files changed, 241 insertions, 655 deletions
@@ -1,3 +1,29 @@ +lacme (0.8.4) upstream; + + + accountd: Use PKCS#1 v1.5 signatures, as it's what JWT RS256 uses. + This change is needed for compatibility with Crypt::OpenSSL::RSA 0.38 + and later. + + Fix 'drop-privileges' test. + + Update test suite to match staging server behavior. + + Drop OCSP must-staple extension test which is no longer available on + Let's Encrypt's ACME server. + + -- Guilhem Moulin <guilhem@fripost.org> Mon, 20 Jul 2026 19:52:28 +0200 + +lacme (0.8.3) upstream; + + + Fix post-issuance validation logic. We avoid pinning the + intermediate certificates in the bundle and instead validate the + leaf certificate with intermediates supplied during issuance as + untrusted (used for chain building only). Only the root + certificates are used as trust anchor. Not pinning intermediate + certificates is in line with Let's Encrypt's latest recommendations. + + Pass `-in /dev/stdin` option to openssl(1) to avoid warning with + OpenSSL 3.2 or later. + + Fix test suite. + + -- Guilhem Moulin <guilhem@fripost.org> Thu, 13 Jun 2024 17:39:34 +0200 + lacme (0.8.2) upstream; + client: Handle "ready" → "processing" → "valid" status change during @@ -16,17 +16,13 @@ $(MANUAL_FILES): $(BUILDDIR)/%: $(BUILDDIR)/%.md # used for validation, see https://letsencrypt.org/certificates/ $(BUILDDIR)/certs/ca-certificates.crt: \ certs/isrgrootx1.pem \ - certs/isrg-root-x2.pem \ - certs/lets-encrypt-r[34].pem \ - certs/lets-encrypt-e[12].pem + certs/isrg-root-x2.pem mkdir -pv -- $(@D) cat -- $^ >$@ # Staging Environment for tests, see https://letsencrypt.org/docs/staging-environment/ $(BUILDDIR)/certs-staging/ca-certificates.crt: \ - certs-staging/letsencrypt-stg-root-x[12].pem \ - certs-staging/letsencrypt-stg-int-r[34].pem \ - certs-staging/letsencrypt-stg-int-e[12].pem + certs-staging/letsencrypt-stg-root-x[12].pem mkdir -pv -- $(@D) cat -- $^ >$@ diff --git a/certs-staging/letsencrypt-stg-int-e1.pem b/certs-staging/letsencrypt-stg-int-e1.pem deleted file mode 100644 index 2d6290c..0000000 --- a/certs-staging/letsencrypt-stg-int-e1.pem +++ /dev/null @@ -1,19 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDCzCCApGgAwIBAgIRALRY4992FVxZJKOJ3bpffWIwCgYIKoZIzj0EAwMwaDEL -MAkGA1UEBhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0 -eSBSZXNlYXJjaCBHcm91cDEkMCIGA1UEAxMbKFNUQUdJTkcpIEJvZ3VzIEJyb2Nj -b2xpIFgyMB4XDTIwMDkwNDAwMDAwMFoXDTI1MDkxNTE2MDAwMFowVTELMAkGA1UE -BhMCVVMxIDAeBgNVBAoTFyhTVEFHSU5HKSBMZXQncyBFbmNyeXB0MSQwIgYDVQQD -ExsoU1RBR0lORykgRXJzYXR6IEVkYW1hbWUgRTEwdjAQBgcqhkjOPQIBBgUrgQQA -IgNiAAT9v/PJUtHOTk28nXCXrpP665vI4Z094h8o7R+5E6yNajZa0UubqjpZFoGq -u785/vGXj6mdfIzc9boITGusZCSWeMj5ySMZGZkS+VSvf8VQqj+3YdEu4PLZEjBA -ivRFpEejggEQMIIBDDAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUH -AwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFOv5JcKA -KGbibQiSMvPC4a3D/zVFMB8GA1UdIwQYMBaAFN7Ro1lkDsGaNqNG7rAQdu+ul5Vm -MDYGCCsGAQUFBwEBBCowKDAmBggrBgEFBQcwAoYaaHR0cDovL3N0Zy14Mi5pLmxl -bmNyLm9yZy8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3N0Zy14Mi5jLmxlbmNy -Lm9yZy8wIgYDVR0gBBswGTAIBgZngQwBAgEwDQYLKwYBBAGC3xMBAQEwCgYIKoZI -zj0EAwMDaAAwZQIwXcZbdgxcGH9rTErfSTkXfBKKygU0yO7OpbuNeY1id0FZ/hRY -N5fdLOGuc+aHfCsMAjEA0P/xwKr6NQ9MN7vrfGAzO397PApdqfM7VdFK18aEu1xm -3HMFKzIR8eEPsMx4smMl ------END CERTIFICATE----- diff --git a/certs-staging/letsencrypt-stg-int-e2.pem b/certs-staging/letsencrypt-stg-int-e2.pem deleted file mode 100644 index 931ff9b..0000000 --- a/certs-staging/letsencrypt-stg-int-e2.pem +++ /dev/null @@ -1,19 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDCjCCApCgAwIBAgIQQuJJzkyQeLKT5OSWP41qRTAKBggqhkjOPQQDAzBoMQsw -CQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3VyaXR5 -IFJlc2VhcmNoIEdyb3VwMSQwIgYDVQQDExsoU1RBR0lORykgQm9ndXMgQnJvY2Nv -bGkgWDIwHhcNMjAwOTA0MDAwMDAwWhcNMjUwOTE1MTYwMDAwWjBVMQswCQYDVQQG -EwJVUzEgMB4GA1UEChMXKFNUQUdJTkcpIExldCdzIEVuY3J5cHQxJDAiBgNVBAMT -GyhTVEFHSU5HKSBFcnNhdHogRWRhbWFtZSBFMjB2MBAGByqGSM49AgEGBSuBBAAi -A2IABEpsxJnmT3EQu6hL6LeYyvVggZd1aOj6QepgX+mdhOYxCgAvb4etuL80y7EP -sUUJh3Y20WhgXsZW21jukrL+PzdKfctcRoOM7CFBBk+09Ubalyys69O99+B6doRx -GYWWp6OCARAwggEMMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcD -AgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUbPiNRb5I -GjoDUBH28pJdQ2OphogwHwYDVR0jBBgwFoAU3tGjWWQOwZo2o0busBB2766XlWYw -NgYIKwYBBQUHAQEEKjAoMCYGCCsGAQUFBzAChhpodHRwOi8vc3RnLXgyLmkubGVu -Y3Iub3JnLzArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3RnLXgyLmMubGVuY3Iu -b3JnLzAiBgNVHSAEGzAZMAgGBmeBDAECATANBgsrBgEEAYLfEwEBATAKBggqhkjO -PQQDAwNoADBlAjEAv19ESEwzY8fAt1WkE4Nkm6bJxQEJZwILGNnvPuEmAKlngKov -dm1feBw0q45Fl8MEAjA24IoWYt7txJSbPQpxETJfsjO8aLWxedQpqHWS1x0zEB4L -K5uFc99+L56DIgmqjKM= ------END CERTIFICATE----- diff --git a/certs-staging/letsencrypt-stg-int-r3.pem b/certs-staging/letsencrypt-stg-int-r3.pem deleted file mode 100644 index 0282fc1..0000000 --- a/certs-staging/letsencrypt-stg-int-r3.pem +++ /dev/null @@ -1,31 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFWzCCA0OgAwIBAgIQTfQrldHumzpMLrM7jRBd1jANBgkqhkiG9w0BAQsFADBm -MQswCQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3Vy -aXR5IFJlc2VhcmNoIEdyb3VwMSIwIAYDVQQDExkoU1RBR0lORykgUHJldGVuZCBQ -ZWFyIFgxMB4XDTIwMDkwNDAwMDAwMFoXDTI1MDkxNTE2MDAwMFowWTELMAkGA1UE -BhMCVVMxIDAeBgNVBAoTFyhTVEFHSU5HKSBMZXQncyBFbmNyeXB0MSgwJgYDVQQD -Ex8oU1RBR0lORykgQXJ0aWZpY2lhbCBBcHJpY290IFIzMIIBIjANBgkqhkiG9w0B -AQEFAAOCAQ8AMIIBCgKCAQEAu6TR8+74b46mOE1FUwBrvxzEYLck3iasmKrcQkb+ -gy/z9Jy7QNIAl0B9pVKp4YU76JwxF5DOZZhi7vK7SbCkK6FbHlyU5BiDYIxbbfvO -L/jVGqdsSjNaJQTg3C3XrJja/HA4WCFEMVoT2wDZm8ABC1N+IQe7Q6FEqc8NwmTS -nmmRQm4TQvr06DP+zgFK/MNubxWWDSbSKKTH5im5j2fZfg+j/tM1bGaczFWw8/lS -nukyn5J2L+NJYnclzkXoh9nMFnyPmVbfyDPOc4Y25aTzVoeBKXa/cZ5MM+WddjdL -biWvm19f1sYn1aRaAIrkppv7kkn83vcth8XCG39qC2ZvaQIDAQABo4IBEDCCAQww -DgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAS -BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTecnpI3zHDplDfn4Uj31c3S10u -ZTAfBgNVHSMEGDAWgBS182Xy/rAKkh/7PH3zRKCsYyXDFDA2BggrBgEFBQcBAQQq -MCgwJgYIKwYBBQUHMAKGGmh0dHA6Ly9zdGcteDEuaS5sZW5jci5vcmcvMCsGA1Ud -HwQkMCIwIKAeoByGGmh0dHA6Ly9zdGcteDEuYy5sZW5jci5vcmcvMCIGA1UdIAQb -MBkwCAYGZ4EMAQIBMA0GCysGAQQBgt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCN -DLam9yN0EFxxn/3p+ruWO6n/9goCAM5PT6cC6fkjMs4uas6UGXJjr5j7PoTQf3C1 -vuxiIGRJC6qxV7yc6U0X+w0Mj85sHI5DnQVWN5+D1er7mp13JJA0xbAbHa3Rlczn -y2Q82XKui8WHuWra0gb2KLpfboYj1Ghgkhr3gau83pC/WQ8HfkwcvSwhIYqTqxoZ -Uq8HIf3M82qS9aKOZE0CEmSyR1zZqQxJUT7emOUapkUN9poJ9zGc+FgRZvdro0XB -yphWXDaqMYph0DxW/10ig5j4xmmNDjCRmqIKsKoWA52wBTKKXK1na2ty/lW5dhtA -xkz5rVZFd4sgS4J0O+zm6d5GRkWsNJ4knotGXl8vtS3X40KXeb3A5+/3p0qaD215 -Xq8oSNORfB2oI1kQuyEAJ5xvPTdfwRlyRG3lFYodrRg6poUBD/8fNTXMtzydpRgy -zUQZh/18F6B/iW6cbiRN9r2Hkh05Om+q0/6w0DdZe+8YrNpfhSObr/1eVZbKGMIY -qKmyZbBNu5ysENIK5MPc14mUeKmFjpN840VR5zunoU52lqpLDua/qIM8idk86xGW -xx2ml43DO/Ya/tVZVok0mO0TUjzJIfPqyvr455IsIut4RlCR9Iq0EDTve2/ZwCuG -hSjpTUFGSiQrR2JK2Evp+o6AETUkBCO1aw0PpQBPDQ== ------END CERTIFICATE----- diff --git a/certs-staging/letsencrypt-stg-int-r4.pem b/certs-staging/letsencrypt-stg-int-r4.pem deleted file mode 100644 index 7e482dc..0000000 --- a/certs-staging/letsencrypt-stg-int-r4.pem +++ /dev/null @@ -1,31 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFWzCCA0OgAwIBAgIQaCYQ95QBw3BbcmLyhdXHzjANBgkqhkiG9w0BAQsFADBm -MQswCQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3Vy -aXR5IFJlc2VhcmNoIEdyb3VwMSIwIAYDVQQDExkoU1RBR0lORykgUHJldGVuZCBQ -ZWFyIFgxMB4XDTIwMDkwNDAwMDAwMFoXDTI1MDkxNTE2MDAwMFowWTELMAkGA1UE -BhMCVVMxIDAeBgNVBAoTFyhTVEFHSU5HKSBMZXQncyBFbmNyeXB0MSgwJgYDVQQD -Ex8oU1RBR0lORykgQXJ0aWZpY2lhbCBBcHJpY290IFI0MIIBIjANBgkqhkiG9w0B -AQEFAAOCAQ8AMIIBCgKCAQEA6J8Tmlh6z62axF2+KzRgHHmxf0c5LHGA+wVx9ukJ -nB9zkqdG+gyGfYBnwPlxny0JWBS/1/wu7ry+IhtYOqar1Rg+f+gD0+SqOYmngNW8 -IIw0WTjHhqYB2d2Fxsr9bPIpDwpHRbgE8HkozAKwrWs5xDthZlaMZfEyAKzdx8mC -PttZzKW4ubSptmNMoGHx5t/pBWrNGz5EFuTYcy0DkknMvKedkVJn+jJBxVQ/ef/y -Gep7+1WjpW/UQvwJ5H2sm6UtBRAfos5U2TubN7fiI9OGsRmIp73BP9TsyP0Mi1rZ -kVAfMEU6pI5dJXTNt6hmzuE6frt+NlHaC9yrs9iEG1m6DQIDAQABo4IBEDCCAQww -DgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAS -BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSa7sAVo3Q7x+zxBWCmwpOn+U8a -NTAfBgNVHSMEGDAWgBS182Xy/rAKkh/7PH3zRKCsYyXDFDA2BggrBgEFBQcBAQQq -MCgwJgYIKwYBBQUHMAKGGmh0dHA6Ly9zdGcteDEuaS5sZW5jci5vcmcvMCsGA1Ud -HwQkMCIwIKAeoByGGmh0dHA6Ly9zdGcteDEuYy5sZW5jci5vcmcvMCIGA1UdIAQb -MBkwCAYGZ4EMAQIBMA0GCysGAQQBgt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCw -o/xtzOLhliWC6F6XTdgCqt2FrjLQAXRUnCwnwg44oVbD+Gh9qXREpdpRPVrlIS7T -tobw8Z329nsLZ+wiGvm3wkC3Ka3RWbThLE/MuwVMysaTi5jXLJcQLvHRlW00jHgM -/V8vtJPr5s443KuOX1TFUV5Z/0ZilrBY3sAbgVk2n/fgyonX/JCdiGXt3HODpBh3 -eJH1kKM/EIrVVZwxHCwG1x/LuKpcUpbelF+NDI11neL+AzhU6wmBhgplg4OxzYWD -Xg0LCi6W0/t73HnG8SaRiCAcPyJOGBZtLQLUgfVKSd6DtRMhVcTzM6EjFiJYZuv4 -JHj65p1yFh8+kgJL/kyIWp2+mHgj/QCDaQEJccmWl+dpXm0jyyNBbjKG7oOlCzvH -HEBmrYSlzWI4XcK5C2+1SmSQqXv7vPo8jEVXSftg4Z6mEA8e2S6dt/rvreiQ+fDm -gixNiQRd7lkUqPv1EZhiGMYxhW52taj9A3xlcnD9/tfD7BKFe38ilVblYTU423WY -zAslpz6oDEiftKCZ2VmaUzEsS6Hma/r/SkF5oorVlaz7hE1qcu9HLkRohXPJtw3k -XJcK1hT3rITPasaSTREfwKBQS+y6guxv+IpkZftMEiOUix2cRoICJesxsYDE5tei -Pwrakf/zlLfF4WDZVqrYKsddVqddAoa64LfXxS/B4Q== ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-e1.pem b/certs/lets-encrypt-e1.pem deleted file mode 100644 index 2a19d41..0000000 --- a/certs/lets-encrypt-e1.pem +++ /dev/null @@ -1,17 +0,0 @@ ------BEGIN CERTIFICATE----- -MIICxjCCAk2gAwIBAgIRALO93/inhFu86QOgQTWzSkUwCgYIKoZIzj0EAwMwTzEL -MAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNo -IEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjAwOTA0MDAwMDAwWhcN -MjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5j -cnlwdDELMAkGA1UEAxMCRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQkXC2iKv0c -S6Zdl3MnMayyoGli72XoprDwrEuf/xwLcA/TmC9N/A8AmzfwdAVXMpcuBe8qQyWj -+240JxP2T35p0wKZXuskR5LBJJvmsSGPwSSB/GjMH2m6WPUZIvd0xhajggEIMIIB -BDAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMB -MBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFFrz7Sv8NsI3eblSMOpUb89V -yy6sMB8GA1UdIwQYMBaAFHxClq7eS0g7+pL4nozPbYupcjeVMDIGCCsGAQUFBwEB -BCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gyLmkubGVuY3Iub3JnLzAnBgNVHR8E -IDAeMBygGqAYhhZodHRwOi8veDIuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYG -Z4EMAQIBMA0GCysGAQQBgt8TAQEBMAoGCCqGSM49BAMDA2cAMGQCMHt01VITjWH+ -Dbo/AwCd89eYhNlXLr3pD5xcSAQh8suzYHKOl9YST8pE9kLJ03uGqQIwWrGxtO3q -YJkgsTgDyj2gJrjubi1K9sZmHzOa25JK1fUpE8ZwYii6I4zPPS/Lgul/ ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-e2.pem b/certs/lets-encrypt-e2.pem deleted file mode 100644 index 0fd9f40..0000000 --- a/certs/lets-encrypt-e2.pem +++ /dev/null @@ -1,17 +0,0 @@ ------BEGIN CERTIFICATE----- -MIICxjCCAkygAwIBAgIQTtI99q9+x/mwxHJv+VEqdzAKBggqhkjOPQQDAzBPMQsw -CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg -R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw0y -NTA5MTUxNjAwMDBaMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNy -eXB0MQswCQYDVQQDEwJFMjB2MBAGByqGSM49AgEGBSuBBAAiA2IABCOaLO3lixmN -YVWex+ZVYOiTLgi0SgNWtU4hufk50VU4Zp/LbBVDxCsnsI7vuf4xp4Cu+ETNggGE -yBqJ3j8iUwe5Yt/qfSrRf1/D5R58duaJ+IvLRXeASRqEL+VkDXrW3qOCAQgwggEE -MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEw -EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUbZkq9U0C6+MRwWC6km+NPS7x -6kQwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEE -JjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMCcGA1UdHwQg -MB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wIgYDVR0gBBswGTAIBgZn -gQwBAgEwDQYLKwYBBAGC3xMBAQEwCgYIKoZIzj0EAwMDaAAwZQIxAPJCN9qpyDmZ -tX8K3m8UYQvK51BrXclM6WfrdeZlUBKyhTXUmFAtJw4X6A0x9mQFPAIwJa/No+KQ -UAM1u34E36neL/Zba7ombkIOchSgx1iVxzqtFWGddgoG+tppRPWhuhhn ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-r3-cross-signed.pem b/certs/lets-encrypt-r3-cross-signed.pem deleted file mode 100644 index 1d82449..0000000 --- a/certs/lets-encrypt-r3-cross-signed.pem +++ /dev/null @@ -1,26 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/ -MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT -DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow -MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT -AlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs -jVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp -Tm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB -U840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7 -gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel -/xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R -oYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E -BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p -ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE -p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE -AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu -Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0 -LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf -r52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B -AQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH -ejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8 -S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL -qjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p -O5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw -UdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg== ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-r3.pem b/certs/lets-encrypt-r3.pem deleted file mode 100644 index 43b222a..0000000 --- a/certs/lets-encrypt-r3.pem +++ /dev/null @@ -1,30 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw -TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh -cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw -WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg -RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK -AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP -R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx -sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm -NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg -Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG -/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC -AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB -Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA -FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw -AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw -Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB -gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W -PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl -ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz -CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm -lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4 -avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2 -yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O -yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids -hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+ -HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv -MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX -nLRbwHOoq7hHwg== ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-r4-cross-signed.pem b/certs/lets-encrypt-r4-cross-signed.pem deleted file mode 100644 index f0ed3cd..0000000 --- a/certs/lets-encrypt-r4-cross-signed.pem +++ /dev/null @@ -1,26 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEZTCCA02gAwIBAgIQQAF1BIMlO+Rkt3exI9CKgjANBgkqhkiG9w0BAQsFADA/ -MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT -DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0NVoXDTIxMDkyOTE5MjE0NVow -MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT -AlI0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsyjcdynT55G+87cK -AMf78lULJSJjUzav6Qgg3w2vKD7NxqtXtp2kJRml0jJtSaYIuccvoZuTxSBAa4Qx -IKKOMGAlYO/ZGok/H2lxstrqP3NBxJBvZv19nljYd8/NWXVEyaEKe58/Gw46Zm+2 -dc+Ly6+dwHDF/9KCCq9dzeLonIWUpOYANeh+TjmBxyGJYHfqHZbyi4N7R8RtMsBS -fiMeRbVx7qPvF8IDqZOJ3fWf27rx2uB+l4dxgR4aglbkPnwYogjlFl+o+qjgSFFN -GBSgDKPltsqztVUSa3LHWn87jPnn2dGOEk0zMwMq8RPhQjzCLllgLm3gB0czZd/S -Z8pNhQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E -BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p -ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE -p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE -AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu -Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0 -LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFDadPuCxQPYnLHy/jZ0x -ivZUpkYmMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B -AQsFAAOCAQEAN4CpgPmK2C5pq/RdV9gEdWcvPnPfT9ToucrAMTcn//wyWBWF2wG4 -hvPBQxxuqPECZsi4nLQ45VJpyC1NDd0GqGQIMqNdC4N4TLDtd7Yhy8v5JsfEMUbb -6xW4sKeeeKy3afOkel60Xg1/7ndSmppiHqdh+TdJML1hptRgdxGiB8LMpHuW/oM8 -akfyt4TkBhA8+Wu8MM6dlJyJ7nHBVnEUFQ4Ni+GzNC/pQSL2+Y9Mq4HHIk2ZFy0W -B8KsVwdeNrERPL+LjhhLde1Et0aL9nlv4CqwXHML2LPgk38j/WllbQ/8HRd2VpB+ -JW6Z8JNhcnuBwATHMCeJVCFapoZsPfQQ6Q== ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-r4.pem b/certs/lets-encrypt-r4.pem deleted file mode 100644 index 578b3bd..0000000 --- a/certs/lets-encrypt-r4.pem +++ /dev/null @@ -1,30 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFFjCCAv6gAwIBAgIRAIp5IlCr5SxSbO7Pf8lC3WIwDQYJKoZIhvcNAQELBQAw -TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh -cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw -WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg -RW5jcnlwdDELMAkGA1UEAxMCUjQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK -AoIBAQCzKNx3KdPnkb7ztwoAx/vyVQslImNTNq/pCCDfDa8oPs3Gq1e2naQlGaXS -Mm1Jpgi5xy+hm5PFIEBrhDEgoo4wYCVg79kaiT8faXGy2uo/c0HEkG9m/X2eWNh3 -z81ZdUTJoQp7nz8bDjpmb7Z1z4vLr53AcMX/0oIKr13N4uichZSk5gA16H5OOYHH -IYlgd+odlvKLg3tHxG0ywFJ+Ix5FtXHuo+8XwgOpk4nd9Z/buvHa4H6Xh3GBHhqC -VuQ+fBiiCOUWX6j6qOBIUU0YFKAMo+W2yrO1VRJrcsdafzuM+efZ0Y4STTMzAyrx -E+FCPMIuWWAubeAHRzNl39Jnyk2FAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC -AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB -Af8CAQAwHQYDVR0OBBYEFDadPuCxQPYnLHy/jZ0xivZUpkYmMB8GA1UdIwQYMBaA -FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw -AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw -Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB -gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCJbu5CalWO+H+Az0lmIG14DXmlYHQE -k26umjuCyioWs2icOlZznPTcZvbfq02YPHGTCu3ctggVDULJ+fwOxKekzIqeyLNk -p8dyFwSAr23DYBIVeXDpxHhShvv0MLJzqqDFBTHYe1X5X2Y7oogy+UDJxV2N24/g -Z8lxG4Vr2/VEfUOrw4Tosl5Z+1uzOdvTyBcxD/E5rGgTLczmulctHy3IMTmdTFr0 -FnU0/HMQoquWQuODhFqzMqNcsdbjANUBwOEQrKI8Sy6+b84kHP7PtO+S4Ik8R2k7 -ZeMlE1JmxBi/PZU860YlwT8/qOYToCHVyDjhv8qutbf2QnUl3SV86th2I1QQE14s -0y7CdAHcHkw3sAEeYGkwCA74MO+VFtnYbf9B2JBOhyyWb5087rGzitu5MTAW41X9 -DwTeXEg+a24tAeht+Y1MionHUwa4j7FB/trN3Fnb/r90+4P66ZETVIEcjseUSMHO -w6yqv10/H/dw/8r2EDUincBBX3o9DL3SadqragkKy96HtMiLcqMMGAPm0gti1b6f -bnvOdr0mrIVIKX5nzOeGZORaYLoSD4C8qvFT7U+Um6DMo36cVDNsPmkF575/s3C2 -CxGiCPQqVxPgfNSh+2CPd2Xv04lNeuw6gG89DlOhHuoFKRlmPnom+gwqhz3ZXMfz -TfmvjrBokzCICA== ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-x1-cross-signed.pem b/certs/lets-encrypt-x1-cross-signed.pem deleted file mode 100644 index 8a92a0b..0000000 --- a/certs/lets-encrypt-x1-cross-signed.pem +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEqDCCA5CgAwIBAgIRAJgT9HUT5XULQ+dDHpceRL0wDQYJKoZIhvcNAQELBQAw -PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD -Ew5EU1QgUm9vdCBDQSBYMzAeFw0xNTEwMTkyMjMzMzZaFw0yMDEwMTkyMjMzMzZa -MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD -ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMTCCASIwDQYJKoZIhvcNAQEBBQAD -ggEPADCCAQoCggEBAJzTDPBa5S5Ht3JdN4OzaGMw6tc1Jhkl4b2+NfFwki+3uEtB -BaupnjUIWOyxKsRohwuj43Xk5vOnYnG6eYFgH9eRmp/z0HhncchpDpWRz/7mmelg -PEjMfspNdxIknUcbWuu57B43ABycrHunBerOSuu9QeU2mLnL/W08lmjfIypCkAyG -dGfIf6WauFJhFBM/ZemCh8vb+g5W9oaJ84U/l4avsNwa72sNlRZ9xCugZbKZBDZ1 -gGusSvMbkEl4L6KWTyogJSkExnTA0DHNjzE4lRa6qDO4Q/GxH8Mwf6J5MRM9LTb4 -4/zyM2q5OTHFr8SNDR1kFjOq+oQpttQLwNh9w5MCAwEAAaOCAZIwggGOMBIGA1Ud -EwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMH8GCCsGAQUFBwEBBHMwcTAy -BggrBgEFBQcwAYYmaHR0cDovL2lzcmcudHJ1c3RpZC5vY3NwLmlkZW50cnVzdC5j -b20wOwYIKwYBBQUHMAKGL2h0dHA6Ly9hcHBzLmlkZW50cnVzdC5jb20vcm9vdHMv -ZHN0cm9vdGNheDMucDdjMB8GA1UdIwQYMBaAFMSnsaR7LHH62+FLkHX/xBVghYkQ -MFQGA1UdIARNMEswCAYGZ4EMAQIBMD8GCysGAQQBgt8TAQEBMDAwLgYIKwYBBQUH -AgEWImh0dHA6Ly9jcHMucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcwPAYDVR0fBDUw -MzAxoC+gLYYraHR0cDovL2NybC5pZGVudHJ1c3QuY29tL0RTVFJPT1RDQVgzQ1JM -LmNybDATBgNVHR4EDDAKoQgwBoIELm1pbDAdBgNVHQ4EFgQUqEpqYwR93brm0Tm3 -pkVl7/Oo7KEwDQYJKoZIhvcNAQELBQADggEBANHIIkus7+MJiZZQsY14cCoBG1hd -v0J20/FyWo5ppnfjL78S2k4s2GLRJ7iD9ZDKErndvbNFGcsW+9kKK/TnY21hp4Dd -ITv8S9ZYQ7oaoqs7HwhEMY9sibED4aXw09xrJZTC9zK1uIfW6t5dHQjuOWv+HHoW -ZnupyxpsEUlEaFb+/SCI4KCSBdAsYxAcsHYI5xxEI4LutHp6s3OT2FuO90WfdsIk -6q78OMSdn875bNjdBYAqxUp2/LEIHfDBkLoQz0hFJmwAbYahqKaLn73PAAm1X2kj -f1w8DdnkabOLGeOVcj9LQ+s67vBykx4anTjURkbqZslUEUsn2k5xeua2zUk= ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-x2-cross-signed.pem b/certs/lets-encrypt-x2-cross-signed.pem deleted file mode 100644 index c152625..0000000 --- a/certs/lets-encrypt-x2-cross-signed.pem +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEqDCCA5CgAwIBAgIRAMODTJjAvWslLKN5tm+lKw4wDQYJKoZIhvcNAQELBQAw -PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD -Ew5EU1QgUm9vdCBDQSBYMzAeFw0xNTEwMTkyMjM1MDFaFw0yMDEwMTkyMjM1MDFa -MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD -ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMjCCASIwDQYJKoZIhvcNAQEBBQAD -ggEPADCCAQoCggEBAOEkdEJ7t5Ex2XP/OKrYzkRctzkK3ESuDb1FuZc3Z6+9UE9f -0xBUa/dB2o5j5m1bwOhAqYxB/NEDif9iYQlg1gcFeJqQvRpkPk/cz3cviWvLZ69B -TcWNAMBr/o2E3LXylTGo6PaQoENKk3Rcsz5DaUuJIkd0UT6ZZMPNJAH5hC8odxci -p93DbAhMZi83dMVvk46wRjcWYdFQmMiwD09YU3ys9totlmFQrUPcCqZPnrVSuZyO -707fRrMx3CD8acKjIHU+7DgbNk5mZtLf9Wakky97pg6UPmA9Skscb7q0TRw8kVhu -L03E2nDb7QE5dsBJ5+k1tRQGkMHlkuIQ/Wu5tIUCAwEAAaOCAZIwggGOMBIGA1Ud -EwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMH8GCCsGAQUFBwEBBHMwcTAy -BggrBgEFBQcwAYYmaHR0cDovL2lzcmcudHJ1c3RpZC5vY3NwLmlkZW50cnVzdC5j -b20wOwYIKwYBBQUHMAKGL2h0dHA6Ly9hcHBzLmlkZW50cnVzdC5jb20vcm9vdHMv -ZHN0cm9vdGNheDMucDdjMB8GA1UdIwQYMBaAFMSnsaR7LHH62+FLkHX/xBVghYkQ -MFQGA1UdIARNMEswCAYGZ4EMAQIBMD8GCysGAQQBgt8TAQEBMDAwLgYIKwYBBQUH -AgEWImh0dHA6Ly9jcHMucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcwPAYDVR0fBDUw -MzAxoC+gLYYraHR0cDovL2NybC5pZGVudHJ1c3QuY29tL0RTVFJPT1RDQVgzQ1JM -LmNybDATBgNVHR4EDDAKoQgwBoIELm1pbDAdBgNVHQ4EFgQUxbGrTkyxzWQwk37B -hJkFq+YD4iUwDQYJKoZIhvcNAQELBQADggEBAAcSAhaE7rvHxyUnhgkEpMR56o2I -IH+mlw5kknjhAuvaBIAM59MZkFbFg5CrNWt8K+G3UoxJgFwv7HvJJxqwgPpNgXC/ -uT3prkvwt+2lvzKJKbqdH+lo40P8EuSyyJOz2hjrRzNMHbJHYDS9OhF5WC5LOQQa -ydgLZ/JHxXgJypEZqcmVgQ+yYBs0XPwXjE7OE8vbx5REwu7gToMIqAoWRoWW2MxS -g28RGPVnHzHk2XV1nZGy9T+NYQ91vWWJr1pzNEFZ0cnA2xGwTeJ+zZ3URCfw3Z1U -+YAL3YUmrvdoRBlASOTmNJmXSo9qvMYPa3DEomAPoFQFZqsSN6kuqDEIqMA= ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-x3-cross-signed.pem b/certs/lets-encrypt-x3-cross-signed.pem deleted file mode 100644 index 0002462..0000000 --- a/certs/lets-encrypt-x3-cross-signed.pem +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ -MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT -DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow -SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT -GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC -AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF -q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8 -SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0 -Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA -a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj -/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T -AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG -CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv -bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k -c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw -VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC -ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz -MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu -Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF -AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo -uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/ -wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu -X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG -PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 -KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== ------END CERTIFICATE----- diff --git a/certs/lets-encrypt-x4-cross-signed.pem b/certs/lets-encrypt-x4-cross-signed.pem deleted file mode 100644 index c0b4eb6..0000000 --- a/certs/lets-encrypt-x4-cross-signed.pem +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc6bLEeMfizANBgkqhkiG9w0BAQsFADA/ -MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT -DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDEwMloXDTIxMDMxNzE2NDEwMlow -SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT -GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFg0MIIBIjANBgkqhkiG9w0BAQEFAAOC -AQ8AMIIBCgKCAQEA4SR0Qnu3kTHZc/84qtjORFy3OQrcRK4NvUW5lzdnr71QT1/T -EFRr90HajmPmbVvA6ECpjEH80QOJ/2JhCWDWBwV4mpC9GmQ+T9zPdy+Ja8tnr0FN -xY0AwGv+jYTctfKVMajo9pCgQ0qTdFyzPkNpS4kiR3RRPplkw80kAfmELyh3FyKn -3cNsCExmLzd0xW+TjrBGNxZh0VCYyLAPT1hTfKz22i2WYVCtQ9wKpk+etVK5nI7v -Tt9GszHcIPxpwqMgdT7sOBs2TmZm0t/1ZqSTL3umDpQ+YD1KSxxvurRNHDyRWG4v -TcTacNvtATl2wEnn6TW1FAaQweWS4hD9a7m0hQIDAQABo4IBfTCCAXkwEgYDVR0T -AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG -CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv -bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k -c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw -VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC -ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz -MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu -Y3JsMB0GA1UdDgQWBBTFsatOTLHNZDCTfsGEmQWr5gPiJTANBgkqhkiG9w0BAQsF -AAOCAQEANlaeSdstfAtqFN3jdRZJFjx9X+Ob3PIDlekPYQ1OQ1Uw43rE1FUj7hUw -g2MJKfs9b7M0WoQg7C20nJY/ajsg7pWhUG3J6rlkDTfVY9faeWi0qsPYXE6BpBDr -5BrW/Xv8yT8U2BiEAmNggWq8dmFl82fghmLzHBM8X8NZ3ZwA1fGePA53AP5IoD+0 -ArpW8Ik1sSuQBjZ8oQLfN+G8OoY7MNRopyLyQQCNy4aWfE+xYnoVoa5+yr+aPiX0 -7YQrY/cKawAn7QB4PyF5//IKSAVs7mAuB68wbMdE3FKfOHfJ24W4z/bIJTrTY8Y5 -Sr4AUhtzf8oVDrHZYWRrP4joIcOu/Q== ------END CERTIFICATE----- diff --git a/certs/letsencryptauthorityx1.pem b/certs/letsencryptauthorityx1.pem deleted file mode 100644 index 0a9a3ce..0000000 --- a/certs/letsencryptauthorityx1.pem +++ /dev/null @@ -1,32 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFjTCCA3WgAwIBAgIRAOeTkL6SBwNJGF95dYHlyoMwDQYJKoZIhvcNAQELBQAw -TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh -cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTIwMDIw -WhcNMjAwNjA0MTIwMDIwWjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg -RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDEwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc0wzwWuUuR7dyXTeDs2hjMOrX -NSYZJeG9vjXxcJIvt7hLQQWrqZ41CFjssSrEaIcLo+N15Obzp2JxunmBYB/XkZqf -89B4Z3HIaQ6Vkc/+5pnpYDxIzH7KTXcSJJ1HG1rrueweNwAcnKx7pwXqzkrrvUHl -Npi5y/1tPJZo3yMqQpAMhnRnyH+lmrhSYRQTP2XpgofL2/oOVvaGifOFP5eGr7Dc -Gu9rDZUWfcQroGWymQQ2dYBrrErzG5BJeC+ilk8qICUpBMZ0wNAxzY8xOJUWuqgz -uEPxsR/DMH+ieTETPS02+OP88jNquTkxxa/EjQ0dZBYzqvqEKbbUC8DYfcOTAgMB -AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU -BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB -FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBSo -SmpjBH3duubRObemRWXv86jsoTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js -LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF -BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG -AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD -VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB -AGvM/XGv8yafGRGMPP6hnggoI9DGWGf4l0mzjBhuCkDVqoG/7rsH1ytzteePxiA3 -7kqSBo0fXu5GmbWOw09GpwPYyAAY0iWOMU6ybrTJHS466Urzoe/4IwLQoQc219EK -lh+4Ugu1q4KxNY1qMDA/1YX2Qm9M6AcAs1UvZKHSpJQAbsYrbN6obNoUGOeG6ONH -Yr8KRQz5FMfZYcA49fmdDTwKn/pyLOkJFeA/dm/oP99UmKCFoeOa5w9YJr2Vi7ic -Xd59CU8mprWhxFXnma1oU3T8ZNovjib3UHocjlEJfNbDy9zgKTYURcMVweo1dkbH -NbLc5mIjIk/kJ+RPD+chR+gJjy3Gh9xMNkDrZQKfsIO93hxTsZMmgZQ4c+vujC1M -jSak+Ai87YZeYQPh1fCGMSTno5III37DUCtIn8BJxJixuPeOMKsjLLD5AtMVy0fp -d19lcUek4bjDY8/Ujb5/wfn2+Kk7z72SxWdekjtHOWBmKxqq8jDuuMw4ymg1g5n7 -R7TZ/Y3y4bTpWUDkBHFo03xNM21wBFDIrCZZeVhvDW4MtT6+Ass2bcpoHwYcGol2 -gaLDa5k2dkG41OGtXa0fY+TjdryY4cOcstJUKjv2MJku4yaTtjjECX1rJvFLnqYe -wC+FmxjgWPuyRNuLDAWK30mmpcJZ3CmD6dFtAi4h7H37 ------END CERTIFICATE----- diff --git a/certs/letsencryptauthorityx2.pem b/certs/letsencryptauthorityx2.pem deleted file mode 100644 index 3a8e77c..0000000 --- a/certs/letsencryptauthorityx2.pem +++ /dev/null @@ -1,32 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFjTCCA3WgAwIBAgIRAJY2TKc4C+SL3JDGzeC33mgwDQYJKoZIhvcNAQELBQAw -TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh -cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTIwMDMx -WhcNMjAwNjA0MTIwMDMxWjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg -RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDIwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhJHRCe7eRMdlz/ziq2M5EXLc5 -CtxErg29RbmXN2evvVBPX9MQVGv3QdqOY+ZtW8DoQKmMQfzRA4n/YmEJYNYHBXia -kL0aZD5P3M93L4lry2evQU3FjQDAa/6NhNy18pUxqOj2kKBDSpN0XLM+Q2lLiSJH -dFE+mWTDzSQB+YQvKHcXIqfdw2wITGYvN3TFb5OOsEY3FmHRUJjIsA9PWFN8rPba -LZZhUK1D3AqmT561Urmcju9O30azMdwg/GnCoyB1Puw4GzZOZmbS3/VmpJMve6YO -lD5gPUpLHG+6tE0cPJFYbi9NxNpw2+0BOXbASefpNbUUBpDB5ZLiEP1rubSFAgMB -AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU -BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB -FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBTF -satOTLHNZDCTfsGEmQWr5gPiJTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js -LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF -BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG -AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD -VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB -AA4eqMjSEJKCF6XRR5pEutkS/e7xgy2vCYYbw1ospQiGQ4FO5TtbvO+5K4v7WR3b -1peMQ03rX0Dr+ylmGNypZahNxTqDiO0X2sHBwJWj/k61+MYq3bRYxKwI6cduTDXb -YQxilGTDNGZUIFKKIloz4zGAl68sj+8pLg534EqKgl8+rWSxclToS1KrydJezokE -dQRXfxu79iscWA3PIj1vbaUBB16lnWJxA3LhTGhUrhZrCnFuOZ93KO8kCKPM7EVo -7c4FCYKI8eWDsf0FF49A4xMUmxPJAPIyZkwQ8KkjpzcTHOmT4CEXUhNu9eMI9qBK -VSFDDMifJ8HzCaVLyMvY1Kf7iR+840EkX1EGC+Z39EaK1hjm314LYpLoYGvYYLJO -/J76XAx8ZgpofqHz1gAEfiMLMLxLQkOjKLXqoUEd5KdnzaO3aLH91gnasy8aD4D5 -9RfEO2xcaozD2rbYsoAMVzcZZHw0Smdmobaz2YazMBjFRcqGntg6s5Xqwusaleiy -snjMCC/9mvIPqGyuVnBPTBaUDFDEhX6qD2MX4dzODL91Z0ogYDWcFLN+uLnZKHje -4JoNuzkJ2FXWOREcsW93KXb+3T8COjhTDKvK4H6ufdrZxxusx60ajJAMBzW0XTf5 -nm2yGEDtyVoMgJLp0rkiPlormgHxSkFDOJbY94J7yxRK ------END CERTIFICATE----- diff --git a/certs/letsencryptauthorityx3.pem b/certs/letsencryptauthorityx3.pem deleted file mode 100644 index 4e82cb5..0000000 --- a/certs/letsencryptauthorityx3.pem +++ /dev/null @@ -1,32 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFjTCCA3WgAwIBAgIRANOxciY0IzLc9AUoUSrsnGowDQYJKoZIhvcNAQELBQAw -TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh -cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTYxMDA2MTU0MzU1 -WhcNMjExMDA2MTU0MzU1WjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg -RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDMwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc0wzwWuUuR7dyXTeDs2hjMOrX -NSYZJeG9vjXxcJIvt7hLQQWrqZ41CFjssSrEaIcLo+N15Obzp2JxunmBYB/XkZqf -89B4Z3HIaQ6Vkc/+5pnpYDxIzH7KTXcSJJ1HG1rrueweNwAcnKx7pwXqzkrrvUHl -Npi5y/1tPJZo3yMqQpAMhnRnyH+lmrhSYRQTP2XpgofL2/oOVvaGifOFP5eGr7Dc -Gu9rDZUWfcQroGWymQQ2dYBrrErzG5BJeC+ilk8qICUpBMZ0wNAxzY8xOJUWuqgz -uEPxsR/DMH+ieTETPS02+OP88jNquTkxxa/EjQ0dZBYzqvqEKbbUC8DYfcOTAgMB -AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU -BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB -FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBSo -SmpjBH3duubRObemRWXv86jsoTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js -LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF -BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG -AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD -VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB -ABnPdSA0LTqmRf/Q1eaM2jLonG4bQdEnqOJQ8nCqxOeTRrToEKtwT++36gTSlBGx -A/5dut82jJQ2jxN8RI8L9QFXrWi4xXnA2EqA10yjHiR6H9cj6MFiOnb5In1eWsRM -UM2v3e9tNsCAgBukPHAg1lQh07rvFKm/Bz9BCjaxorALINUfZ9DD64j2igLIxle2 -DPxW8dI/F2loHMjXZjqG8RkqZUdoxtID5+90FgsGIfkMpqgRS05f4zPbCEHqCXl1 -eO5HyELTgcVlLXXQDgAWnRzut1hFJeczY1tjQQno6f6s+nMydLN26WuU4s3UYvOu -OsUxRlJu7TSRHqDC3lSE5XggVkzdaPkuKGQbGpny+01/47hfXXNB7HntWNZ6N2Vw -p7G6OfY+YQrZwIaQmhrIqJZuigsrbe3W+gdn5ykE9+Ky0VgVUsfxo52mwFYs1JKY -2PGDuWx8M6DlS6qQkvHaRUo0FMd8TsSlbF0/v965qGFKhSDeQoMpYnwcmQilRh/0 -ayLThlHLN81gSkJjVrPI0Y8xCVPB4twb1PFUd2fPM3sA1tJ83sZ5v8vgFv2yofKR -PB0t6JzUA81mSqM3kxl5e+IZwhYAyO0OTg3/fs8HqGTNKd9BqoUwSRBzp06JMg5b -rUCGwbCUDI0mxadJ3Bz4WxR6fyNpBK2yAinWEsikxqEt ------END CERTIFICATE----- diff --git a/certs/letsencryptauthorityx4.pem b/certs/letsencryptauthorityx4.pem deleted file mode 100644 index 34064da..0000000 --- a/certs/letsencryptauthorityx4.pem +++ /dev/null @@ -1,32 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFjTCCA3WgAwIBAgIRAJObmZ6kjhYNW0JZtD0gE9owDQYJKoZIhvcNAQELBQAw -TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh -cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTYxMDA2MTU0NDM0 -WhcNMjExMDA2MTU0NDM0WjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg -RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDQwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhJHRCe7eRMdlz/ziq2M5EXLc5 -CtxErg29RbmXN2evvVBPX9MQVGv3QdqOY+ZtW8DoQKmMQfzRA4n/YmEJYNYHBXia -kL0aZD5P3M93L4lry2evQU3FjQDAa/6NhNy18pUxqOj2kKBDSpN0XLM+Q2lLiSJH -dFE+mWTDzSQB+YQvKHcXIqfdw2wITGYvN3TFb5OOsEY3FmHRUJjIsA9PWFN8rPba -LZZhUK1D3AqmT561Urmcju9O30azMdwg/GnCoyB1Puw4GzZOZmbS3/VmpJMve6YO -lD5gPUpLHG+6tE0cPJFYbi9NxNpw2+0BOXbASefpNbUUBpDB5ZLiEP1rubSFAgMB -AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU -BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB -FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBTF -satOTLHNZDCTfsGEmQWr5gPiJTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js -LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF -BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG -AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD -VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB -AF4tI1yGjZgld9lP01+zftU3aSV0un0d2GKUMO7GxvwTLWAKQz/eT+u3J4+GvpD+ -BMfopIxkJcDCzMChjjZtZZwJpIY7BatVrO6OkEmaRNITtbZ/hCwNkUnbk3C7EG3O -GJZlo9b2wzA8v9WBsPzHpTvLfOr+dS57LLPZBhp3ArHaLbdk33lIONRPt9sseDEk -mdHnVmGmBRf4+J0Wy67mddOvz5rHH8uzY94raOayf20gzzcmqmot4hPXtDG4Y49M -oFMMT2kcWck3EOTAH6QiGWkGJ7cxMfSL3S0niA6wgFJtfETETOZu8AVDgENgCJ3D -S0bz/dhVKvs3WRkaKuuR/W0nnC2VDdaFj4+CRF8LGtn/8ERaH48TktH5BDyDVcF9 -zfJ75Scxcy23jAL2N6w3n/t3nnqoXt9Im4FprDr+mP1g2Z6Lf2YA0jE3kZalgZ6l -NHu4CmvJYoOTSJw9X2qlGl1K+B4U327rG1tRxgjM76pN6lIS02PMECoyKJigpOSB -u4V8+LVaUMezCJH9Qf4EKeZTHddQ1t96zvNd2s9ewSKx/DblXbKsBDzIdHJ+qi6+ -F9DIVM5/ICdtDdulOO+dr/BXB+pBZ3uVxjRANvJKKpdxkePyluITSNZHbanWRN07 -gMvwBWOL060i4VrL9er1sBQrRjU9iNpZQGTnLVAxQVFu ------END CERTIFICATE----- @@ -43,7 +43,7 @@ use warnings; # instance own by another user and created with umask 0177) is not a # problem since SOCKET_FD can be bound as root prior to the execve(2). -our $VERSION = '0.8.2'; +our $VERSION = '0.8.4'; my $PROTOCOL_VERSION = 1; my $NAME = 'lacme-client'; diff --git a/debian/changelog b/debian/changelog index b03a9b2..96c70fa 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,56 @@ +lacme (0.8.4-2) unstable; urgency=medium + + [ Luca Boccassi ] + * Install and use sysusers.d config files + + -- Guilhem Moulin <guilhem@debian.org> Tue, 21 Jul 2026 00:51:11 +0200 + +lacme (0.8.4-1) unstable; urgency=medium + + * New upstream bugfix release. + + accountd: Use PKCS#1 v1.5 signatures, as it's what JWT RS256 uses. + This change is needed for compatibility with libcrypt-openssl-rsa-perl + 0.38 and later. + * d/control: Remove `Rules-Requires-Root: no`. + * d/watch: Port to Version 5. + * Update Standards-Version to 4.7.4. + + Remove "Priority: optional" which is the current default and spelling it + out is no longer recommended per Policy. + * d/u/signing-key.asc: Upgrade to new packet format. + * Refresh d/patches. + + -- Guilhem Moulin <guilhem@debian.org> Mon, 20 Jul 2026 19:56:11 +0200 + +lacme (0.8.3-1) unstable; urgency=high + + * New upstream bugfix release. + + Fix post-issuance validation logic. We avoid pinning the intermediate + certificates in the bundle and instead validate the leaf certificate + with intermediates supplied during issuance as untrusted (used for chain + building only). Only the root certificates are used as trust anchor. + Not pinning intermediate certificates is in line with Let's Encrypt's + latest recommendations. + Closes: #1072847 + + Pass `-in /dev/stdin` option to openssl(1) to avoid warning with OpenSSL + 3.2 or later. + + Fix test suite to account for Let's Encrypt's (staging) ACME server + changes. + * d/control: Update Standards-Version to 4.7.0 (no changes necessary). + + -- Guilhem Moulin <guilhem@debian.org> Thu, 13 Jun 2024 17:56:33 +0200 + +lacme (0.8.2-1) unstable; urgency=medium + + * New upstream bugfix release. + + client: Handle "ready" → "processing" → "valid" status change during + newOrder, instead of just "ready" → "valid". The latter may be what we + observe when the server is fast enough, but according to RFC 8555 sec. + 7.1.6 the state actually transitions via "processing" state and we need + to account for that. Closes: #1034834. + + Test suite: Point stretch's archive URL to archive.d.o. + + -- Guilhem Moulin <guilhem@debian.org> Tue, 25 Apr 2023 20:08:21 +0200 + lacme (0.8.1-1) unstable; urgency=medium [ Guilhem Moulin ] diff --git a/debian/control b/debian/control index 3f8a096..d86f01f 100644 --- a/debian/control +++ b/debian/control @@ -1,18 +1,15 @@ Source: lacme Section: utils -Priority: optional Maintainer: Guilhem Moulin <guilhem@debian.org> -Build-Depends: debhelper-compat (= 13), jq, pandoc (>= 2.1~) -Rules-Requires-Root: no -Standards-Version: 4.6.2 +Build-Depends: debhelper-compat (= 13), dh-sequence-installsysusers, jq, pandoc (>= 2.1~) +Standards-Version: 4.7.4 Homepage: https://git.guilhem.org/lacme/about/ Vcs-Git: https://salsa.debian.org/debian/lacme.git -b debian/latest Vcs-Browser: https://salsa.debian.org/debian/lacme Package: lacme Architecture: all -Depends: adduser, - libconfig-tiny-perl, +Depends: libconfig-tiny-perl, libjson-perl, libnet-ssleay-perl, libtimedate-perl, diff --git a/debian/lacme.postinst b/debian/lacme.postinst deleted file mode 100755 index 536e37f..0000000 --- a/debian/lacme.postinst +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh - -set -e - -if [ "$1" = "configure" ]; then - if ! getent passwd _lacme-www >/dev/null; then - adduser --force-badname --system \ - --home /nonexistent --no-create-home \ - --gecos "lacme www user" \ - --quiet _lacme-www || true - fi - if ! getent passwd _lacme-client >/dev/null; then - adduser --force-badname --system \ - --home /nonexistent --no-create-home \ - --gecos "lacme client user" \ - --quiet _lacme-client || true - fi -fi - -#DEBHELPER# -exit 0 diff --git a/debian/lacme.sysusers b/debian/lacme.sysusers new file mode 100644 index 0000000..2134456 --- /dev/null +++ b/debian/lacme.sysusers @@ -0,0 +1,2 @@ +u! _lacme-www -:nogroup "lacme www user" /nonexistent +u! _lacme-client -:nogroup "lacme client user" /nonexistent diff --git a/debian/patches/Mention-the-Debian-BTS-in-the-manpages.patch b/debian/patches/Mention-the-Debian-BTS-in-the-manpages.patch index 24fad20..2937296 100644 --- a/debian/patches/Mention-the-Debian-BTS-in-the-manpages.patch +++ b/debian/patches/Mention-the-Debian-BTS-in-the-manpages.patch @@ -26,7 +26,7 @@ index 4933a78..272cd52 100644 ======== diff --git a/lacme.8.md b/lacme.8.md -index ad6dab6..33d7e11 100644 +index 65f1c36..31ebcca 100644 --- a/lacme.8.md +++ b/lacme.8.md @@ -499,6 +499,12 @@ restrictions: diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc index 8afec53..9815f7d 100644 --- a/debian/upstream/signing-key.asc +++ b/debian/upstream/signing-key.asc @@ -1,6 +1,6 @@ -----BEGIN PGP PUBLIC KEY BLOCK----- -mQINBFCXIGYBEADjtahMDYeKpR3aovhSymGabaQFtQMb4idCCZBXcm/QL6QbdCtl +xsFNBFCXIGYBEADjtahMDYeKpR3aovhSymGabaQFtQMb4idCCZBXcm/QL6QbdCtl RGF3FoTeYPxk7wmcAqpA3JV2Hkc0tB+pWOaDJTJFEasNuUlIzcaFnr2VqsLRLiTP LWNlnSLbUb8EtyUyaj5qkZY2e0LAUrNXGspNEqTOJUE3j8KXLpxXadjmDKDD4Z8o P2X1Qxb2VnNmJ6/T4lpCdTKpQE8gG8qpq2oQXuqoiezO6pudohimvVsKUTXcumlk @@ -11,7 +11,7 @@ tteyDH9nU/yvJ9pCsn5flR3jJCNC35AoxJnONZ0KKcVzzdcMG9uCf+PzH1gJi2f/ Y1yPr8a5kNltKL2jVs5Nut8R8i2UngjipMTWFFP+eJlJm3aQl9EbL31G9j0GnR4Y TZFk+MuTSqmZ4ZAzimT7ffDCIZQymrYyGGpJjdJP6bh/KcAZtrAdcj77CKlz0A+Q aaJ9hCtERjy2DSn+UqAGdcln7fdaMJ9TrqqAa03wO/QIU5MgJpH14HdHQQARAQAB -tA5HdWlsaGVtIE1vdWxpbokCVwQTAQoAQQIbAQULCQgHAwUVCgkICwUWAgMBAAIe +zQ5HdWlsaGVtIE1vdWxpbsLBlwQTAQoAQQIbAQULCQgHAwUVCgkICwUWAgMBAAIe AQIXgAIZARYhBHQg34a84VpFjc6ZdjknjagQnmJEBQJdkJ7ABQkRN9JaAAoJEDkn jagQnmJEExoP/jxRyCFWVWt70M2hPG0TWQ37AFTBghVzzAzCDWHJzJJzGc+XDb1d AvOFkodli09eKv4lA4CVCwQT7fXgzHZegKfSSttgpArH+OByiQMtV2RwfYnnrpJj @@ -23,8 +23,8 @@ arsm37XRemVcgZJqNYGJMzrEYVsNWpYH0TX/MMkGGVpB9wun0ylKN9NTlVrmYjMT HSp8g6/jrGmMnrWtsRsfgZ0aFwggxKRGSXvXl3p/kvCLB04Dt0hjrbGn7kOZq4s4 VneMLDoLNWmEQTXbpMmcuUneCe8OH8sT7f3/StVSHtoeBycnJG7ITZZRg4VvjLU2 fmK+03f1JWMektFwEwt1u9wjQNMXRYSRqA9EgkHVuGHdWw+DLsi0V5s3hjhBdCvq -lGcDILiUM8hHi72tEKeGx7FKdiF2mgY9C+Gb5WArRI9juAPonWe2ofwutCRHdWls -aGVtIE1vdWxpbiA8Z3VpbGhlbUBmcmlwb3N0Lm9yZz6JAlQEEwEKAD4CGwEFCwkI +lGcDILiUM8hHi72tEKeGx7FKdiF2mgY9C+Gb5WArRI9juAPonWe2ofwuzSRHdWls +aGVtIE1vdWxpbiA8Z3VpbGhlbUBmcmlwb3N0Lm9yZz7CwZQEEwEKAD4CGwEFCwkI BwMFFQoJCAsFFgIDAQACHgECF4AWIQR0IN+GvOFaRY3OmXY5J42oEJ5iRAUCXZCe wAUJETfSWgAKCRA5J42oEJ5iRBGMEACHG+IxN3/GwROdJmJEmtAFG5i8SgIbXe5M OpyYxojL4JUCZ9hB1dDm7nMSCvHzfrxIBOeK0hqKeUBWV1vwgiKA0o0ba+LNYezI @@ -37,8 +37,8 @@ B+ZGJJB8ktcKvu1Uc2w7WOigLICI6iim9lU7Ot27l4c+eDbUO0bf5NnlJeQTa+Q6 BHNmy5l+uuvL3PHl/BAlqYa4IvJPBMLl/H5AugbCBx40kSYo50AJdZ2Kt7bpXcoq Ex78gFLriFziYYUjqJaNx1DjeTvYE+hCDR2M5DTd3PO2PCeGVpe5IZpPaNusdwg6 ubreTpWCZft3O1tJoyui4qEChGKVjV5juZIHNhdrXnnW8q+gzIfm221CQHG3R3zX -YtRHhVTOurQrR3VpbGhlbSBNb3VsaW4gPGd1aWxoZW0ubW91bGluQGNoYWxtZXJz -LnNlPokCHwQwAQoACQUCV35wugIdIAAKCRA5J42oEJ5iRFB7D/44uGGQbYaxwWo9 +YtRHhVTOus0rR3VpbGhlbSBNb3VsaW4gPGd1aWxoZW0ubW91bGluQGNoYWxtZXJz +LnNlPsLBXwQwAQoACQUCV35wugIdIAAKCRA5J42oEJ5iRFB7D/44uGGQbYaxwWo9 mfzpkS2T3EVpwPzTasuEHB4E4prpP2UYjJP3f0i18K+rVYReHqp8LOXVQvg2HMsr EOHoSvdhuZq56glXWyTslCAOQGTc/AbFj/K2C72PhzoaS6Oq5hM4AW6ilMSGbEPR rr/Ys7oMhuLv0dlVYOZpcALeDO4c4sXK/XJnAOJgCbHPD+Miw+JSKZzMfQKmNenY @@ -49,8 +49,8 @@ MLSueddRo+KpGO6FlPI3vRnfDAi0WSdENWAzfEaz3K/ZuodaTzwy35Dg3wxGwHxD Y/b11XRwBHjn//Z1hBhw+2Rw7iIFSYMikpMVSZqNDDOcXJ2UXT49f9c3SC7xXz1U qJqtvxgS5He1D7pNUP0mrOsETsk4W3cl15Z1tlb6iiWkrK9ZSLIWBxOZSWp5YxVh MLssbMAzW3blyKZzAn12Am3ap40Pb0KJBA4cUHKV/Gj3JnSP9CDr0kTerlJKeIga -wRSc+84HpHHPc/xVxbwFHyzfFN7C+bQrR3VpbGhlbSBNb3VsaW4gPGd1aWxoZW0u -bW91bGluQGZyaXBvc3Qub3JnPokCUQQwAQoAOwUCVmx7AjQdAFN1YnN1bWVkIGJ5 +wRSc+84HpHHPc/xVxbwFHyzfFN7C+c0rR3VpbGhlbSBNb3VsaW4gPGd1aWxoZW0u +bW91bGluQGZyaXBvc3Qub3JnPsLBkQQwAQoAOwUCVmx7AjQdAFN1YnN1bWVkIGJ5 ICJHdWlsaGVtIE1vdWxpbiA8Z3VpbGhlbUBmcmlwb3N0Lm9yZz4iAAoJEDknjagQ nmJESF0QALfe4R+HP+L8ScT4msHjhc6bqlJkckaYO4An7mNUe7IEMoRirYET226x 9Ftc6PGPIaUPTg+xE/t2c8Jx3a929/kHeDE2VRqn8ANYICphDKF/W+Drviw/fKd6 @@ -62,8 +62,8 @@ dLfRLsEe58sj2iwmEIxXQX2yPiy7J09L3vDcLJl2l/6Oz6U0xEEyc9jN/QdXcsMK WcrtkCY4imUHDulzBoPtusIqYoccHPTkxoENRmEWtcTp7iZthhY8IxUpbFW/V92U WsVw87Z6MkYiwSxgeVtLxYPd8qdMAYQY3ehFStoNJnJR03PW+CZwGsIp1EntL0K1 huC8yq23N4rfUkV56EDQjDUWeEGbmwY5knYF1SMWD1eftXDhs8HeuqrPJ7MgHK8Z -+PmcCsOjl472gaNnf6unGASbSZ47mXMH35amLnIKwI1w4E0GoUbKtCxHdWlsaGVt -IE1vdWxpbiA8Z3VpbGhlbS5tb3VsaW5AZW5zLWx5b24ub3JnPokCVAQTAQoAPgIb ++PmcCsOjl472gaNnf6unGASbSZ47mXMH35amLnIKwI1w4E0GoUbKzSxHdWlsaGVt +IE1vdWxpbiA8Z3VpbGhlbS5tb3VsaW5AZW5zLWx5b24ub3JnPsLBlAQTAQoAPgIb AQULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBHQg34a84VpFjc6ZdjknjagQnmJE BQJdkJ7ABQkRN9JaAAoJEDknjagQnmJEP4EP/Rn1ImI75n/owCQGMdqiOfZpcXv3 wYnhME/3vAnxBoTvyLeVRAzEycUFTSl/Pzc8Ncu/WfmZ7eDDXKtgFIdNxJPAwz8k @@ -76,8 +76,8 @@ C4sMcpplG4zpEcz3PpOWFRbjRoL/XXQX1p/1gQYDt0cjF5Q5YPB8+JxluahQR2Tx RIdHiJphl/ctQbQtO5/e2/GkEvrlIBl1ymFrnXiQlPa9zaWJPz5iYEdoYwGFcqT8 q8KXhDUkrZ/j4857ztOuJJmI1BlZ4e10zjfDBHKOh389D+RJ3MrHkXhvvwxbyy+A LHqF5HV/BUz/d9ZLC6sXjcUjMMLOelT9odSN9iuNlLi/W+Pd1Rj5Qgylvz8AfILH -iphNiwR2Ik+AsX1MtCRHdWlsaGVtIE1vdWxpbiA8Z3VpbGhlbUBndWlsaGVtLm9y -Zz6JAlQEEwEKAD4CGwEFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQR0IN+GvOFa +iphNiwR2Ik+AsX1MzSRHdWlsaGVtIE1vdWxpbiA8Z3VpbGhlbUBndWlsaGVtLm9y +Zz7CwZQEEwEKAD4CGwEFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQR0IN+GvOFa RY3OmXY5J42oEJ5iRAUCXZCewAUJETfSWgAKCRA5J42oEJ5iRJC0D/wK7yX/AdmI 6Bo+r7/H3iDn3WoNNjIybfgnTsQ0k0DtMVim8LbjEhfUQXGhZOJh6MmG5IG+6ixM Ih4VjPlyia53L6mHO+PNA6M4+VyeCErboBl8OfURzAmPBLA0PkojO2o4gDD8k6aD @@ -89,8 +89,8 @@ rr9NpG1wopJ6WmyjbFF7q6LHXiMr+zwSnce1OY8slT2Olv+woHTkz9QEW3o8jBRZ 8cQkIIbnqP4oO79gzI8r0Vf2P9sKh41roBKR9jNqagKkQS7c/7bqzzMfWLItlv+0 8ayaNYfvBi9jLCMKmzPE0trrZIOscRMlugRxGewcCkFSG5tXZCk0xN6h/861ON3F qagbD28ZMyXyyezTTxBcNsMSMpTKI9ZuBQN5oRtO06Krjn5LaBmOtRfQthchZ/eV -lXCI5I4fwS3x82stlDejHgUQ2gCyaJ0kfbQoR3VpbGhlbSBNb3VsaW4gPGd1aWxo -ZW1AbGlicmVvZmZpY2Uub3JnPokCUwQTAQoAPQIbAQQLCQgHBRUKCQgLBRYCAwEA +lXCI5I4fwS3x82stlDejHgUQ2gCyaJ0kfc0oR3VpbGhlbSBNb3VsaW4gPGd1aWxo +ZW1AbGlicmVvZmZpY2Uub3JnPsLBkwQTAQoAPQIbAQQLCQgHBRUKCQgLBRYCAwEA Ah4BAheAFiEEdCDfhrzhWkWNzpl2OSeNqBCeYkQFAl2QnsEFCRE30loACgkQOSeN qBCeYkSsfg//da0Uj/vsNFmfVpv0JcRUVyxX1MRCOHcVwNQPW+NgpipELQ5lY9+y ti2XG6y3JG05QUs2ygOOyDqQQSIXzrMphKQIvG5cay9w2f7BHjB08X/pIJzqP/cs @@ -102,8 +102,8 @@ rMJHOE1DzxuaNnfXxHB/pejruyp27UF/OCi1NAd/x5vpM7QrIR8s9T24WEXZOD11 aNNqrYsrZVSG3QGx5s/kJckHBgxrxRSpLKMOwPhXtp9VPNJpWiFtM3a0AcH3VjuU cXMRjG/PAFjEC6/ymXpO6xJDDKg3iD1sKk2pe8m36NHgMkT8yHe0yYF3qdC99aFN l1kH0S1KEAXj7nxrUFYqbTvhc4saHojHItRCE4PjpOvrAehg8bcZ58tmPeVmo+lz -qoQAmHpnaXV612NdyshK85b5dt7kSA5+nw46wrrSZqz/3NSEmvMUA+q0I0d1aWxo -ZW0gTW91bGluIDxndWlsaGVtQGRlYmlhbi5vcmc+iQJTBBMBCgA9AhsBBAsJCAcF +qoQAmHpnaXV612NdyshK85b5dt7kSA5+nw46wrrSZqz/3NSEmvMUA+rNI0d1aWxo +ZW0gTW91bGluIDxndWlsaGVtQGRlYmlhbi5vcmc+wsGTBBMBCgA9AhsBBAsJCAcF FQoJCAsFFgIDAQACHgECF4AWIQR0IN+GvOFaRY3OmXY5J42oEJ5iRAUCXZCewQUJ ETfSWgAKCRA5J42oEJ5iRLncEACgG5hc4Rj713tUjISVbox76suWaks8Fs77OFQA WIbu21yzLiTwhnU4as8cSGN0x/FUsWSpfAxtSsYlUtFaPfT4nxT5IthYZ2PL6RYc @@ -116,7 +116,7 @@ TQLgf2truHd8wERHZ7CjOM2X4Buqx1rHHSouL7S/gRf+XnvtU/kc2fj9VtEJpB8f WcDXHKnm206+w8JTSVti6vOpWmTo8iO9Vcdi/NiKOwNg8DNITtcIxLgI54H1AP3y 7f1IUuKaDB/ITveSUBRqVtVEWlNUy9pbVqOJrAIjl7E9ouRu/QwTKM7XcWn3aJNa oQje1U24k3B4hhiPPcM/K2YwF8fnU+LOW/uvpF5cWWWELEsR+B47EnS0dX5SfVCw -+Xl8rLkCDQRQlyERARAAzi+R39PEKV7sLncMEvWHQTTGSUNRSD4hEOhB+PVhOUmj ++Xl8rM7BTQRQlyERARAAzi+R39PEKV7sLncMEvWHQTTGSUNRSD4hEOhB+PVhOUmj DSwglgGDZ4wfjKmmmgHREIGSan6bXOXW38Iepc+XB3NuGgMZHgo55mmRJydDqFC2 HP41Cruu91mOkOyTLbyg4lM7efi24xc3BPuxV4uFsEKaHUdhRTqiETxRTXqQCooq UeWsDZdc7uJUtdV70T7H8n/YHRtJnCue1r8QZP03Vzuav0KXB2ad4aqTAYeZz4C0 @@ -127,7 +127,7 @@ uTwjwcnaFz6/9EEAN8b1I9e74eXkSaSLHxyb53EsiX8nVEvYPDw0Eq2bgc/OXiR3 p4AyW2QIAbHy4K1KP3GLmy7tLl5a9Vzra5EvCtxnyBzSN5Ca2vyWTzh41yf++8fq BMoV/zvRz1nZ9MbajNXMPuf2wFLxLzDV8vB5TPmf1P5PQtkS/Tie6x57LpeS1bJl 0vs+8MdWAvnpxFX6L3lIq3r7oXnlJceO5VapMkdm9eH1adpr4Ef/zt7B2k98s5MA -EQEAAYkEWwQYAQoAJgIbAhYhBHQg34a84VpFjc6ZdjknjagQnmJEBQJdkJmsBQkR +EQEAAcLDmwQYAQoAJgIbAhYhBHQg34a84VpFjc6ZdjknjagQnmJEBQJdkJmsBQkR N8ybAinBXSAEGQEIAAYFAlCXIREACgkQ05pJnDwhpVJVhhAAhoyf+ONzqGNacWB1 kWQlmuyPmraoLiGk9hY/TRr9g6g4VHqRffmaW+iqUmBKb4xiRkAZ+YEftruDudsH yJsVyw181mkHLvPLf4wc/Ywaz+O5rY+/jO52w5T+Yx5zxVbuHnL1Z2YqINvbPWrU @@ -150,7 +150,7 @@ HhTjuQFPExUDzP4fogrIW9NyLBMe6S7NSVhFk7OeiHC/QF1deWWBlfzknJ1oyIID bUUYlVUGPyUQgRlBazXPxKIVhXcJ0k2sHu3rUEpdu8aa9nU9vdMrqgLHvcDqwylp q3iFLu7wjn1SUOra7BLUVnTJRKy5ie3X4RYCaq1jzgE19KyoDI5amIt4YgMj160z 8F/ycEiVGj2bcwMus+fyHQo6TkYDTudW5hcLyH1XkpXIVNx5WuoMyJWSXwIrEq96 -e2oWfvwOesN3w08V+HWPd5mRuQINBFCXIWkBEADYqxLU/iHbhzsFh0uRw4XwVhaw +e2oWfvwOesN3w08V+HWPd5mRzsFNBFCXIWkBEADYqxLU/iHbhzsFh0uRw4XwVhaw mUsWSXycQp9bn+aDG9oTb/VYgQDpHEwEX3uba4qCSeOdV9Vs2aksz7xI4wNUFjrI IpzkPJth1bu2qbUYtezgq0HMuS2w/BbnuoNbvBTKl5vEjE1/AmLyP9tMpSZjBIqP KdxtkK0np3NOxjd00Dj+YceRKa2SZU0ueqh+VQyzfaTfupMMNuI0DpN1Q6rjr2is @@ -161,7 +161,7 @@ f0ryBNE32ZPIevRNJT/SVDJIpt0JARzVdKpkQG8eKnH1EHngQDEnBCPYOrL3rOxN OVqoWBy2DUkHpvhCnowND1W+t3ya/rXEzfEq3SOc34T/wcclGJdJtkTS417ix1ix eEl7IbDqv5i3vXKpPk+O6t30Sk5QZpQu+fanlJJAjZStZJn1bbNFOx8X1r738STk 6mhqT8+8Z/4ciFG7fnH4AQW+mAZJ8Zndvz7PvVwj+GVw49utmwDzCChHgSwDl+eU -WJE6Ig01JoszE7zXHwARAQABiQI8BBgBCgAmAhsMFiEEdCDfhrzhWkWNzpl2OSeN +WJE6Ig01JoszE7zXHwARAQABwsF8BBgBCgAmAhsMFiEEdCDfhrzhWkWNzpl2OSeN qBCeYkQFAl2QmbgFCRE3zEMACgkQOSeNqBCeYkToJA/+LgryFWW746I7i2Zc3JOU Y9y8rBb+c+ZY54aBQYJO0QQ3las3pxgbLDuRL8IyF0DKAxTw0GbOgFDnORZuI51f Q49ND7I673aPX+f5tHgEwpR53DtRjdhqQ1RHzZ4sXjUQiEPSd/NgbSi/Rw8I3ROh @@ -173,7 +173,7 @@ TzaRlnr9IhFyZqASokSVaPmvR9oHCQEjP/cBQR2sRQm4gqKMHr7gIb1DmIxrewJB vGJGuoF8+cwPGxA5kZXUDGzSJScm/zU9w70voHJ62onFEth4iI93S6ssinNu7sOo V91FFLZ89xvzCCslX1VDGRcUaxB0AKET5ahQOnB7nEGv6v6yFhrlVGS+93ryseel frEG3yBwdjhYO8JGrIA5HJP8Q6sqo747sq5UfVc+8eRZotPfjykuouCe646uvwB6 -lEqmVWVRUYtqmZpHLjim4zS5Ag0EUJchrwEQALOrqpCPddr8PPTdRBmSGorqwdmk +lEqmVWVRUYtqmZpHLjim4zTOwU0EUJchrwEQALOrqpCPddr8PPTdRBmSGorqwdmk TUHPNRd36VbQJPJt0/8ZAJh6J5KZo9Bzv0nE07Iwcz5bev7iCM9dTR0UaLj7zlS+ VwFbdUmjfxie8iIlZB4l3pmKXShag9zJTYyt/0HUU3RytJoiGigsVX1O/qNSM+QW xrPGsIg8YmRSbQ3PwOsc4udEAqL2/pZni+raf/TAS8SQbJHm2K9ebHSQ8ZBbvap0 @@ -184,7 +184,7 @@ ms0RXMuxmdwioWYHE5wChNZQocnHb2fnwuAmoZzRj7IZzcsZvYPpT6Ld/dKWVnIM WaZ3vsQx4yF2morULH0Yrb4wrXzK1vASDRgW9G2Im/y7woZn609r3LNA2ELioEHF j1hQyd1wqgIRXDvs9ltM4xZusEO7McS9yF/Ywm8EjWaWznabD/OOo8ul1NzR2sKi qojCyOgcPYp4udK0e7+4FntKEiallyuFQjbA6RGzZsnsJ28Uyb3qfQCQJyzRL+cT -dlCM92EwfgHVnJPXABEBAAGJAjwEGAEKACYCGyAWIQR0IN+GvOFaRY3OmXY5J42o +dlCM92EwfgHVnJPXABEBAAHCwXwEGAEKACYCGyAWIQR0IN+GvOFaRY3OmXY5J42o EJ5iRAUCXZCZuAUJETfL/QAKCRA5J42oEJ5iREW1D/9k29b863oG1q1nx11AanNN uquJ0MVqHEQQx/enoYHG55IrRvtx5tZ/sHXzSEM+hY6YX4SkpGhrxNl2mFpevp65 n5cmzMsHfscT4U91NkzALoeSkfuDksp2zfi+90F+iiEwst+Btj9tChk5AWkBC7vJ @@ -196,8 +196,8 @@ OzD+Im+Le+N/qPzP214GwsBm/uJNH1hjhtiGuCSDPYWhrKBsqBxfhiYXeCOv2nx9 qcku1lwBD2lTAFbgp4P0EZ8mXPsDyB24Z5UH4CgWv1hOGpU37T6NIHWaX8uUyPhT 4mIKIZ3Z6/dmnT4qE+Pric2epTMKTUXEovwYPff9Kz3ByvEA8rHJSMkVI8Pvyyao BlCCKxX0EOiDLZ7c950YpuaH+Q7G67v4i1O8KmutwLmrk4Hb7uOQehz0V0Ue3Us/ -n+OxhhD1zJxbBrRR+vtDH7gzBFd+ceAWCSsGAQQB2kcPAQEHQP43gROo1fKfPOpX -g3CvCe3a3xd4AuJxSkTk0vs/+YDyiQI8BBgBCgAmAhsgFiEEdCDfhrzhWkWNzpl2 +n+OxhhD1zJxbBrRR+vtDH84zBFd+ceAWCSsGAQQB2kcPAQEHQP43gROo1fKfPOpX +g3CvCe3a3xd4AuJxSkTk0vs/+YDywsF8BBgBCgAmAhsgFiEEdCDfhrzhWkWNzpl2 OSeNqBCeYkQFAl2QmbgFCQpQe8wACgkQOSeNqBCeYkRO2w/8Dd3Z/a7Y9wjRHklB 5QHoMiv2zcBV4B4wTA5RHce6+NPnkK5CV8K7oP1RKvu8aWSfSgyD+Nu5f85gRY1c NpLQmGZrsAX/tBVbVIuB2/4aI6RFf30YLl7WuhonCf85czs5sBcRwIW1SCkgQI30 @@ -210,5 +210,5 @@ Zq6ysU8S9raXk1QtqOyV9FCW22ItGrwQT+xsPkrLWRyqaRbHILI+1lLLFTmWjnsW aWUlY8E8Q7rVYr3ga8acxSMVSqBgFKLqWbaWuwTGAP37ARKgpyz7tlFRd34mm04J nIRjBn08lLwMSW/CtK/jxwl9vouGQ9dgtRqvPSfOKYjJQTEwLzdlESD0yCbqF+lJ GJEHV3ge20qUwbV/0n1xVgRnKAM= -=R/AC +=jenJ -----END PGP PUBLIC KEY BLOCK----- diff --git a/debian/watch b/debian/watch index 518a123..5dc7632 100644 --- a/debian/watch +++ b/debian/watch @@ -1,3 +1,6 @@ -version=4 -opts="mode=git,pgpmode=gittag" \ -https://git.guilhem.org/lacme/ refs/tags/v([\d\.]+) +Version: 5 + +Source: https://git.guilhem.org/lacme/ +Matching-Pattern: refs/tags/v([\d\.]+) +Mode: git +Pgpmode: gittag @@ -22,7 +22,7 @@ use v5.14.2; use strict; use warnings; -our $VERSION = '0.8.2'; +our $VERSION = '0.8.4'; my $NAME = 'lacme'; use Errno 'EINTR'; @@ -184,7 +184,7 @@ sub gen_csr(%) { push @args, "-$args{hash}" if defined $args{hash}; push @args, '-subj', $args{subject}, '-config', $config->filename(), qw/-reqexts v3_req/; - open my $fh, '-|', qw/openssl req -outform DER/, @args or die "fork: $!"; + open my $fh, '-|', qw{openssl req -outform DER}, @args or die "fork: $!"; my $csr = do { local $/ = undef; <$fh> }; close $fh or $! ? die "close: $!" : return; @@ -195,7 +195,7 @@ sub gen_csr(%) { unless ($pid) { open STDIN, '<&', $rd or die "dup: $!"; open STDOUT, '>&', \*STDERR or die "dup: $!"; - exec qw/openssl req -noout -text -inform DER/ or die; + exec qw{openssl req -in /dev/stdin -inform DER -noout -text} or die; } $rd->close() or die "close: $!"; $wd->print($csr); @@ -822,28 +822,38 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') { next; } - my $cert; + my @chain; eval { my $mem = Net::SSLeay::BIO_s_mem() or die; my $bio = Net::SSLeay::BIO_new($mem) or die; die "incomplete write" unless Net::SSLeay::BIO_write($bio, $chain) == length($chain); - my $x509 = Net::SSLeay::PEM_read_bio_X509($bio); - $cert = Net::SSLeay::PEM_get_string_X509($x509); + + my $sk_x509_info = Net::SSLeay::PEM_X509_INFO_read_bio($bio); + + my $n = Net::SSLeay::sk_X509_INFO_num($sk_x509_info); + for (my $i = 0; $i < $n; $i++) { + my $x509_info = Net::SSLeay::sk_X509_INFO_value($sk_x509_info, $i); + my $x509 = Net::SSLeay::P_X509_INFO_get_x509($x509_info); + my $cert = Net::SSLeay::PEM_get_string_X509($x509); + push @chain, $cert; + } + Net::SSLeay::BIO_free($bio) or die; }; - if ($@) { + if ($@ or !@chain) { print STDERR "[$s] Error: Received bogus X.509 certificate from ACME server!\n"; $rv = 1; next; } + my $cert = shift @chain; # leave only the intermediate in @chain # extract pubkeys from CSR and cert, and ensure they match # XXX would be nice to use X509_get_X509_PUBKEY and X509_REQ_get_X509_PUBKEY here, # or EVP_PKEY_cmp(), but unfortunately Net::SSLeay 1.88 doesn't support these my ($cert_pubkey, $csr_pubkey); - spawn({in => $cert, out => \$cert_pubkey}, qw/openssl x509 -inform PEM -noout -pubkey/); - spawn({in => $csr, out => \$csr_pubkey }, qw/openssl req -inform DER -noout -pubkey/); + spawn({in => $cert, out => \$cert_pubkey}, qw{openssl x509 -in /dev/stdin -inform PEM -noout -pubkey}); + spawn({in => $csr, out => \$csr_pubkey }, qw{openssl req -in /dev/stdin -inform DER -noout -pubkey}); unless (defined $cert_pubkey and defined $csr_pubkey and $cert_pubkey eq $csr_pubkey) { print STDERR "[$s] Error: Received bogus X.509 certificate from ACME server!\n"; $rv = 1; @@ -852,9 +862,15 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') { # verify certificate validity against the CA bundle if ((my $CAfile = $conf->{CAfile} // '@@datadir@@/lacme/ca-certificates.crt') ne '') { + my $chain_tmp = File::Temp::->new(SUFFIX => '.crt', TMPDIR => 1) // die; + $chain_tmp->say($_) foreach @chain; + $chain_tmp->flush(); + my %args = (in => $cert); $args{out} = \*STDERR if $OPTS{debug}; - my @options = ('-trusted', $CAfile, '-purpose', 'sslserver', '-x509_strict'); + my @options = ('-trusted', $CAfile); + push @options, '-untrusted', $chain_tmp->filename() if @chain; + push @options, ('-purpose', 'sslserver', '-x509_strict'); push @options, '-show_chain' if $OPTS{debug}; if (spawn(\%args, 'openssl', 'verify', @options)) { print STDERR "[$s] Error: Received invalid X.509 certificate from ACME server!\n"; @@ -878,7 +894,7 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') { } my @certopts = join ',', qw/no_header no_version no_pubkey no_sigdump/; - open my $fh, '|-', qw/openssl x509 -noout -fingerprint -sha256 -text -certopt/, @certopts + open my $fh, '|-', qw{openssl x509 -in /dev/stdin -noout -fingerprint -sha256 -text -certopt}, @certopts or die "fork: $!"; print $fh $cert; close $fh or die $! ? @@ -909,14 +925,14 @@ elsif ($COMMAND eq 'revokeCert' or $COMMAND eq 'revoke-cert') { print STDERR "Revoking $filename\n"; # conversion PEM -> DER - open my $fh, '-|', qw/openssl x509 -outform DER -in/, $filename or die "fork: $!"; + open my $fh, '-|', qw{openssl x509 -in}, $filename, qw{-outform DER} or die "fork: $!"; my $der = do { local $/ = undef; <$fh> }; close $fh or die $! ? "close: $!" : "Error: x509(1ssl) exited with value ".($? >> 8)."\n"; my @certopts = join ',', qw/no_header no_version no_pubkey no_sigdump no_extensions/; - open my $fh2, '|-', qw/openssl x509 -inform DER -noout -fingerprint -sha256 -text -certopt/, @certopts + open my $fh2, '|-', qw{openssl x509 -in /dev/stdin -inform DER -noout -fingerprint -sha256 -text -certopt}, @certopts or die "fork: $!"; print $fh2 $der; close $fh2 or die $! ? diff --git a/lacme-accountd b/lacme-accountd index 8d2c599..05fa227 100755 --- a/lacme-accountd +++ b/lacme-accountd @@ -23,7 +23,7 @@ use v5.14.2; use strict; use warnings; -our $VERSION = '0.8.2'; +our $VERSION = '0.8.4'; my $PROTOCOL_VERSION = 1; my $NAME = 'lacme-accountd'; @@ -174,6 +174,7 @@ if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) { error("$filename: Not a private key") unless $rsa->is_private(); error("$filename: Invalid key") unless $rsa->check_key(); $rsa->use_sha256_hash(); + $rsa->use_pkcs1_padding(); # JWT RS256 uses PKCS#1 v1.5 signatures require 'Crypt/OpenSSL/Bignum.pm'; my ($n, $e) = $rsa->get_key_parameters(); # don't include private params! @@ -67,7 +67,7 @@ else if [ -f "tests/$t" ]; then TESTS+=( "$t" ) else - echo "Error: '$1': no such test" >&2 + echo "Error: '$t': no such test" >&2 exit 1 fi done diff --git a/tests/account-encrypted-gpg b/tests/account-encrypted-gpg index fd1e4ac..7cb978d 100644 --- a/tests/account-encrypted-gpg +++ b/tests/account-encrypted-gpg @@ -9,7 +9,7 @@ keyid="$(gpg --list-secret-key --with-colons | grep -m1 ^fpr: | cut -sd: -f10)" gpg --encrypt -r "$keyid" /etc/lacme/account.key sed -ri '0,\|^#?privkey\s*=.*| {s||privkey = gpg:/etc/lacme/account.key.gpg|}' /etc/lacme/lacme-accountd.conf -export GPG_TTY="$(tty)" +export GPG_TTY="$(tty)" TERM="linux" lacme account # vim: set filetype=sh : diff --git a/tests/account-encrypted-openssl b/tests/account-encrypted-openssl index e79a528..1f97fd0 100644 --- a/tests/account-encrypted-openssl +++ b/tests/account-encrypted-openssl @@ -2,9 +2,10 @@ PASSPHRASE="test" -openssl rsa -aes128 -passout pass:"$PASSPHRASE" </etc/lacme/account.key >/etc/lacme/account.enc.key +openssl rsa -in /etc/lacme/account.key -out /etc/lacme/account.enc.key -aes128 -passout pass:"$PASSPHRASE" sed -ri '0,\|^#?privkey\s*=.*| {s||privkey = file:/etc/lacme/account.enc.key|}' /etc/lacme/lacme-accountd.conf +export TERM="linux" lacme account # vim: set filetype=sh : diff --git a/tests/accountd-kid b/tests/accountd-kid index 8a4b53c..e6f5ca4 100644 --- a/tests/accountd-kid +++ b/tests/accountd-kid @@ -28,7 +28,7 @@ sleep 1 # newAccount resource fails as per RFC 8555 sec. 6.2 it requires a JWK ! lacme --socket="$SOCKET" account 2>"$STDERR" || fail grepstderr -Fxq "Warning: lacme-accountd supplied an empty JWK; try removing 'keyid' setting from lacme-accountd.conf if the ACME resource request fails." -grepstderr -Fxq "400 Bad Request (Parse error reading JWS)" +grepstderr -Fxq "400 Bad Request (Unable to validate JWS :: Parse error reading JWS)" grep -F "] SIGNED header=base64url({" ~lacme-account/.local/share/lacme/accountd.log >/tmp/signed ! grep -vF "] SIGNED header=base64url({\"alg\":\"RS256\",\"jwk\":{}," </tmp/signed @@ -48,7 +48,7 @@ test /etc/lacme/simpletest.rsa.crt -nt /etc/lacme/simpletest.rsa.key lacme --socket="$SOCKET" revokeCert /etc/lacme/simpletest.rsa.crt ! lacme --socket="$SOCKET" revokeCert /etc/lacme/simpletest.rsa.crt 2>"$STDERR" || fail grepstderr -Fxq "Revoking /etc/lacme/simpletest.rsa.crt" -grepstderr -Fq "400 Bad Request (unable to revoke" +grepstderr -Eq "400 Bad Request \\(Unable to revoke :: no certificate with serial [0-9a-fA-F]+ and status other than revoked\\)" grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.rsa.crt" kill $PID diff --git a/tests/cert-extensions b/tests/cert-extensions index a397ee5..9c5b977 100644 --- a/tests/cert-extensions +++ b/tests/cert-extensions @@ -4,13 +4,13 @@ x509_check() { local cert="$1" ext out out="$(mktemp --tmpdir)" ext="basicConstraints,subjectAltName,keyUsage,extendedKeyUsage,tlsfeature" - openssl x509 -noout -subject -ext "$ext" -nameopt compat <"$cert" >"$out" + openssl x509 -in "$cert" -noout -subject -ext "$ext" -nameopt compat >"$out" diff --unified --color=auto -b --label="a/${cert#/}" --label="b/${cert#/}" -- - "$out" } # default settings (the ACME server adds a subjectAltName with the Common Name) openssl genpkey -algorithm RSA -out /etc/lacme/test1.key -commonName="$(head -c10 /dev/urandom | base32 -w0 | tr "[A-Z]" "[a-z]").$DOMAINNAME" +commonName="$(head -c10 /dev/urandom | base32 -w0 | tr "A-Z" "a-z").$DOMAINNAME" cat >"/etc/lacme/lacme-certs.conf.d/test1.conf" <<- EOF [test1] certificate-key = /etc/lacme/test1.key @@ -25,7 +25,7 @@ x509_check /etc/lacme/test1.crt <<-EOF X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication + TLS Web Server Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Alternative Name: @@ -34,10 +34,10 @@ EOF # subjectAltName openssl genpkey -algorithm RSA -out /etc/lacme/test2.key -commonName="$(head -c10 /dev/urandom | base32 -w0 | tr "[A-Z]" "[a-z]").$DOMAINNAME" +commonName="$(head -c10 /dev/urandom | base32 -w0 | tr "A-Z" "a-z").$DOMAINNAME" subjectAltName="" for i in $(seq 1 8); do - subjectAltName="${subjectAltName:+"$subjectAltName "}$(head -c10 /dev/urandom | base32 -w0 | tr "[A-Z]" "[a-z]").$DOMAINNAME" + subjectAltName="${subjectAltName:+"$subjectAltName "}$(head -c10 /dev/urandom | base32 -w0 | tr "A-Z" "a-z").$DOMAINNAME" done cat >"/etc/lacme/lacme-certs.conf.d/test2.conf" <<- EOF [test2] @@ -54,38 +54,11 @@ x509_check /etc/lacme/test2.crt <<-EOF X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication + TLS Web Server Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Alternative Name: DNS:$(echo "$commonName" "$subjectAltName" | tr " " "\\n" | sort -u | paste -sd" " | sed -r "s/ /, DNS:/g") EOF -# tlsfeature -openssl genpkey -algorithm RSA -out /etc/lacme/test3.key -commonName="$(head -c10 /dev/urandom | base32 -w0 | tr "[A-Z]" "[a-z]").$DOMAINNAME" -cat >"/etc/lacme/lacme-certs.conf.d/test3.conf" <<- EOF - [test3] - certificate-key = /etc/lacme/test3.key - certificate-chain = /etc/lacme/test3.crt - subject = /CN=$commonName - tlsfeature = status_request -EOF - -lacme newOrder test3 -test /etc/lacme/test3.crt -nt /etc/lacme/test3.key -x509_check /etc/lacme/test3.crt <<-EOF - subject=/CN=$commonName - X509v3 Key Usage: critical - Digital Signature, Key Encipherment - X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication - X509v3 Basic Constraints: critical - CA:FALSE - X509v3 Subject Alternative Name: - DNS:$commonName - TLS Feature: - status_request -EOF - # vim: set filetype=sh : diff --git a/tests/cert-install b/tests/cert-install index 4b3e820..279309f 100644 --- a/tests/cert-install +++ b/tests/cert-install @@ -28,9 +28,58 @@ EOF grepstderr -Fxq "[bad3] Warning: Couldn't generate CSR, skipping" +check_spki() { + local p1="$1" p2="$2" s1 s2 + s1="$(openssl x509 -in "$p1" -noout -pubkey \ + | openssl pkey -pubin -outform DER \ + | openssl dgst -sha256 \ + | sed 's/.*=\s*//')" + s2="$(openssl pkey -in "$p2" -pubout -outform DER \ + | openssl dgst -sha256 \ + | sed 's/.*=\s*//')" + if [ -n "$s1" ] && [ "$s1" = "$s2" ]; then + return 0 + else + printf "%s != %s\\n" "$s1" "$s2" >&2 + return 1 + fi +} +check_chain() { + local priv="$1" chain="$2" leaf="${3-}" pem0 + + csplit -f "${chain%.crt}.chain.pem" "$chain" \ + "/-----BEGIN CERTIFICATE-----/" "{*}" + + pem0="${chain%.crt}.chain.pem00" + if [ ! -s "$pem0" ]; then + # 00 is empty, leaf cert is at 01 + rm -f -- "$pem0" + pem0="${chain%.crt}.chain.pem01" + fi + test -s "$pem0" || return 1 + check_spki "$pem0" "$priv" + + if [ -n "$leaf" ]; then + diff --ignore-blank-lines --unified "$pem0" "$leaf" || return 1 + fi + + leaf="${chain%.crt}.leaf.pem" + mv -T -- "$pem0" "$leaf" + + intermediates="${chain%.crt}.intermediates.pem" + sed "/^$/d" "${chain%.crt}.chain.pem"[0-9]* >"$intermediates" + test -s "$intermediates" || return 1 # ensure there is at least one intermediate + + openssl verify -trusted /usr/share/lacme/ca-certificates.crt \ + -untrusted "$intermediates" \ + -purpose sslserver -x509_strict \ + -show_chain \ + -- "$leaf" || return 1 +} + # 'certificate' installs only the leaf certificate openssl genpkey -algorithm RSA -out /etc/lacme/test1.key -subject="/CN=$(head -c10 /dev/urandom | base32 -w0).$DOMAINNAME" +subject="/CN=$(head -c10 /dev/urandom | base32 -w0 | tr "A-Z" "a-z").$DOMAINNAME" cat >"/etc/lacme/lacme-certs.conf.d/test1.conf" <<- EOF [test1] certificate-key = /etc/lacme/test1.key @@ -42,23 +91,9 @@ lacme newOrder test1 2>"$STDERR" || fail newOrder test1 test /etc/lacme/test1.crt -nt /etc/lacme/test1.key sed -n "0,/^-----END CERTIFICATE-----$/ p" /etc/lacme/test1.crt >/etc/lacme/test1.pem diff --unified /etc/lacme/test1.crt /etc/lacme/test1.pem +check_spki /etc/lacme/test1.crt /etc/lacme/test1.key -check_hash() { - local p1="$1" p2 s1 s2 - s1="$(openssl x509 -noout -hash <"$p1")" - for p2 in /usr/share/lacme/ca-certificates.pem.*; do - s2="$(openssl x509 -noout -hash <"$p2")" - if [ "$s1" = "$s2" ]; then - return 0 - fi - done - return 1 -} -csplit -f /usr/share/lacme/ca-certificates.pem. /usr/share/lacme/ca-certificates.crt \ - "/-----BEGIN CERTIFICATE-----/" "{*}" -rm -f /usr/share/lacme/ca-certificates.pem.00 - # 'certificate-chain' appends the chain of trust openssl genpkey -algorithm RSA -out /etc/lacme/test2.key cat >"/etc/lacme/lacme-certs.conf.d/test2.conf" <<- EOF @@ -70,16 +105,7 @@ EOF lacme newOrder test2 2>"$STDERR" || fail newOrder test2 test /etc/lacme/test2.crt -nt /etc/lacme/test2.key -csplit -f /etc/lacme/test2.chain.pem /etc/lacme/test2.crt \ - "/-----BEGIN CERTIFICATE-----/" "{*}" -test -s /etc/lacme/test2.chain.pem01 # leaf cert (00 is empty) -rm -f /etc/lacme/test2.chain.pem0[01] -test -s /etc/lacme/test2.chain.pem02 # depth 1 - -# all certificates at depth >=1 must be in our CA bundle -for p in /etc/lacme/test2.chain.pem*; do - check_hash "$p" -done +check_chain /etc/lacme/test2.key /etc/lacme/test2.crt # 'certificate' + 'certificate-chain' openssl genpkey -algorithm RSA -out /etc/lacme/test3.key @@ -94,10 +120,8 @@ EOF lacme newOrder test3 2>"$STDERR" || fail newOrder test3 test /etc/lacme/test3.pem -nt /etc/lacme/test3.key test /etc/lacme/test3.crt -nt /etc/lacme/test3.key -csplit -f /etc/lacme/test3.chain.pem /etc/lacme/test3.crt \ - "/-----BEGIN CERTIFICATE-----/" "{*}" -sed -i "/^$/d" /etc/lacme/test3.chain.pem* -diff -q /etc/lacme/test3.chain.pem01 /etc/lacme/test3.pem +check_chain /etc/lacme/test3.key /etc/lacme/test3.crt /etc/lacme/test3.pem + st="$(stat -c "%U:%G %#a" /etc/lacme/test3.pem)" [ "$st" = "root:root 0644" ] st="$(stat -c "%U:%G %#a" /etc/lacme/test3.crt)" diff --git a/tests/cert-revoke b/tests/cert-revoke index 179ccba..ead6723 100644 --- a/tests/cert-revoke +++ b/tests/cert-revoke @@ -18,7 +18,7 @@ test /etc/lacme/simpletest.ecdsa.crt -nt /etc/lacme/simpletest.ecdsa.key lacme revokeCert /etc/lacme/simpletest.ecdsa.crt ! lacme revokeCert /etc/lacme/simpletest.ecdsa.crt 2>"$STDERR" || fail grepstderr -Fxq "Revoking /etc/lacme/simpletest.ecdsa.crt" -grepstderr -Fq "400 Bad Request (unable to revoke" +grepstderr -Fq "400 Bad Request (Unable to revoke ::" grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.ecdsa.crt" # and the RSA certificate using the service key @@ -26,7 +26,7 @@ mv -vfT /etc/lacme/simpletest.rsa.key /etc/lacme/account.key lacme revokeCert /etc/lacme/simpletest.rsa.crt ! lacme revokeCert /etc/lacme/simpletest.rsa.crt 2>"$STDERR" || fail grepstderr -Fxq "Revoking /etc/lacme/simpletest.rsa.crt" -grepstderr -Fq "400 Bad Request (unable to revoke" +grepstderr -Fq "400 Bad Request (Unable to revoke ::" grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.rsa.crt" # vim: set filetype=sh : diff --git a/tests/cert-verify b/tests/cert-verify index 4d254c6..2138e29 100644 --- a/tests/cert-verify +++ b/tests/cert-verify @@ -8,31 +8,19 @@ for ca in /usr/share/lacme/letsencrypt-stg-root-*.pem; do done update-ca-certificates -# test (modified) trust store for intermediate certificates -openssl verify -no-CAfile -CApath /etc/ssl/certs -show_chain /usr/share/lacme/letsencrypt-stg-int-*.pem -openssl verify -no-CApath -CAfile /etc/ssl/certs/ca-certificates.crt -show_chain /usr/share/lacme/letsencrypt-stg-int-*.pem +# test (modified) trust store +openssl verify -no-CAfile -CApath /etc/ssl/certs -show_chain /usr/share/lacme/letsencrypt-stg-root-x1.pem +openssl verify -no-CApath -CAfile /etc/ssl/certs/ca-certificates.crt -show_chain /usr/share/lacme/letsencrypt-stg-root-x1.pem mv /usr/share/lacme/ca-certificates.crt /usr/share/lacme/ca-certificates.crt.back ! lacme newOrder 2>"$STDERR" || fail -grepstderr -Fxq "Could not open file or uri for loading certs of trusted certificates from /usr/share/lacme/ca-certificates.crt" +grepstderr -Fq "Could not open file or uri for loading trusted certificates from /usr/share/lacme/ca-certificates.crt:" grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" # verification error for unrelated CA bundle cat /etc/ssl/certs/ssl-cert-snakeoil.pem >/usr/share/lacme/ca-certificates.crt ! lacme newOrder 2>"$STDERR" || fail -grepstderr -Fxq "error 20 at 0 depth lookup: unable to get local issuer certificate" -grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" - -# verification error when the CA bundle contains only the root certificates -cat /usr/share/lacme/letsencrypt-stg-root-*.pem >/usr/share/lacme/ca-certificates.crt -! lacme newOrder 2>"$STDERR" || fail -grepstderr -Fxq "error 20 at 0 depth lookup: unable to get local issuer certificate" -grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" - -# verification error when the CA bundle contains only the intermediate certificates -cat /usr/share/lacme/letsencrypt-stg-int-*.pem >/usr/share/lacme/ca-certificates.crt -! lacme newOrder 2>"$STDERR" || fail -grepstderr -Fxq "error 2 at 1 depth lookup: unable to get issuer certificate" +grepstderr -Eq "^error 20 at [1-9][0-9]* depth lookup: unable to get local issuer certificate$" grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" # use saved bundle as custom CAfile diff --git a/tests/drop-privileges b/tests/drop-privileges index 8deb8f1..3589ee3 100644 --- a/tests/drop-privileges +++ b/tests/drop-privileges @@ -81,7 +81,8 @@ check_accountd() { USER=lacme-account EOF - stderr="$(readlink -e "/proc/$$/fd/2")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stderr" || return -1 socket_ino="$(sed -rn '/^0 .* socket:\[([0-9]+)\]$/ {s//\1/p;q}' "$prefix/fd")" [ -n "$socket_ino" ] || return 1 grep -Fxq "0 0700 $UID:$GID socket:[$socket_ino]" "$prefix/fd" || return 1 @@ -106,8 +107,10 @@ check_client() { USER=_lacme-client EOF - stdout="$(readlink -e "/proc/$$/fd/1")" - stderr="$(readlink -e "/proc/$$/fd/2")" + stdout="$(readlink -f "/proc/$$/fd/1")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stdout" || return -1 + test -n "$stderr" || return -1 if [ "$command" = "account" ]; then # no pipe grep -Fxq "0 0500 $UID:$GID /dev/null" "$prefix/fd" || return 1 grep -Fxq "1 0700 $UID:$GID $stdout" "$prefix/fd" || return 1 @@ -143,8 +146,10 @@ check_webserver() { USER=_lacme-www EOF - stdout="$(readlink -e "/proc/$$/fd/1")" - stderr="$(readlink -e "/proc/$$/fd/2")" + stdout="$(readlink -f "/proc/$$/fd/1")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stdout" || return -1 + test -n "$stderr" || return -1 grep -Fxq "0 0500 $UID:$GID /dev/null" "$prefix/fd" || return 1 grep -Fxq "1 0700 $UID:$GID $stdout" "$prefix/fd" || return 1 grep -Fxq "2 0700 $UID:$GID $stderr" "$prefix/fd" || return 1 diff --git a/tests/old-accountd b/tests/old-accountd index 3ad4b31..daa1996 100644 --- a/tests/old-accountd +++ b/tests/old-accountd @@ -19,6 +19,9 @@ DEBIAN_FRONTEND="noninteractive" apt install -y --no-install-recommends \ -oDPkg::Options::="--force-confdef" -oDPkg::Options::="--force-overwrite" \ lacme-accountd/stretch +# somewhat cheating, but needed for an older accountd using a newer Crypt::OpenSSL::RSA +sed -ri 's/^\s*\$rsa->use_sha256_hash\(\);$/& $rsa->use_pkcs1_padding();/' /usr/bin/lacme-accountd + SOCKET=~lacme-account/S.lacme runuser -u lacme-account -- lacme-accountd --socket="$SOCKET" & PID=$! sleep 1 diff --git a/tests/old-lacme b/tests/old-lacme index b1c9f88..278a705 100644 --- a/tests/old-lacme +++ b/tests/old-lacme @@ -1,5 +1,6 @@ -# IPC test between recent lacme-accountd(1) and ancient lacme(8) 0.5 from Debian buster -# (we don't try earlier versions as we need v2 support of the ACME API) +# IPC test between recent lacme-accountd(1) and ancient lacme(8) 0.8 from Debian Bullseye +# (we don't try earlier versions as we need v2 support of the ACME API +# and non-pinned intermediates) adduser --disabled-password \ --home /home/lacme-account \ @@ -14,12 +15,12 @@ cat >~lacme-account/.config/lacme/lacme-accountd.conf <<-EOF privkey = file:/etc/lacme/account.key EOF -echo "deb http://deb.debian.org/debian buster main" >>/etc/apt/sources.list +echo "deb http://deb.debian.org/debian bullseye main" >>/etc/apt/sources.list DEBIAN_FRONTEND="noninteractive" apt update DEBIAN_FRONTEND="noninteractive" apt install -y --no-install-recommends \ --reinstall --allow-downgrades \ -oDPkg::Options::="--force-confdef" -oDPkg::Options::="--force-overwrite" \ - lacme/buster + lacme/bullseye # restore staging environment mv -f /usr/share/lacme/ca-certificates.crt.back /usr/share/lacme/ca-certificates.crt |