diff options
Diffstat (limited to 'debian')
| -rw-r--r-- | debian/changelog | 23 | ||||
| -rw-r--r-- | debian/lacme.install | 3 | ||||
| -rw-r--r-- | debian/patches/0003-Use-upstream-certicate-chain-instead-of-an-hardcoded.patch | 479 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
4 files changed, 505 insertions, 1 deletions
diff --git a/debian/changelog b/debian/changelog index 3366d21..a643159 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,26 @@ +lacme (0.5-1+deb10u2) buster; urgency=medium + + * Use upstream certificate chain instead of an hardcoded one. + This is a breaking change. The certificate indicated by 'CAfile' is no + longer used as is in 'certificate-chain' (along with the leaf cert). + The chain returned by the ACME v2 endpoint is used instead. This allows + for more flexbility with respect to key/CA rotation, cf. + https://letsencrypt.org/2020/11/06/own-two-feet.html and + https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 + * Additional current/planned CA certificates can be found under + /usr/local/share/lacme: + - lets-encrypt-e[12].pem + - lets-encrypt-r[34]-cross-signed.pem + - lets-encrypt-r[34].pem + - letsencryptauthorityx[34].pem + See https://letsencrypt.org/certificates/ + * Moreover 'CAfile' now defaults to /usr/share/lacme/ca-certificates.crt + which is a concatenation of all known active CA certificates (which + includes the previous default). + Closes: #975862. + + -- Guilhem Moulin <guilhem@debian.org> Thu, 26 Nov 2020 01:14:50 +0100 + lacme (0.5-1+deb10u1) buster; urgency=medium * Link to RFC 8555 <https://tools.ietf.org/html/rfc8555> instead of the diff --git a/debian/lacme.install b/debian/lacme.install index 303c121..220097d 100644 --- a/debian/lacme.install +++ b/debian/lacme.install @@ -1,4 +1,5 @@ -certs/lets-encrypt-x[1-4]-cross-signed.pem /usr/share/lacme +certs/*.pem /usr/share/lacme +/usr/share/lacme/ca-certificates.crt client webserver /usr/lib/lacme config/lacme-certs.conf config/lacme.conf /etc/lacme lacme /usr/sbin diff --git a/debian/patches/0003-Use-upstream-certicate-chain-instead-of-an-hardcoded.patch b/debian/patches/0003-Use-upstream-certicate-chain-instead-of-an-hardcoded.patch new file mode 100644 index 0000000..1032af2 --- /dev/null +++ b/debian/patches/0003-Use-upstream-certicate-chain-instead-of-an-hardcoded.patch @@ -0,0 +1,479 @@ +From d3c9435c4f43167b9d5c9315044f50b8878a2881 Mon Sep 17 00:00:00 2001 +From: Guilhem Moulin <guilhem@fripost.org> +Date: Thu, 26 Nov 2020 01:10:38 +0100 +Subject: Use upstream certificate chain instead of an hardcoded one. + +This is a breaking change. The certificate indicated by 'CAfile' is no +longer used as is in 'certificate-chain' (along with the leaf cert). +The chain returned by the ACME v2 endpoint is used instead. This allows +for more flexbility with respect to key/CA rotation, cf. +https://letsencrypt.org/2020/11/06/own-two-feet.html and +https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 + +Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt +which is a concatenation of all known active CA certificates (which +includes the previous default). +--- + Makefile | 9 ++++++- + certs/lets-encrypt-e1.pem | 17 +++++++++++++ + certs/lets-encrypt-e2.pem | 17 +++++++++++++ + certs/lets-encrypt-r3-cross-signed.pem | 26 +++++++++++++++++++ + certs/lets-encrypt-r3.pem | 30 ++++++++++++++++++++++ + certs/lets-encrypt-r4-cross-signed.pem | 26 +++++++++++++++++++ + certs/lets-encrypt-r4.pem | 30 ++++++++++++++++++++++ + certs/letsencryptauthorityx3.pem | 32 +++++++++++++++++++++++ + certs/letsencryptauthorityx4.pem | 32 +++++++++++++++++++++++ + client | 15 +---------- + config/lacme-certs.conf | 11 ++++---- + lacme | 35 ++++++++++++++++---------- + lacme.md | 13 ++++------ + 13 files changed, 251 insertions(+), 42 deletions(-) + create mode 100644 certs/lets-encrypt-e1.pem + create mode 100644 certs/lets-encrypt-e2.pem + create mode 100644 certs/lets-encrypt-r3-cross-signed.pem + create mode 100644 certs/lets-encrypt-r3.pem + create mode 100644 certs/lets-encrypt-r4-cross-signed.pem + create mode 100644 certs/lets-encrypt-r4.pem + create mode 100644 certs/letsencryptauthorityx3.pem + create mode 100644 certs/letsencryptauthorityx4.pem + +diff --git a/Makefile b/Makefile +index 5d421bf..99ce749 100644 +--- a/Makefile ++++ b/Makefile +@@ -37,7 +37,14 @@ install: ${MANPAGES} + install -m0644 -t $(DESTDIR)/etc/lacme config/*.conf + install -m0644 -t $(DESTDIR)/etc/lacme snippets/*.conf + install -d $(DESTDIR)/usr/share/lacme +- install -m0644 -t $(DESTDIR)/usr/share/lacme certs/lets-encrypt-x[1-4]-cross-signed.pem ++ install -m0644 -t $(DESTDIR)/usr/share/lacme certs/* ++ # used for validation, see https://letsencrypt.org/certificates/ ++ cat certs/letsencryptauthorityx[34].pem \ ++ certs/lets-encrypt-x[34]-cross-signed.pem \ ++ certs/lets-encrypt-r[34].pem \ ++ certs/lets-encrypt-r[34]-cross-signed.pem \ ++ certs/lets-encrypt-e[12].pem \ ++ >$(DESTDIR)/usr/share/lacme/ca-certificates.crt + install -d $(DESTDIR)/usr/lib/lacme + install -m0755 -t $(DESTDIR)/usr/lib/lacme client webserver + install -d $(DESTDIR)/usr/share/man/man1 +diff --git a/certs/lets-encrypt-e1.pem b/certs/lets-encrypt-e1.pem +new file mode 100644 +index 0000000..2a19d41 +--- /dev/null ++++ b/certs/lets-encrypt-e1.pem +@@ -0,0 +1,17 @@ ++-----BEGIN CERTIFICATE----- ++MIICxjCCAk2gAwIBAgIRALO93/inhFu86QOgQTWzSkUwCgYIKoZIzj0EAwMwTzEL ++MAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNo ++IEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjAwOTA0MDAwMDAwWhcN ++MjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5j ++cnlwdDELMAkGA1UEAxMCRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQkXC2iKv0c ++S6Zdl3MnMayyoGli72XoprDwrEuf/xwLcA/TmC9N/A8AmzfwdAVXMpcuBe8qQyWj +++240JxP2T35p0wKZXuskR5LBJJvmsSGPwSSB/GjMH2m6WPUZIvd0xhajggEIMIIB ++BDAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMB ++MBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFFrz7Sv8NsI3eblSMOpUb89V ++yy6sMB8GA1UdIwQYMBaAFHxClq7eS0g7+pL4nozPbYupcjeVMDIGCCsGAQUFBwEB ++BCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gyLmkubGVuY3Iub3JnLzAnBgNVHR8E ++IDAeMBygGqAYhhZodHRwOi8veDIuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYG ++Z4EMAQIBMA0GCysGAQQBgt8TAQEBMAoGCCqGSM49BAMDA2cAMGQCMHt01VITjWH+ ++Dbo/AwCd89eYhNlXLr3pD5xcSAQh8suzYHKOl9YST8pE9kLJ03uGqQIwWrGxtO3q ++YJkgsTgDyj2gJrjubi1K9sZmHzOa25JK1fUpE8ZwYii6I4zPPS/Lgul/ ++-----END CERTIFICATE----- +diff --git a/certs/lets-encrypt-e2.pem b/certs/lets-encrypt-e2.pem +new file mode 100644 +index 0000000..0fd9f40 +--- /dev/null ++++ b/certs/lets-encrypt-e2.pem +@@ -0,0 +1,17 @@ ++-----BEGIN CERTIFICATE----- ++MIICxjCCAkygAwIBAgIQTtI99q9+x/mwxHJv+VEqdzAKBggqhkjOPQQDAzBPMQsw ++CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg ++R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw0y ++NTA5MTUxNjAwMDBaMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNy ++eXB0MQswCQYDVQQDEwJFMjB2MBAGByqGSM49AgEGBSuBBAAiA2IABCOaLO3lixmN ++YVWex+ZVYOiTLgi0SgNWtU4hufk50VU4Zp/LbBVDxCsnsI7vuf4xp4Cu+ETNggGE ++yBqJ3j8iUwe5Yt/qfSrRf1/D5R58duaJ+IvLRXeASRqEL+VkDXrW3qOCAQgwggEE ++MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEw ++EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUbZkq9U0C6+MRwWC6km+NPS7x ++6kQwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEE ++JjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMCcGA1UdHwQg ++MB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wIgYDVR0gBBswGTAIBgZn ++gQwBAgEwDQYLKwYBBAGC3xMBAQEwCgYIKoZIzj0EAwMDaAAwZQIxAPJCN9qpyDmZ ++tX8K3m8UYQvK51BrXclM6WfrdeZlUBKyhTXUmFAtJw4X6A0x9mQFPAIwJa/No+KQ ++UAM1u34E36neL/Zba7ombkIOchSgx1iVxzqtFWGddgoG+tppRPWhuhhn ++-----END CERTIFICATE----- +diff --git a/certs/lets-encrypt-r3-cross-signed.pem b/certs/lets-encrypt-r3-cross-signed.pem +new file mode 100644 +index 0000000..1d82449 +--- /dev/null ++++ b/certs/lets-encrypt-r3-cross-signed.pem +@@ -0,0 +1,26 @@ ++-----BEGIN CERTIFICATE----- ++MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/ ++MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT ++DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow ++MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT ++AlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs ++jVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp ++Tm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB ++U840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7 ++gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel ++/xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R ++oYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E ++BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p ++ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE ++p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE ++AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu ++Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0 ++LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf ++r52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B ++AQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH ++ejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8 ++S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL ++qjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p ++O5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw ++UdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg== ++-----END CERTIFICATE----- +diff --git a/certs/lets-encrypt-r3.pem b/certs/lets-encrypt-r3.pem +new file mode 100644 +index 0000000..43b222a +--- /dev/null ++++ b/certs/lets-encrypt-r3.pem +@@ -0,0 +1,30 @@ ++-----BEGIN CERTIFICATE----- ++MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw ++TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh ++cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw ++WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg ++RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK ++AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP ++R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx ++sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm ++NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg ++Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG ++/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC ++AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB ++Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA ++FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw ++AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw ++Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB ++gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W ++PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl ++ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz ++CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm ++lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4 ++avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2 ++yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O ++yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids ++hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+ ++HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv ++MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX ++nLRbwHOoq7hHwg== ++-----END CERTIFICATE----- +diff --git a/certs/lets-encrypt-r4-cross-signed.pem b/certs/lets-encrypt-r4-cross-signed.pem +new file mode 100644 +index 0000000..f0ed3cd +--- /dev/null ++++ b/certs/lets-encrypt-r4-cross-signed.pem +@@ -0,0 +1,26 @@ ++-----BEGIN CERTIFICATE----- ++MIIEZTCCA02gAwIBAgIQQAF1BIMlO+Rkt3exI9CKgjANBgkqhkiG9w0BAQsFADA/ ++MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT ++DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0NVoXDTIxMDkyOTE5MjE0NVow ++MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT ++AlI0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsyjcdynT55G+87cK ++AMf78lULJSJjUzav6Qgg3w2vKD7NxqtXtp2kJRml0jJtSaYIuccvoZuTxSBAa4Qx ++IKKOMGAlYO/ZGok/H2lxstrqP3NBxJBvZv19nljYd8/NWXVEyaEKe58/Gw46Zm+2 ++dc+Ly6+dwHDF/9KCCq9dzeLonIWUpOYANeh+TjmBxyGJYHfqHZbyi4N7R8RtMsBS ++fiMeRbVx7qPvF8IDqZOJ3fWf27rx2uB+l4dxgR4aglbkPnwYogjlFl+o+qjgSFFN ++GBSgDKPltsqztVUSa3LHWn87jPnn2dGOEk0zMwMq8RPhQjzCLllgLm3gB0czZd/S ++Z8pNhQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E ++BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p ++ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE ++p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE ++AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu ++Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0 ++LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFDadPuCxQPYnLHy/jZ0x ++ivZUpkYmMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B ++AQsFAAOCAQEAN4CpgPmK2C5pq/RdV9gEdWcvPnPfT9ToucrAMTcn//wyWBWF2wG4 ++hvPBQxxuqPECZsi4nLQ45VJpyC1NDd0GqGQIMqNdC4N4TLDtd7Yhy8v5JsfEMUbb ++6xW4sKeeeKy3afOkel60Xg1/7ndSmppiHqdh+TdJML1hptRgdxGiB8LMpHuW/oM8 ++akfyt4TkBhA8+Wu8MM6dlJyJ7nHBVnEUFQ4Ni+GzNC/pQSL2+Y9Mq4HHIk2ZFy0W ++B8KsVwdeNrERPL+LjhhLde1Et0aL9nlv4CqwXHML2LPgk38j/WllbQ/8HRd2VpB+ ++JW6Z8JNhcnuBwATHMCeJVCFapoZsPfQQ6Q== ++-----END CERTIFICATE----- +diff --git a/certs/lets-encrypt-r4.pem b/certs/lets-encrypt-r4.pem +new file mode 100644 +index 0000000..578b3bd +--- /dev/null ++++ b/certs/lets-encrypt-r4.pem +@@ -0,0 +1,30 @@ ++-----BEGIN CERTIFICATE----- ++MIIFFjCCAv6gAwIBAgIRAIp5IlCr5SxSbO7Pf8lC3WIwDQYJKoZIhvcNAQELBQAw ++TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh ++cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw ++WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg ++RW5jcnlwdDELMAkGA1UEAxMCUjQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK ++AoIBAQCzKNx3KdPnkb7ztwoAx/vyVQslImNTNq/pCCDfDa8oPs3Gq1e2naQlGaXS ++Mm1Jpgi5xy+hm5PFIEBrhDEgoo4wYCVg79kaiT8faXGy2uo/c0HEkG9m/X2eWNh3 ++z81ZdUTJoQp7nz8bDjpmb7Z1z4vLr53AcMX/0oIKr13N4uichZSk5gA16H5OOYHH ++IYlgd+odlvKLg3tHxG0ywFJ+Ix5FtXHuo+8XwgOpk4nd9Z/buvHa4H6Xh3GBHhqC ++VuQ+fBiiCOUWX6j6qOBIUU0YFKAMo+W2yrO1VRJrcsdafzuM+efZ0Y4STTMzAyrx ++E+FCPMIuWWAubeAHRzNl39Jnyk2FAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC ++AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB ++Af8CAQAwHQYDVR0OBBYEFDadPuCxQPYnLHy/jZ0xivZUpkYmMB8GA1UdIwQYMBaA ++FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw ++AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw ++Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB ++gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCJbu5CalWO+H+Az0lmIG14DXmlYHQE ++k26umjuCyioWs2icOlZznPTcZvbfq02YPHGTCu3ctggVDULJ+fwOxKekzIqeyLNk ++p8dyFwSAr23DYBIVeXDpxHhShvv0MLJzqqDFBTHYe1X5X2Y7oogy+UDJxV2N24/g ++Z8lxG4Vr2/VEfUOrw4Tosl5Z+1uzOdvTyBcxD/E5rGgTLczmulctHy3IMTmdTFr0 ++FnU0/HMQoquWQuODhFqzMqNcsdbjANUBwOEQrKI8Sy6+b84kHP7PtO+S4Ik8R2k7 ++ZeMlE1JmxBi/PZU860YlwT8/qOYToCHVyDjhv8qutbf2QnUl3SV86th2I1QQE14s ++0y7CdAHcHkw3sAEeYGkwCA74MO+VFtnYbf9B2JBOhyyWb5087rGzitu5MTAW41X9 ++DwTeXEg+a24tAeht+Y1MionHUwa4j7FB/trN3Fnb/r90+4P66ZETVIEcjseUSMHO ++w6yqv10/H/dw/8r2EDUincBBX3o9DL3SadqragkKy96HtMiLcqMMGAPm0gti1b6f ++bnvOdr0mrIVIKX5nzOeGZORaYLoSD4C8qvFT7U+Um6DMo36cVDNsPmkF575/s3C2 ++CxGiCPQqVxPgfNSh+2CPd2Xv04lNeuw6gG89DlOhHuoFKRlmPnom+gwqhz3ZXMfz ++TfmvjrBokzCICA== ++-----END CERTIFICATE----- +diff --git a/certs/letsencryptauthorityx3.pem b/certs/letsencryptauthorityx3.pem +new file mode 100644 +index 0000000..4e82cb5 +--- /dev/null ++++ b/certs/letsencryptauthorityx3.pem +@@ -0,0 +1,32 @@ ++-----BEGIN CERTIFICATE----- ++MIIFjTCCA3WgAwIBAgIRANOxciY0IzLc9AUoUSrsnGowDQYJKoZIhvcNAQELBQAw ++TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh ++cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTYxMDA2MTU0MzU1 ++WhcNMjExMDA2MTU0MzU1WjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg ++RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDMwggEi ++MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc0wzwWuUuR7dyXTeDs2hjMOrX ++NSYZJeG9vjXxcJIvt7hLQQWrqZ41CFjssSrEaIcLo+N15Obzp2JxunmBYB/XkZqf ++89B4Z3HIaQ6Vkc/+5pnpYDxIzH7KTXcSJJ1HG1rrueweNwAcnKx7pwXqzkrrvUHl ++Npi5y/1tPJZo3yMqQpAMhnRnyH+lmrhSYRQTP2XpgofL2/oOVvaGifOFP5eGr7Dc ++Gu9rDZUWfcQroGWymQQ2dYBrrErzG5BJeC+ilk8qICUpBMZ0wNAxzY8xOJUWuqgz ++uEPxsR/DMH+ieTETPS02+OP88jNquTkxxa/EjQ0dZBYzqvqEKbbUC8DYfcOTAgMB ++AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU ++BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB ++FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBSo ++SmpjBH3duubRObemRWXv86jsoTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js ++LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF ++BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG ++AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD ++VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB ++ABnPdSA0LTqmRf/Q1eaM2jLonG4bQdEnqOJQ8nCqxOeTRrToEKtwT++36gTSlBGx ++A/5dut82jJQ2jxN8RI8L9QFXrWi4xXnA2EqA10yjHiR6H9cj6MFiOnb5In1eWsRM ++UM2v3e9tNsCAgBukPHAg1lQh07rvFKm/Bz9BCjaxorALINUfZ9DD64j2igLIxle2 ++DPxW8dI/F2loHMjXZjqG8RkqZUdoxtID5+90FgsGIfkMpqgRS05f4zPbCEHqCXl1 ++eO5HyELTgcVlLXXQDgAWnRzut1hFJeczY1tjQQno6f6s+nMydLN26WuU4s3UYvOu ++OsUxRlJu7TSRHqDC3lSE5XggVkzdaPkuKGQbGpny+01/47hfXXNB7HntWNZ6N2Vw ++p7G6OfY+YQrZwIaQmhrIqJZuigsrbe3W+gdn5ykE9+Ky0VgVUsfxo52mwFYs1JKY ++2PGDuWx8M6DlS6qQkvHaRUo0FMd8TsSlbF0/v965qGFKhSDeQoMpYnwcmQilRh/0 ++ayLThlHLN81gSkJjVrPI0Y8xCVPB4twb1PFUd2fPM3sA1tJ83sZ5v8vgFv2yofKR ++PB0t6JzUA81mSqM3kxl5e+IZwhYAyO0OTg3/fs8HqGTNKd9BqoUwSRBzp06JMg5b ++rUCGwbCUDI0mxadJ3Bz4WxR6fyNpBK2yAinWEsikxqEt ++-----END CERTIFICATE----- +diff --git a/certs/letsencryptauthorityx4.pem b/certs/letsencryptauthorityx4.pem +new file mode 100644 +index 0000000..34064da +--- /dev/null ++++ b/certs/letsencryptauthorityx4.pem +@@ -0,0 +1,32 @@ ++-----BEGIN CERTIFICATE----- ++MIIFjTCCA3WgAwIBAgIRAJObmZ6kjhYNW0JZtD0gE9owDQYJKoZIhvcNAQELBQAw ++TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh ++cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTYxMDA2MTU0NDM0 ++WhcNMjExMDA2MTU0NDM0WjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg ++RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDQwggEi ++MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhJHRCe7eRMdlz/ziq2M5EXLc5 ++CtxErg29RbmXN2evvVBPX9MQVGv3QdqOY+ZtW8DoQKmMQfzRA4n/YmEJYNYHBXia ++kL0aZD5P3M93L4lry2evQU3FjQDAa/6NhNy18pUxqOj2kKBDSpN0XLM+Q2lLiSJH ++dFE+mWTDzSQB+YQvKHcXIqfdw2wITGYvN3TFb5OOsEY3FmHRUJjIsA9PWFN8rPba ++LZZhUK1D3AqmT561Urmcju9O30azMdwg/GnCoyB1Puw4GzZOZmbS3/VmpJMve6YO ++lD5gPUpLHG+6tE0cPJFYbi9NxNpw2+0BOXbASefpNbUUBpDB5ZLiEP1rubSFAgMB ++AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU ++BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB ++FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBTF ++satOTLHNZDCTfsGEmQWr5gPiJTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js ++LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF ++BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG ++AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD ++VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB ++AF4tI1yGjZgld9lP01+zftU3aSV0un0d2GKUMO7GxvwTLWAKQz/eT+u3J4+GvpD+ ++BMfopIxkJcDCzMChjjZtZZwJpIY7BatVrO6OkEmaRNITtbZ/hCwNkUnbk3C7EG3O ++GJZlo9b2wzA8v9WBsPzHpTvLfOr+dS57LLPZBhp3ArHaLbdk33lIONRPt9sseDEk ++mdHnVmGmBRf4+J0Wy67mddOvz5rHH8uzY94raOayf20gzzcmqmot4hPXtDG4Y49M ++oFMMT2kcWck3EOTAH6QiGWkGJ7cxMfSL3S0niA6wgFJtfETETOZu8AVDgENgCJ3D ++S0bz/dhVKvs3WRkaKuuR/W0nnC2VDdaFj4+CRF8LGtn/8ERaH48TktH5BDyDVcF9 ++zfJ75Scxcy23jAL2N6w3n/t3nnqoXt9Im4FprDr+mP1g2Z6Lf2YA0jE3kZalgZ6l ++NHu4CmvJYoOTSJw9X2qlGl1K+B4U327rG1tRxgjM76pN6lIS02PMECoyKJigpOSB ++u4V8+LVaUMezCJH9Qf4EKeZTHddQ1t96zvNd2s9ewSKx/DblXbKsBDzIdHJ+qi6+ ++F9DIVM5/ICdtDdulOO+dr/BXB+pBZ3uVxjRANvJKKpdxkePyluITSNZHbanWRN07 ++gMvwBWOL060i4VrL9er1sBQrRjU9iNpZQGTnLVAxQVFu ++-----END CERTIFICATE----- +diff --git a/client b/client +index 838b184..52aab3d 100755 +--- a/client ++++ b/client +@@ -338,20 +338,7 @@ elsif ($COMMAND eq 'newOrder') { + die "Timeout exceeded while waiting for certificate\n" if $timeout > 0 and $i >= $timeout; + sleep $retry_after; + } +- +- # keep only the leaf certificate +- pipe my $rd, my $wd or die "Can't pipe: $!"; +- my $pid = fork // die "Can't fork: $!"; +- unless ($pid) { +- open STDIN, '<&', $rd or die "Can't dup: $!"; +- exec qw/openssl x509 -outform PEM/ or die; +- } +- $rd->close() or die "Can't close: $!"; +- $wd->print( $r->decoded_content() ); +- $wd->close() or die "Can't close: $!"; +- +- waitpid $pid => 0; +- die $? if $? > 0; ++ print $r->decoded_content(); + } + + +diff --git a/config/lacme-certs.conf b/config/lacme-certs.conf +index 97d588a..7a9ba29 100644 +--- a/config/lacme-certs.conf ++++ b/config/lacme-certs.conf +@@ -20,8 +20,8 @@ + # + #certificate = /etc/nginx/ssl/srv.pem + +-# Where to store the issued certificate, concatenated with the content +-# of the file specified specified with the CAfile option (in PEM format). ++# Where to store the issued certificate along with its chain of trust ++# (in PEM format). + # + #certificate-chain = /etc/nginx/ssl/srv.chain.pem + +@@ -30,11 +30,10 @@ + # + #min-days = 21 + +-# Path to the issuer's certificate. This is used for certificate-chain +-# and to verify the validity of each issued certificate. Specifying an +-# empty value skip certificate validation. ++# Path to trusted issuer certificates, used for validating each issued ++# certificate. Specifying an empty value skips certificate validation. + # +-#CAfile = /usr/share/lacme/lets-encrypt-x3-cross-signed.pem ++#CAfile = /usr/share/lacme/ca-certificates.crt + + # Subject field of the Certificate Signing Request. This option is + # required. +diff --git a/lacme b/lacme +index 3e5347d..8f03d38 100755 +--- a/lacme ++++ b/lacme +@@ -609,12 +609,10 @@ sub spawn($@) { + + + ############################################################################# +-# Install the certificate ++# Install the certificate (optionally excluding the chain of trust) + # + sub install_cert($$;$) { +- my $filename = shift; +- my $x509 = shift; +- my @chain = grep !/\A\s*\z/, @_; # ignore empty CAfile ++ my ($filename, $chain, $leafonly) = @_; + + my ($dirname, $basename) = + $filename =~ /\A(.*)\/([^\/]+)\z/ ? ($1, $2) : ('.', $filename); +@@ -624,12 +622,23 @@ sub install_cert($$;$) { + eval { + my $umask = umask() // die "umask: $!"; + chmod(0644 &~ $umask, $fh) or die "chmod: $!"; +- $fh->print($x509) or die "Can't print: $!"; +- foreach (@chain) { # append the chain +- open my $fh2, '<', $_ or die "Can't open $_: $!"; +- my $ca = do { local $/ = undef; $fh2->getline() }; +- $fh2->close() or die "Can't close: $!"; +- $fh->print($ca) or die "Can't print: $!"; ++ if ($leafonly) { ++ # keep only the leaf certificate ++ pipe my $rd, my $wd or die "Can't pipe: $!"; ++ my $pid = fork // die "Can't fork: $!"; ++ unless ($pid) { ++ open STDIN, '<&', $rd or die "Can't dup: $!"; ++ open STDOUT, '>&', $fh or die "Can't dup: $!"; ++ exec qw/openssl x509 -outform PEM/ or die; ++ } ++ $rd->close() or die "Can't close: $!"; ++ $wd->print($chain); ++ $wd->close() or die "Can't close: $!"; ++ ++ waitpid $pid => 0; ++ die $? if $? > 0; ++ } else { ++ $fh->print($chain) or die "Can't print: $!"; + } + $fh->close() or die "Can't close: $!"; + }; +@@ -767,7 +776,7 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') { + }; + + # verify certificate validity against the CA +- $conf->{CAfile} //= '/usr/share/lacme/lets-encrypt-x3-cross-signed.pem'; ++ $conf->{CAfile} //= '/usr/share/lacme/ca-certificates.crt'; + if ($conf->{CAfile} ne '' and spawn({in => $x509}, 'openssl', 'verify', '-CAfile', $conf->{CAfile}, + qw/-purpose sslserver -x509_strict/)) { + print STDERR "[$s] Error: Received invalid X.509 certificate from ACME server!\n"; +@@ -778,11 +787,11 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') { + # install certificate + if (defined $conf->{'certificate'}) { + print STDERR "Installing X.509 certificate $conf->{'certificate'}\n"; +- install_cert($conf->{'certificate'}, $x509); ++ install_cert($conf->{'certificate'}, $x509, 1); + } + if (defined $conf->{'certificate-chain'}) { + print STDERR "Installing X.509 certificate chain $conf->{'certificate-chain'}\n"; +- install_cert($conf->{'certificate-chain'}, $x509, $conf->{CAfile}); ++ install_cert($conf->{'certificate-chain'}, $x509); + } + + if (defined $conf->{chown}) { +diff --git a/lacme.md b/lacme.md +index 2d70c49..28d1a53 100644 +--- a/lacme.md ++++ b/lacme.md +@@ -327,9 +327,8 @@ Valid options are: + + *certificate-chain* + +-: Where to store the issued certificate, concatenated with the content +- of the file specified specified with the *CAfile* option (in PEM +- format). ++: Where to store the issued certificate along with its chain of trust ++ (in PEM format). + At least one of *certificate* or *certificate-chain* is required. + + *certificate-key* +@@ -351,11 +350,9 @@ Valid options are: + + *CAfile* + +-: Path to the issuer's certificate. This is used for +- *certificate-chain* and to verify the validity of each issued +- certificate. +- Specifying an empty value skip certificate validation. +- Default: `/usr/share/lacme/lets-encrypt-x3-cross-signed.pem`. ++: Path to trusted issuer certificates, used for validating each issued ++ certificate. Specifying an empty values skips certificate validation. ++ Default: `/usr/share/lacme/ca-certificates.crt`. + + *hash* + +-- +2.29.2 + diff --git a/debian/patches/series b/debian/patches/series index ddf7cce..fcf1c3f 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ 0001-Mention-the-Debian-BTS-in-the-manpages.patch 0002-Issue-GET-and-POST-as-GET-requests.patch +0003-Use-upstream-certicate-chain-instead-of-an-hardcoded.patch |