| Commit message (Collapse) | Author | Age | Files |
|
|
|
| |
Now part of the upstream build system.
|
| |
|
|
|
|
|
| |
lacme also works with earlier accountds, but might yield bad suprises
when the 'keyid' setting is set.
|
| |
|
| |
|
| |
|
| |
|
|
|
|
| |
See b54d248515357297d84a01cf45a42a6787c21240.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
* The internal webserver now runs as a dedicated system user _lacme-www
(and group nogroup) instead of www-data:www-data. This is configurable
in the [webserver] section of the lacme(8) configuration file.
* The internal ACME client now runs as a dedicated system user _lacme-client
(and group nogroup) instead of nobody:nogroup. This is configurable in
the [client] section of the lacme(8) configuration file.
* The _lacme-www and _lacme-client system users are created automatically by
lacme.postinst (hence a new Depends: adduser), and deleted on purge. (So
make sure not to chown any file to these internal users.)
|
|
|
|
| |
And add "Forwarded: not-needed" annotations when relevant.
|
|\
| |
| |
| | |
Release version 0.8.0
|
| | |
|
| | |
|
| |
| |
| |
| | |
The staging environment wasn't set properly for the Debian packages.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
| |
| |
| |
| | |
This saves a round trip and provides a safeguard against malicious
clients.
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Passing the JWA to the ACME client is required if we want to support
account keys other than RSA. As of 0.7 both lacme-accountd(1) and
lacme(8) hardcode “RS256” (SHA256withRSA per RFC 7518 sec. A.1).
Passing the JWK thumbprint is handy as it gives more flexibility if RFC
8555 sec. 8.1 were to be updated with another digest algorithm (it's
currently hardcoded to SHA-256). A single lacme-account(1) instance
might be used to sign requests from many clients, and it's easier to
upgrade a single ‘lacme-accountd’ than many ‘lacme’. Moreover, in some
restricted environments lacme-accountd might hide the JWK from the
client to prevent ‘newAccount’ requests (such as contact updates);
passing its thumbprint is enough for ‘newOrder’ requests.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
| |
| |
| | |
Prefixed with a timestamp.
|
| |
| |
| |
| | |
Before printing them to the standard error.
|
| | |
|
| |
| |
| |
| |
| | |
It's an internal flag, but can be useful for authorized_keys(5)
restrictions.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
lacme(8): for --config=, --socket=, --config-certs= (and ‘socket’/
‘config-certs’/‘challenge-directory’ configuration options *before*
privilege drop; and for the [accountd] section ‘command’/‘config’
configuration options *after* privilege drop).
lacme-accountd(1): for --config=, --socket= and --privkey= (and
‘socket’/‘privkey’ configuration options).
This also changes the default configuration file location. lacme(8) and
lacme-accountd(1) now respectively use /etc/lacme/lacme.conf resp.
/etc/lacme/lacme-accountd.conf when running as root, and
$XDG_CONFIG_HOME/lacme/lacme.conf resp. $XDG_CONFIG_HOME/lacme/lacme-accountd.conf
when running as a normal user. There is no fallback to /etc anymore.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
| |
| |
| | |
Not that it make a difference since we don't run suid.
|
| |
| |
| |
| |
| |
| |
| | |
../../lacme/apache2.conf.
This is useful for enabling the snippet with `a2enconf lacme`, cf.
https://bugs.debian.org/955859 .
|
| | |
|
| |
| |
| |
| | |
And add a test case for this.
|
| |
| |
| |
| |
| | |
Instead, treat it as an empty file. This makes it possible to use
lacme-accountd(1) without configuration file under ~/.config/lacme.
|
| |
| |
| |
| | |
These tests are not interactive!
|
| |
| |
| |
| | |
This is needed for gpg-encrypted privkeys.
|
| |
| |
| |
| |
| |
| |
| | |
configuration file.
One need to use the lacme-accountd(1) configuration file for that
instead.
|
| |
| |
| |
| |
| |
| |
| |
| | |
default value.
The previous default, namely /etc/lacme/lacme-accountd.conf, is still
honored when there is the user running lacme doesn't have a
~/.config/lacme/lacme-account.conf configuration file.
|
| |
| |
| |
| | |
https://letsencrypt.org/docs/staging-environment/
|
| |
| |
| |
| | |
Cf. https://community.letsencrypt.org/t/staging-hierarchy-new-root-cert/145677 .
|