aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFiles
* Adjust test suite against current Let's Encrypt staging environment.Guilhem Moulin2023-01-257
|
* Replace '$(dir $@)' with '$(@D)' in Makefile.Guilhem Moulin2023-01-252
|
* lacme: pass a temporary JSON file with the client configuration to the ↵Guilhem Moulin2021-02-254
| | | | | | | | | internal client. So it doesn't have to parse the INI file again. Also, while lacme.conf is world-readable by default, one might restrict permissions and add private information in there, not realizing that everything, including comments, will be readable by the client.
* lacme: split certificates using Net::SSLeay::PEM_* instead of calling openssl.Guilhem Moulin2021-02-252
|
* lacme: improve install_cert()'s handling of temporary files.Guilhem Moulin2021-02-241
|
* lacme: Return an error when the 'mode'/'chown' isn't a number.Guilhem Moulin2021-02-242
| | | | oct("foobar") is 0, definitely not what we want.
* lacme: Add 'owner' resp. 'mode' as (prefered) alias for 'chown' resp. 'chmod'.Guilhem Moulin2021-02-245
|
* lacme: Default mode for certificate(-chain) creation is 0644 minus umask ↵Guilhem Moulin2021-02-245
| | | | | | | | restrictions. Also, always spawn the client with umask 0022 so a starting lacme(8) with a restrictive umask doesn't impede serving challenge response files.
* lacme: Don't write certificate(-chain) file on chown/chmod failure.Guilhem Moulin2021-02-243
| | | | | | | | | Otherwise we end up with files with mode 0644 owned by root:root, and subsequent lacme(8) invocations will likely not renew them for a while. This change also saves a chown(2) call. And the new logic (chown resp. chmod from root:root resp. 0600) is safe if we ever include private key material in there too.
* If restricting access via umask() fails, don't include errno in the error ↵Guilhem Moulin2021-02-243
| | | | | | | message. errno is not set on umask failure, see https://perldoc.perl.org/functions/umask.
* lacme: Ignore empty values in 'chown'/'chmod'/'certificate'/'certificate-chain'.Guilhem Moulin2021-02-242
|
* tests/cert-install: Include tests for failing chown(2).Guilhem Moulin2021-02-242
| | | | Due to unknown user/group name.
* tab damageGuilhem Moulin2021-02-241
|
* typofixGuilhem Moulin2021-02-241
|
* tests/drop-privileges: Ensure failure to drop privileges yields an error.Guilhem Moulin2021-02-242
| | | | And doesn't retain root privileges.
* lacme: When getpwnam()/getgrnam()'s errno is 0, exclude it from error messages.Guilhem Moulin2021-02-242
|
* lacme-accountd: Refactor logging logic.Guilhem Moulin2021-02-232
|
* lacme-accountd: don't log debug messages unless --debug is set.Guilhem Moulin2021-02-232
|
* Consolidate error messages.Guilhem Moulin2021-02-232
|
* lacme-accountd: panic() upon internal error of the signing routine.Guilhem Moulin2021-02-221
| | | | It might croak and we want to log that error also.
* test suite: Avoid setting twice the ACME API server URL.Guilhem Moulin2021-02-221
|
* test: Allow prefixing test names with 'tests/'.Guilhem Moulin2021-02-221
| | | | It's handy to be able to run `./test tests/accountd*` or similar.
* lacme-accountd: Refuse to sign JWS with an invalid Protected Header.Guilhem Moulin2021-02-223
| | | | | | | | | | | “The JWS Protected Header is a JSON object” — RFC 7515 sec. 2. “The JWS Protected Header MUST include the following fields: - "alg" - "nonce" - "url" - either "jwk" or "kid"” — RFC 8555 sec. 6.2.
* lacme-account: Improve log messages.Guilhem Moulin2021-02-225
| | | | Again…
* accountd::conn(): Minor refactoring.Guilhem Moulin2021-02-221
|
* In lacme's the [accountd] config, let lacme-accountd(1) do the %-expansion ↵Guilhem Moulin2021-02-223
| | | | | | | | for 'config'. This matches the arguably expected behavior that ‘config = %h/foo’ is passed as ‘--config=%h/foo’ and resolved by lacme-accountd(1) (possibly remote and with another passwd database).
* Prepare new release v0.8.0.v0.8.0Guilhem Moulin2021-02-224
|
* tests: Check presence of extra greeting data.Guilhem Moulin2021-02-221
|
* Fix `./test --deb`.Guilhem Moulin2021-02-223
| | | | The staging environment wasn't set properly for the Debian packages.
* Print error messages only once.Guilhem Moulin2021-02-221
|
* space damageGuilhem Moulin2021-02-221
|
* client: Print Terms of Service URL for 'account' command.Guilhem Moulin2021-02-222
|
* logfile: treat empty values as unset.Guilhem Moulin2021-02-221
|
* Add 'logfile' to lacme-account.conf.Guilhem Moulin2021-02-221
|
* lacme-accountd(1): new setting 'keyid'.Guilhem Moulin2021-02-226
| | | | | This saves a round trip and provides a safeguard against malicious clients.
* accountd: Improve log message for incoming requests.Guilhem Moulin2021-02-213
|
* accountd: Pass JWA and JWK thumbprint via extended greeting data.Guilhem Moulin2021-02-213
| | | | | | | | | | | | | | | Passing the JWA to the ACME client is required if we want to support account keys other than RSA. As of 0.7 both lacme-accountd(1) and lacme(8) hardcode “RS256” (SHA256withRSA per RFC 7518 sec. A.1). Passing the JWK thumbprint is handy as it gives more flexibility if RFC 8555 sec. 8.1 were to be updated with another digest algorithm (it's currently hardcoded to SHA-256). A single lacme-account(1) instance might be used to sign requests from many clients, and it's easier to upgrade a single ‘lacme-accountd’ than many ‘lacme’. Moreover, in some restricted environments lacme-accountd might hide the JWK from the client to prevent ‘newAccount’ requests (such as contact updates); passing its thumbprint is enough for ‘newOrder’ requests.
* Add IPC tests with an old lacme(8) resp. lacme-accountd(1).Guilhem Moulin2021-02-212
|
* wordingGuilhem Moulin2021-02-215
|
* wordingGuilhem Moulin2021-02-212
|
* accountd: Fix prototype.Guilhem Moulin2021-02-211
|
* test suite: Don't try to show stderr if it's empty.Guilhem Moulin2021-02-211
|
* test suite: Indicate which tests have passed.Guilhem Moulin2021-02-211
|
* Make the ACME API server URL configurable at build time.Guilhem Moulin2021-02-215
|
* lacme-accountd: new setting 'logfile' to log signature requests.Guilhem Moulin2021-02-218
| | | | Prefixed with a timestamp.
* lacme-accountd(1): base64url-decode incoming signature requests.Guilhem Moulin2021-02-212
| | | | Before printing them to the standard error.
* Documentation: Wrap commands in `…`.Guilhem Moulin2021-02-201
|
* Document `lacme-accountd --stdio`.Guilhem Moulin2021-02-204
| | | | | It's an internal flag, but can be useful for authorized_keys(5) restrictions.
* Add %-specifiers support.Guilhem Moulin2021-02-2011
| | | | | | | | | | | | | | | | lacme(8): for --config=, --socket=, --config-certs= (and ‘socket’/ ‘config-certs’/‘challenge-directory’ configuration options *before* privilege drop; and for the [accountd] section ‘command’/‘config’ configuration options *after* privilege drop). lacme-accountd(1): for --config=, --socket= and --privkey= (and ‘socket’/‘privkey’ configuration options). This also changes the default configuration file location. lacme(8) and lacme-accountd(1) now respectively use /etc/lacme/lacme.conf resp. /etc/lacme/lacme-accountd.conf when running as root, and $XDG_CONFIG_HOME/lacme/lacme.conf resp. $XDG_CONFIG_HOME/lacme/lacme-accountd.conf when running as a normal user. There is no fallback to /etc anymore.
* Wording: s/option/setting/.Guilhem Moulin2021-02-204
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-09 18:05:20 +0000