| Commit message (Collapse) | Author | Age | Files | |
|---|---|---|---|---|
| * | lacme: Add 'owner' resp. 'mode' as (prefered) alias for 'chown' resp. 'chmod'. | Guilhem Moulin | 2021-02-24 | 1 |
| | | ||||
| * | Add 'logfile' to lacme-account.conf. | Guilhem Moulin | 2021-02-22 | 1 |
| | | ||||
| * | lacme-accountd(1): new setting 'keyid'. | Guilhem Moulin | 2021-02-22 | 1 |
| | | | | | | This saves a round trip and provides a safeguard against malicious clients. | |||
| * | Make the ACME API server URL configurable at build time. | Guilhem Moulin | 2021-02-21 | 1 |
| | | ||||
| * | Add %-specifiers support. | Guilhem Moulin | 2021-02-20 | 2 |
| | | | | | | | | | | | | | | | | | lacme(8): for --config=, --socket=, --config-certs= (and ‘socket’/ ‘config-certs’/‘challenge-directory’ configuration options *before* privilege drop; and for the [accountd] section ‘command’/‘config’ configuration options *after* privilege drop). lacme-accountd(1): for --config=, --socket= and --privkey= (and ‘socket’/‘privkey’ configuration options). This also changes the default configuration file location. lacme(8) and lacme-accountd(1) now respectively use /etc/lacme/lacme.conf resp. /etc/lacme/lacme-accountd.conf when running as root, and $XDG_CONFIG_HOME/lacme/lacme.conf resp. $XDG_CONFIG_HOME/lacme/lacme-accountd.conf when running as a normal user. There is no fallback to /etc anymore. | |||
| * | Wording: s/option/setting/. | Guilhem Moulin | 2021-02-20 | 2 |
| | | ||||
| * | Deprecate setting 'privkey' in [accountd] section of the lacme(8) ↵ | Guilhem Moulin | 2021-02-20 | 2 |
| | | | | | | | | configuration file. One need to use the lacme-accountd(1) configuration file for that instead. | |||
| * | lacme(8)'s 'config' option in the [accountd] section no longer have a ↵ | Guilhem Moulin | 2021-02-20 | 1 |
| | | | | | | | | | default value. The previous default, namely /etc/lacme/lacme-accountd.conf, is still honored when there is the user running lacme doesn't have a ~/.config/lacme/lacme-account.conf configuration file. | |||
| * | Split client/webserver/accountd commands on whitespace. | Guilhem Moulin | 2021-02-18 | 1 |
| | | | | | This doesn't change the default behavior. | |||
| * | challenge-directory now needs to be set to an *existing* directory. | Guilhem Moulin | 2021-02-14 | 1 |
| | | | | | | | | Since lacme(8) spawns a builtin webserver by default the change doesn't affect default configurations. See https://bugs.debian.org/970800 for the rationale. | |||
| * | lacme: allow direct use challenge-directory .well-known/acme-challenge | Benjamin Tietz | 2021-02-14 | 1 |
| | | ||||
| * | Improve keyUsage documentation. | Guilhem Moulin | 2021-02-12 | 1 |
| | | ||||
| * | Raise client timeout from 10 to 30s. | Guilhem Moulin | 2021-02-12 | 1 |
| | | ||||
| * | Make unprivileged user/group for the internal client resp. webserver ↵ | Guilhem Moulin | 2020-12-09 | 1 |
| | | | | | configurable. | |||
| * | s/\.pem$/.crt/ | Guilhem Moulin | 2020-12-09 | 1 |
| | | ||||
| * | documentation: emphasize default values in the config file. | Guilhem Moulin | 2020-12-09 | 1 |
| | | | | | | Also, move the most common options ('hash', 'keyUsage', 'CAfile', 'min-days') to the default section. | |||
| * | documentation: clarify that "file:/path/to/account.key" can point to a ↵ | Guilhem Moulin | 2020-12-09 | 1 |
| | | | | | symmetrically-encrypted private key. | |||
| * | Use upstream certicate chain instead of an hardcoded one.upstream/0.7 | Guilhem Moulin | 2020-11-26 | 1 |
| | | | | | | | | | | | | | | This is a breaking change. The certificate indicated by 'CAfile' is no longer used as is in 'certificate-chain' (along with the leaf cert). The chain returned by the ACME v2 endpoint is used instead. This allows for more flexbility with respect to key/CA rotation, cf. https://letsencrypt.org/2020/11/06/own-two-feet.html and https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which is a concatenation of all known active CA certificates (which includes the previous default). | |||
| * | Ignore [accountd] section from lacme.conf when the --socket option is defined. | Guilhem Moulin | 2020-08-04 | 1 |
| | | | | | | This allows remotely-controlled lacme processes being controlled without modifying an config files. See https://bugs.debian.org/955767 . | |||
| * | Makefile: Use variables for target directories etc. | Guilhem Moulin | 2020-08-04 | 2 |
| | | ||||
| * | Change default libexec dir from /usr/lib/lacme to /usr/libexec/lacme. | Guilhem Moulin | 2020-08-03 | 1 |
| | | ||||
| * | Install lacme manpage to section 8. | Guilhem Moulin | 2020-08-03 | 1 |
| | | | | | As it's a system command, see hier(7) for details. | |||
| * | Use /run for the listening socket of the webserver component. | Guilhem Moulin | 2019-08-22 | 1 |
| | | ||||
| * | Use ACME v2 endpoints | Guilhem Moulin | 2018-04-27 | 1 |
| | | | | | https://tools.ietf.org/html/draft-ietf-acme-acme-12 | |||
| * | Bind webserver to /var/run/lacme-www.socket by default. | Guilhem Moulin | 2017-07-08 | 1 |
| | | ||||
| * | mv config/{apache2.conf,nginx.conf} snippets/ | Guilhem Moulin | 2017-07-08 | 2 |
| | | ||||
| * | wibble | Guilhem Moulin | 2017-06-30 | 1 |
| | | ||||
| * | Provide apache2 configuration snippet. | Guilhem Moulin | 2017-06-29 | 2 |
| | | ||||
| * | Improve docs. | Guilhem Moulin | 2017-06-29 | 1 |
| | | ||||
| * | Provide nginx configuration snippet. | Guilhem Moulin | 2017-06-28 | 1 |
| | | ||||
| * | Change the default 'min-days' from 10 to 21. | Guilhem Moulin | 2017-06-28 | 1 |
| | | | | | | | This avoids expiration notices from Let's Encrypt when auto-renewal is done by a cronjob: Let's Encrypt sends a notice 19 (then 9) days before expiration. | |||
| * | webserver: allow listening to multiple addresses. | Guilhem Moulin | 2017-06-28 | 1 |
| | | | | | | | | | | | (Useful when dual-stack IPv4/IPv6 is not supported.) Also, change the default to listen to a UNIX-domain socket </var/run/lacme.socket>. Moreover temporary iptables rules are no longer installed. Hosts without a public HTTP daemon listening on port 80 need to set the 'listen' option to [::] and/or 0.0.0.0, and possibly set the 'iptables' option to Yes. | |||
| * | s/lacme-certs.d/lacme-certs.conf.d/upstream/0.2 | Guilhem Moulin | 2016-12-05 | 1 |
| | | ||||
| * | "config-certs" now points to a list of files or directories. | Guilhem Moulin | 2016-12-05 | 1 |
| | | ||||
| * | Improve formatting of config files. | Guilhem Moulin | 2016-12-01 | 2 |
| | | ||||
| * | wibble | Guilhem Moulin | 2016-12-01 | 1 |
| | | ||||
| * | lacme.conf: mention the default groupname for the ACME client. | Guilhem Moulin | 2016-12-01 | 1 |
| | | ||||
| * | s/priv.key/account.key/ | Guilhem Moulin | 2016-12-01 | 1 |
| | | ||||
| * | wibble | Guilhem Moulin | 2016-12-01 | 1 |
| | | ||||
| * | Make lacme able to spawn lacme-accountd. | Guilhem Moulin | 2016-12-01 | 1 |
| | | ||||
| * | typo | Guilhem Moulin | 2016-11-30 | 3 |
| | | ||||
| * | typo | Guilhem Moulin | 2016-06-14 | 1 |
| | | ||||
| * | Rename ‘letsencrypt-tiny’ to ‘lacme’. | Guilhem Moulin | 2016-06-13 | 3 |
| | | ||||
| * | Change the default CA from LE's X1 to X3. | Guilhem Moulin | 2016-03-27 | 1 |
| | | ||||
| * | Use restart not reload in notify commands | Guilhem Moulin | 2016-03-05 | 1 |
| | | ||||
| * | Refactoring to use the account key manager. | Guilhem Moulin | 2016-03-02 | 2 |
| | | ||||
| * | letsencrypt-accountd | Guilhem Moulin | 2016-03-02 | 1 |
 |
index : lacme | |
| Small ACME client written with process isolation and minimal privileges in mind | Guilhem Moulin |
| aboutsummaryrefslogtreecommitdiffstats |