aboutsummaryrefslogtreecommitdiffstats
path: root/lacme
Commit message (Collapse)AuthorAgeFiles
* Prepare new release v0.8.3.v0.8.3Guilhem Moulin2024-06-131
|
* Fix post-issuance validation logic.Guilhem Moulin2024-06-131
| | | | | | | | | | | | | | | | | | | | | Rather than adding intermediates in the certificate bundle we now validate the leaf certificate with intermediates as untrusted (used for chain building only). Only the root certificates are used as trust anchor. Not pining intermediate certificates anymore is in line with Let's Encrypt's latest recommendations: Rotating the set of intermediates we issue from helps keep the Internet agile and more secure. It encourages automation and efficiency, and discourages outdated practices like key pinning. “Key Pinning” is a practice in which clients — either ACME clients getting certificates for their site, or apps connecting to their own backend servers — decide to trust only a single issuing intermediate certificate rather than delegating trust to the system trust store. Updating pinned keys is a manual process, which leads to an increased risk of errors and potential business continuity failures. — https://letsencrypt.org/2024/03/19/new-intermediate-certificates:
* Pass `-in /dev/stdin` option to openssl(1) to avoid warning with recent ↵Guilhem Moulin2024-06-131
| | | | | | | | | | versions. OpenSSL 3.2 from Debian sid spews Warning: Reading certificate from stdin since no -in or -new option is given without an explicit `-in /dev/stdin`.
* Prepare new release v0.8.2.v0.8.2Guilhem Moulin2023-04-251
|
* Prepare new release v0.8.1.v0.8.1Guilhem Moulin2023-01-251
|
* lacme: pass a temporary JSON file with the client configuration to the ↵Guilhem Moulin2021-02-251
| | | | | | | | | internal client. So it doesn't have to parse the INI file again. Also, while lacme.conf is world-readable by default, one might restrict permissions and add private information in there, not realizing that everything, including comments, will be readable by the client.
* lacme: split certificates using Net::SSLeay::PEM_* instead of calling openssl.Guilhem Moulin2021-02-251
|
* lacme: improve install_cert()'s handling of temporary files.Guilhem Moulin2021-02-241
|
* lacme: Return an error when the 'mode'/'chown' isn't a number.Guilhem Moulin2021-02-241
| | | | oct("foobar") is 0, definitely not what we want.
* lacme: Add 'owner' resp. 'mode' as (prefered) alias for 'chown' resp. 'chmod'.Guilhem Moulin2021-02-241
|
* lacme: Default mode for certificate(-chain) creation is 0644 minus umask ↵Guilhem Moulin2021-02-241
| | | | | | | | restrictions. Also, always spawn the client with umask 0022 so a starting lacme(8) with a restrictive umask doesn't impede serving challenge response files.
* lacme: Don't write certificate(-chain) file on chown/chmod failure.Guilhem Moulin2021-02-241
| | | | | | | | | Otherwise we end up with files with mode 0644 owned by root:root, and subsequent lacme(8) invocations will likely not renew them for a while. This change also saves a chown(2) call. And the new logic (chown resp. chmod from root:root resp. 0600) is safe if we ever include private key material in there too.
* If restricting access via umask() fails, don't include errno in the error ↵Guilhem Moulin2021-02-241
| | | | | | | message. errno is not set on umask failure, see https://perldoc.perl.org/functions/umask.
* lacme: Ignore empty values in 'chown'/'chmod'/'certificate'/'certificate-chain'.Guilhem Moulin2021-02-241
|
* lacme: When getpwnam()/getgrnam()'s errno is 0, exclude it from error messages.Guilhem Moulin2021-02-241
|
* In lacme's the [accountd] config, let lacme-accountd(1) do the %-expansion ↵Guilhem Moulin2021-02-221
| | | | | | | | for 'config'. This matches the arguably expected behavior that ‘config = %h/foo’ is passed as ‘--config=%h/foo’ and resolved by lacme-accountd(1) (possibly remote and with another passwd database).
* Prepare new release v0.8.0.v0.8.0Guilhem Moulin2021-02-221
|
* wordingGuilhem Moulin2021-02-211
|
* lacme-accountd: new setting 'logfile' to log signature requests.Guilhem Moulin2021-02-211
| | | | Prefixed with a timestamp.
* Add %-specifiers support.Guilhem Moulin2021-02-201
| | | | | | | | | | | | | | | | lacme(8): for --config=, --socket=, --config-certs= (and ‘socket’/ ‘config-certs’/‘challenge-directory’ configuration options *before* privilege drop; and for the [accountd] section ‘command’/‘config’ configuration options *after* privilege drop). lacme-accountd(1): for --config=, --socket= and --privkey= (and ‘socket’/‘privkey’ configuration options). This also changes the default configuration file location. lacme(8) and lacme-accountd(1) now respectively use /etc/lacme/lacme.conf resp. /etc/lacme/lacme-accountd.conf when running as root, and $XDG_CONFIG_HOME/lacme/lacme.conf resp. $XDG_CONFIG_HOME/lacme/lacme-accountd.conf when running as a normal user. There is no fallback to /etc anymore.
* wibbleGuilhem Moulin2021-02-201
|
* Remove dependency on List::Util (core module).Guilhem Moulin2021-02-201
|
* Use real UID not effective UID in environment sanitation.Guilhem Moulin2021-02-201
| | | | Not that it make a difference since we don't run suid.
* lacme: Preserve $GPG_TTY when spawning the accountd.Guilhem Moulin2021-02-201
| | | | This is needed for gpg-encrypted privkeys.
* Deprecate setting 'privkey' in [accountd] section of the lacme(8) ↵Guilhem Moulin2021-02-201
| | | | | | | configuration file. One need to use the lacme-accountd(1) configuration file for that instead.
* lacme(8)'s 'config' option in the [accountd] section no longer have a ↵Guilhem Moulin2021-02-201
| | | | | | | | default value. The previous default, namely /etc/lacme/lacme-accountd.conf, is still honored when there is the user running lacme doesn't have a ~/.config/lacme/lacme-account.conf configuration file.
* Use File::Basename::dirname().Guilhem Moulin2021-02-201
| | | | | | To correctly extract the parent directory of the socket path. The previous returned an empty string when the socket path didn't contain ‘/’.
* accountd: replace internal option --conn-fd=FD with flag --stdio.Guilhem Moulin2021-02-181
| | | | | Using stdin/stdout makes it possible to tunnel the accountd connection through ssh.
* Split client/webserver/accountd commands on whitespace.Guilhem Moulin2021-02-181
| | | | This doesn't change the default behavior.
* Set the DEBUG environment variable to 0/1 instead of ""/1.Guilhem Moulin2021-02-181
|
* Use 'acme-challenge.XXXXXXXXXX' as template for the temporary ACME challenge ↵Guilhem Moulin2021-02-181
| | | | directory.
* webserver: reopen stdin from /dev/null.Guilhem Moulin2021-02-181
| | | | | Having both lacme(8) and its webserver component reading from the same standard input could yield starvation.
* Sanitize environment when spawning children.Guilhem Moulin2021-02-181
| | | | | Set $HOME, $USER, $SHELL, $PATH, $LOGNAME to appropriate values (and perserve $TERM), which matches the login(1) behavior.
* Consolidate error messages for consistency.Guilhem Moulin2021-02-181
|
* Don't load configuration files from ./ by default.Guilhem Moulin2021-02-181
| | | | | | | This is a breaking change: lacme(8) resp. lacme-accountd(1) no longer consider ./lacme.conf resp. ./lacme-accountd.conf as default location for the configuration file. Doing so has security implications when running these program from insecure directories.
* Add support for TLS Feature extension from RFC 7633.Guilhem Moulin2021-02-151
| | | | This is mostly useful for OCSP Must-Staple.
* Bump copyright years.Guilhem Moulin2021-02-151
|
* Add (self-signed) ISRG Roots to the CA bundle.Guilhem Moulin2021-02-151
| | | | | | | | | | | | | | | This allows us to fully validate provided X.509 chains using that self-contained bundle, regardless of which CAs is marqued as trusted under /etc/ssl/certs. Also, remove cross-signed intermediate CAs from the bundle as they're useless in a self-contained bundle. Also, remove decomissioned intermediate CAs Authority X3 and X4 from the bundle. This change bumps the minimum OpenSSL version to 1.1.0 (for verify(1ssl)'s ‘-trusted’ and ‘-show_chain’ options).
* challenge-directory now needs to be set to an *existing* directory.Guilhem Moulin2021-02-141
| | | | | | | Since lacme(8) spawns a builtin webserver by default the change doesn't affect default configurations. See https://bugs.debian.org/970800 for the rationale.
* lacme: allow direct use challenge-directory .well-known/acme-challengeBenjamin Tietz2021-02-141
|
* lacme: new flag `--force`.Guilhem Moulin2020-12-091
| | | | | Which aliases to `--min-days=-1`, i.e., forces renewal regardless of the expiration date of existing certificates.
* Make unprivileged user/group for the internal client resp. webserver ↵Guilhem Moulin2020-12-091
| | | | configurable.
* lacme: delay webserver socket shutdown.Guilhem Moulin2020-12-091
| | | | | | | | | | | To after the process has terminated. This solves a race condition spewing accept: Invalid argument at /usr/libexec/lacme/webserver line 80. (harmless) errors. Closes: deb#970458
* Use upstream certicate chain instead of an hardcoded one.upstream/0.7Guilhem Moulin2020-11-261
| | | | | | | | | | | | | This is a breaking change. The certificate indicated by 'CAfile' is no longer used as is in 'certificate-chain' (along with the leaf cert). The chain returned by the ACME v2 endpoint is used instead. This allows for more flexbility with respect to key/CA rotation, cf. https://letsencrypt.org/2020/11/06/own-two-feet.html and https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which is a concatenation of all known active CA certificates (which includes the previous default).
* Upgrade links to secure HTTP.Guilhem Moulin2020-08-041
|
* Ignore [accountd] section from lacme.conf when the --socket option is defined.Guilhem Moulin2020-08-041
| | | | | This allows remotely-controlled lacme processes being controlled without modifying an config files. See https://bugs.debian.org/955767 .
* Makefile: Use variables for target directories etc.Guilhem Moulin2020-08-041
|
* Change default libexec dir from /usr/lib/lacme to /usr/libexec/lacme.Guilhem Moulin2020-08-031
|
* Use /run for the listening socket of the webserver component.Guilhem Moulin2019-08-221
|
* lacme: new option 'account --deactivate'Guilhem Moulin2019-08-211
| | | | For client-initiated account deactivation. See RFC 8555 sec. 7.3.6.
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-01 21:20:55 +0000