From 601398e92f99a159fcb5ffc0764950ae5c60d096 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Sun, 16 Jun 2024 00:35:57 +0200 Subject: Typofix Pointed by Jonathan Wiltshire at https://bugs.debian.org/1073174#12 . Thanks! --- Changelog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Changelog b/Changelog index 5c91365..df987c6 100644 --- a/Changelog +++ b/Changelog @@ -1,10 +1,10 @@ lacme (0.8.3) upstream; - + Fix post-issuance validation logic. We avoid pining the + + Fix post-issuance validation logic. We avoid pinning the intermediate certificates in the bundle and instead validate the leaf certificate with intermediates supplied during issuance as untrusted (used for chain building only). Only the root - certificates are used as trust anchor. Not pining intermediate + certificates are used as trust anchor. Not pinning intermediate certificates is in line with Let's Encrypt's latest recommendations. + Pass `-in /dev/stdin` option to openssl(1) to avoid warning with OpenSSL 3.2 or later. -- cgit v1.2.3 From 2bbabd3515cf709bed612ba50b3f50089ad099aa Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 1 Jan 2025 12:19:06 +0100 Subject: Fix 'drop-privileges' test. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Apparently `readlink -e …/fd/2` doesn't work anymore so we don't check existence anymore extistence of the last component, and instead merely check that the output is not empty. --- tests/drop-privileges | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/tests/drop-privileges b/tests/drop-privileges index 8deb8f1..3589ee3 100644 --- a/tests/drop-privileges +++ b/tests/drop-privileges @@ -81,7 +81,8 @@ check_accountd() { USER=lacme-account EOF - stderr="$(readlink -e "/proc/$$/fd/2")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stderr" || return -1 socket_ino="$(sed -rn '/^0 .* socket:\[([0-9]+)\]$/ {s//\1/p;q}' "$prefix/fd")" [ -n "$socket_ino" ] || return 1 grep -Fxq "0 0700 $UID:$GID socket:[$socket_ino]" "$prefix/fd" || return 1 @@ -106,8 +107,10 @@ check_client() { USER=_lacme-client EOF - stdout="$(readlink -e "/proc/$$/fd/1")" - stderr="$(readlink -e "/proc/$$/fd/2")" + stdout="$(readlink -f "/proc/$$/fd/1")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stdout" || return -1 + test -n "$stderr" || return -1 if [ "$command" = "account" ]; then # no pipe grep -Fxq "0 0500 $UID:$GID /dev/null" "$prefix/fd" || return 1 grep -Fxq "1 0700 $UID:$GID $stdout" "$prefix/fd" || return 1 @@ -143,8 +146,10 @@ check_webserver() { USER=_lacme-www EOF - stdout="$(readlink -e "/proc/$$/fd/1")" - stderr="$(readlink -e "/proc/$$/fd/2")" + stdout="$(readlink -f "/proc/$$/fd/1")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stdout" || return -1 + test -n "$stderr" || return -1 grep -Fxq "0 0500 $UID:$GID /dev/null" "$prefix/fd" || return 1 grep -Fxq "1 0700 $UID:$GID $stdout" "$prefix/fd" || return 1 grep -Fxq "2 0700 $UID:$GID $stderr" "$prefix/fd" || return 1 -- cgit v1.2.3 From 207f0cd7a1d03f8dfe035bb6583b4f4e68ba38b6 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 14 May 2026 13:14:52 +0200 Subject: Update test suite to match staging server behavior. --- tests/accountd-kid | 4 ++-- tests/cert-extensions | 6 +++--- tests/cert-revoke | 4 ++-- tests/cert-verify | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/accountd-kid b/tests/accountd-kid index 8a4b53c..e6f5ca4 100644 --- a/tests/accountd-kid +++ b/tests/accountd-kid @@ -28,7 +28,7 @@ sleep 1 # newAccount resource fails as per RFC 8555 sec. 6.2 it requires a JWK ! lacme --socket="$SOCKET" account 2>"$STDERR" || fail grepstderr -Fxq "Warning: lacme-accountd supplied an empty JWK; try removing 'keyid' setting from lacme-accountd.conf if the ACME resource request fails." -grepstderr -Fxq "400 Bad Request (Parse error reading JWS)" +grepstderr -Fxq "400 Bad Request (Unable to validate JWS :: Parse error reading JWS)" grep -F "] SIGNED header=base64url({" ~lacme-account/.local/share/lacme/accountd.log >/tmp/signed ! grep -vF "] SIGNED header=base64url({\"alg\":\"RS256\",\"jwk\":{}," "$STDERR" || fail grepstderr -Fxq "Revoking /etc/lacme/simpletest.rsa.crt" -grepstderr -Fq "400 Bad Request (unable to revoke" +grepstderr -Eq "400 Bad Request \\(Unable to revoke :: no certificate with serial [0-9a-fA-F]+ and status other than revoked\\)" grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.rsa.crt" kill $PID diff --git a/tests/cert-extensions b/tests/cert-extensions index d7e7855..3cb0a43 100644 --- a/tests/cert-extensions +++ b/tests/cert-extensions @@ -25,7 +25,7 @@ x509_check /etc/lacme/test1.crt <<-EOF X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication + TLS Web Server Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Alternative Name: @@ -54,7 +54,7 @@ x509_check /etc/lacme/test2.crt <<-EOF X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication + TLS Web Server Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Alternative Name: @@ -79,7 +79,7 @@ x509_check /etc/lacme/test3.crt <<-EOF X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication + TLS Web Server Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Alternative Name: diff --git a/tests/cert-revoke b/tests/cert-revoke index 179ccba..ead6723 100644 --- a/tests/cert-revoke +++ b/tests/cert-revoke @@ -18,7 +18,7 @@ test /etc/lacme/simpletest.ecdsa.crt -nt /etc/lacme/simpletest.ecdsa.key lacme revokeCert /etc/lacme/simpletest.ecdsa.crt ! lacme revokeCert /etc/lacme/simpletest.ecdsa.crt 2>"$STDERR" || fail grepstderr -Fxq "Revoking /etc/lacme/simpletest.ecdsa.crt" -grepstderr -Fq "400 Bad Request (unable to revoke" +grepstderr -Fq "400 Bad Request (Unable to revoke ::" grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.ecdsa.crt" # and the RSA certificate using the service key @@ -26,7 +26,7 @@ mv -vfT /etc/lacme/simpletest.rsa.key /etc/lacme/account.key lacme revokeCert /etc/lacme/simpletest.rsa.crt ! lacme revokeCert /etc/lacme/simpletest.rsa.crt 2>"$STDERR" || fail grepstderr -Fxq "Revoking /etc/lacme/simpletest.rsa.crt" -grepstderr -Fq "400 Bad Request (unable to revoke" +grepstderr -Fq "400 Bad Request (Unable to revoke ::" grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.rsa.crt" # vim: set filetype=sh : diff --git a/tests/cert-verify b/tests/cert-verify index a6cd336..2138e29 100644 --- a/tests/cert-verify +++ b/tests/cert-verify @@ -20,7 +20,7 @@ grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from # verification error for unrelated CA bundle cat /etc/ssl/certs/ssl-cert-snakeoil.pem >/usr/share/lacme/ca-certificates.crt ! lacme newOrder 2>"$STDERR" || fail -grepstderr -Fxq "error 20 at 1 depth lookup: unable to get local issuer certificate" +grepstderr -Eq "^error 20 at [1-9][0-9]* depth lookup: unable to get local issuer certificate$" grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" # use saved bundle as custom CAfile -- cgit v1.2.3 From da63d5b6ca409b46161ceecab1b3dd3f831491df Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 14 May 2026 13:19:00 +0200 Subject: Drop OCSP must-staple extension test which is no longer available. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit “Error finalizing order :: OCSP must-staple extension is no longer available: see https://letsencrypt.org/2024/12/05/ending-ocsp” --- tests/cert-extensions | 27 --------------------------- 1 file changed, 27 deletions(-) diff --git a/tests/cert-extensions b/tests/cert-extensions index 3cb0a43..9c5b977 100644 --- a/tests/cert-extensions +++ b/tests/cert-extensions @@ -61,31 +61,4 @@ x509_check /etc/lacme/test2.crt <<-EOF DNS:$(echo "$commonName" "$subjectAltName" | tr " " "\\n" | sort -u | paste -sd" " | sed -r "s/ /, DNS:/g") EOF -# tlsfeature -openssl genpkey -algorithm RSA -out /etc/lacme/test3.key -commonName="$(head -c10 /dev/urandom | base32 -w0 | tr "A-Z" "a-z").$DOMAINNAME" -cat >"/etc/lacme/lacme-certs.conf.d/test3.conf" <<- EOF - [test3] - certificate-key = /etc/lacme/test3.key - certificate-chain = /etc/lacme/test3.crt - subject = /CN=$commonName - tlsfeature = status_request -EOF - -lacme newOrder test3 -test /etc/lacme/test3.crt -nt /etc/lacme/test3.key -x509_check /etc/lacme/test3.crt <<-EOF - subject=/CN=$commonName - X509v3 Key Usage: critical - Digital Signature, Key Encipherment - X509v3 Extended Key Usage: - TLS Web Server Authentication - X509v3 Basic Constraints: critical - CA:FALSE - X509v3 Subject Alternative Name: - DNS:$commonName - TLS Feature: - status_request -EOF - # vim: set filetype=sh : -- cgit v1.2.3 From fc52c4f391dd6cae1f20ebfc9aefd9f6bc78cfd8 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Mon, 20 Jul 2026 19:05:50 +0200 Subject: accountd: Use PKCS#1 v1.5 signatures. It's what JWT RS256 uses. Nedded for compatibility with Crypt::OpenSSL 0.38 and later. --- lacme-accountd | 1 + tests/old-accountd | 3 +++ 2 files changed, 4 insertions(+) diff --git a/lacme-accountd b/lacme-accountd index 5bc8b5f..a0cc15f 100755 --- a/lacme-accountd +++ b/lacme-accountd @@ -174,6 +174,7 @@ if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) { error("$filename: Not a private key") unless $rsa->is_private(); error("$filename: Invalid key") unless $rsa->check_key(); $rsa->use_sha256_hash(); + $rsa->use_pkcs1_padding(); # JWT RS256 uses PKCS#1 v1.5 signatures require 'Crypt/OpenSSL/Bignum.pm'; my ($n, $e) = $rsa->get_key_parameters(); # don't include private params! diff --git a/tests/old-accountd b/tests/old-accountd index 3ad4b31..daa1996 100644 --- a/tests/old-accountd +++ b/tests/old-accountd @@ -19,6 +19,9 @@ DEBIAN_FRONTEND="noninteractive" apt install -y --no-install-recommends \ -oDPkg::Options::="--force-confdef" -oDPkg::Options::="--force-overwrite" \ lacme-accountd/stretch +# somewhat cheating, but needed for an older accountd using a newer Crypt::OpenSSL::RSA +sed -ri 's/^\s*\$rsa->use_sha256_hash\(\);$/& $rsa->use_pkcs1_padding();/' /usr/bin/lacme-accountd + SOCKET=~lacme-account/S.lacme runuser -u lacme-account -- lacme-accountd --socket="$SOCKET" & PID=$! sleep 1 -- cgit v1.2.3 From cc2ff5e80a465b0325e317aeedb3437165fa2e1b Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Mon, 20 Jul 2026 19:52:28 +0200 Subject: Prepare new release v0.8.4. --- Changelog | 12 ++++++++++++ client | 2 +- lacme | 2 +- lacme-accountd | 2 +- 4 files changed, 15 insertions(+), 3 deletions(-) diff --git a/Changelog b/Changelog index df987c6..358c53a 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,15 @@ +lacme (0.8.4) upstream; + + + accountd: Use PKCS#1 v1.5 signatures, as it's what JWT RS256 uses. + This change is needed for compatibility with Crypt::OpenSSL::RSA 0.38 + and later. + + Fix 'drop-privileges' test. + + Update test suite to match staging server behavior. + + Drop OCSP must-staple extension test which is no longer available on + Let's Encrypt's ACME server. + + -- Guilhem Moulin Mon, 20 Jul 2026 19:52:28 +0200 + lacme (0.8.3) upstream; + Fix post-issuance validation logic. We avoid pinning the diff --git a/client b/client index 2a5ee3c..be9a7f5 100755 --- a/client +++ b/client @@ -43,7 +43,7 @@ use warnings; # instance own by another user and created with umask 0177) is not a # problem since SOCKET_FD can be bound as root prior to the execve(2). -our $VERSION = '0.8.3'; +our $VERSION = '0.8.4'; my $PROTOCOL_VERSION = 1; my $NAME = 'lacme-client'; diff --git a/lacme b/lacme index 37d3a51..c72628c 100755 --- a/lacme +++ b/lacme @@ -22,7 +22,7 @@ use v5.14.2; use strict; use warnings; -our $VERSION = '0.8.3'; +our $VERSION = '0.8.4'; my $NAME = 'lacme'; use Errno 'EINTR'; diff --git a/lacme-accountd b/lacme-accountd index a0cc15f..05fa227 100755 --- a/lacme-accountd +++ b/lacme-accountd @@ -23,7 +23,7 @@ use v5.14.2; use strict; use warnings; -our $VERSION = '0.8.3'; +our $VERSION = '0.8.4'; my $PROTOCOL_VERSION = 1; my $NAME = 'lacme-accountd'; -- cgit v1.2.3