alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity
3373 commits 34 branches 199 tags 41 MiB
Commit graph

158 commits

Author SHA1 Message Date
Herman Slatman
2fbdf7d5b0
Merge branch 'master' into herman/allow-deny 2022-03-30 14:50:14 +02:00
Panagiotis Siatras
00634fb648
api/render, api/log: initial implementation of the packages (#860) 
* api/render: initial implementation of the package

* acme/api: refactored to support api/render

* authority/admin: refactored to support api/render

* ca: refactored to support api/render

* api: refactored to support api/render

* api/render: implemented Error

* api: refactored to support api/render.Error

* acme/api: refactored to support api/render.Error

* authority/admin: refactored to support api/render.Error

* ca: refactored to support api/render.Error

* ca: fixed broken tests

* api/render, api/log: moved error logging to this package

* acme: refactored Error so that it implements render.RenderableError

* authority/admin: refactored Error so that it implements render.RenderableError

* api/render: implemented RenderableError

* api/render: added test coverage for Error

* api/render: implemented statusCodeFromError

* api: refactored RootsPEM to work with render.Error

* acme, authority/admin: fixed pointer receiver name for consistency

* api/render, errs: moved StatusCoder & StackTracer to the render package
 2022-03-30 11:22:22 +03:00
Herman Slatman
b49307f326
Fix ACME order tests with mock ACME CA 2022-03-24 18:34:04 +01:00
Herman Slatman
9e0edc7b50
Add early authority policy evaluation to ACME order API 2022-03-24 14:55:40 +01:00
Herman Slatman
101ca6a2d3
Check admin subjects before changing policy 2022-03-21 15:53:59 +01:00
Herman Slatman
3ec9a7310c
Fix ACME order identifier allow/deny check 2022-03-08 14:17:59 +01:00
Herman Slatman
af53a17bb4
Merge branch 'master' into herman/allow-deny 2022-03-07 14:13:13 +01:00
Herman Slatman
b6f6bd879c
Fix PR comment and add tests for ACME prerequisites checker 2022-03-03 13:00:20 +01:00
Herman Slatman
e47dd0a666
Add ACME configuration prerequisites check 2022-02-28 16:08:00 +01:00
Herman Slatman
c3c6f3da72
Merge branch 'master' into herman/allow-deny 2022-02-22 17:36:56 +01:00
Herman Slatman
bfa2245abb
Merge branch 'master' into herman/normalize-ipv6-dns-names 2022-02-03 17:24:08 +01:00
Herman Slatman
1fe7362bee
Normalize IPv6 addresses in ACME linker 2022-02-03 13:55:15 +01:00
Herman Slatman
c1424036bf
Merge branch 'master' into herman/allow-deny 2022-01-31 14:24:34 +01:00
Herman Slatman
fd9845e9c7
Add cursor and limit to ACME EAB DB interface 2022-01-24 14:03:56 +01:00
Herman Slatman
6440870a80
Clean up, improve test cases and coverage 2022-01-18 14:39:21 +01:00
Herman Slatman
ef16febf40
Refactor ACME EAB queries 
The ACME EAB keys are now also indexed by the provisioner. This
solves part of the issue in which too many EAB keys may be in
memory at a given time.
 2022-01-07 16:59:55 +01:00
Herman Slatman
9539729bd9
Add initial implementation of x509 and SSH allow/deny policy engine 2022-01-03 12:25:24 +01:00
Herman Slatman
f9ae875f9d
Use short if-style statements 2021-12-20 14:30:01 +01:00
Herman Slatman
d799359917
Merge branch 'master' into hs/acme-eab 2021-12-09 13:58:40 +01:00
Herman Slatman
0524122191
Remove authorization flow for different Account private keys 
As discussed in https://github.com/smallstep/certificates/issues/767,
we opted for not including this authorization flow to prevent users
from getting OOMs. We can add the functionality back when the
underlying data store can provide access to a long list of
Authorizations more efficiently, for example when a callback is
implemented.
 2021-12-08 16:28:14 +01:00
Herman Slatman
2215a05c28
Add tests for ACME EAB Admin 
Refactored some of the existing bits for testing the Authority
API by creation of a new LinkedAuthority interface and changing
visibility of the MockAuthority to be usable by other packages.

At this time, not all of the functions of MockAuthority it usable
yet. Will refactor when needed or requested.
 2021-12-08 15:19:38 +01:00
Herman Slatman
9885d42711
Fix linting issues 2021-12-07 16:28:06 +01:00
Herman Slatman
6e11657204
Refactor creation of (raw) EAB JWS contents 2021-12-07 14:57:39 +01:00
Herman Slatman
23898e9b76
Improve EAB JWS validation and increase test coverage 2021-12-07 12:17:41 +01:00
Herman Slatman
d0c23973cc
Merge branch 'master' into hs/acme-eab 2021-12-06 13:01:23 +01:00
Herman Slatman
004fc054d5
Fix PR comments 2021-12-03 15:06:28 +01:00
Herman Slatman
06bb97c91e
Add logic for Account authorizations and improve tests 2021-12-02 16:25:35 +01:00
Herman Slatman
bae1d256ee
Improve tests for JWK vs. KID revoke auth flow 
The logic for both test cases is fairly similar, but with some
small differences. Made those clearer by means of some comments.
Also added some comments to the middleware logic that decided
whether to extract JWK or lookup by KID.
 2021-12-02 10:59:56 +01:00
Herman Slatman
a7fbbc4748
Add tests for GetCertificateBySerial 2021-11-28 21:20:57 +01:00
Herman Slatman
4d01cf8135
Increase test code coverage 2021-11-28 20:30:36 +01:00
Herman Slatman
2d357da99b
Add tests for ACME revocation 2021-11-26 17:27:42 +01:00
Herman Slatman
ed295ca15d
Fix linting issue 2021-11-25 00:44:21 +01:00
Herman Slatman
2d50c96d99
Merge branch 'master' into hs/acme-revocation 2021-11-19 17:00:18 +01:00
Herman Slatman
e7a988b2cd
Pin golangci-lint to v1.43.0 and fix issues 2021-11-13 01:30:03 +01:00
Herman Slatman
c7a9c13060
Add tests for extractOrLookupJWK middleware 2021-11-12 16:37:44 +01:00
Herman Slatman
3151255a25
Merge branch 'master' into hs/acme-revocation 2021-10-30 15:41:29 +02:00
Herman Slatman
dd4b4b0435
Fix remaining gocritic remarks 2021-10-11 23:34:23 +02:00
Herman Slatman
e0b495e4c8
Merge branch 'master' into hs/acme-eab 2021-10-09 01:06:49 +02:00
max furman
933b40a02a Introduce gocritic linter and address warnings 2021-10-08 14:59:57 -04:00
Herman Slatman
0afea2e957
Improve tests for already bound EAB keys 2021-10-08 13:19:35 +02:00
Herman Slatman
02cd3b6b3b
Fix PR comments 2021-09-16 23:09:24 +02:00
Herman Slatman
a98fe03e80
Merge branch 'master' into hs/acme-eab 2021-08-27 12:50:19 +02:00
Herman Slatman
1dba8698e3
Use LinkedCA.EABKey type in ACME EAB API 2021-08-27 12:39:37 +02:00
Mariano Cano
470b546d59
Merge pull request #557 from joejulian/http01-isv 
use InsecureSkipVerify for validation
 2021-08-26 18:06:57 -07:00
Herman Slatman
f31ca4f6a4
Add tests for validateExternalAccountBinding 2021-08-10 12:39:44 +02:00
Herman Slatman
492256f2d7
Add first test cases for EAB and make provisioner unique per EAB 
Before this commit, EAB keys could be used CA-wide, meaning that
an EAB credential could be used at any ACME provisioner. This
commit changes that behavior, so that EAB credentials are now
intended to be used with a specific ACME provisioner. I think
that makes sense, because from the perspective of an ACME client
the provisioner is like a distinct CA.

Besides that this commit also includes the first tests for EAB.
The logic for creating the EAB JWS as a client has been taken
from github.com/mholt/acmez. This logic may be moved or otherwise
sourced (i.e. from a vendor) as soon as the step client also
(needs to) support(s) EAB with ACME.
 2021-08-09 10:37:32 +02:00
Herman Slatman
c6bfc6eac2
Fix PR comments 2021-07-22 23:48:41 +02:00
Herman Slatman
d669f3cb14
Fix misspelling 2021-07-17 20:39:12 +02:00
Herman Slatman
540d5fbbdc
Fix marshaling -> marshalling 2021-07-17 20:35:44 +02:00
Herman Slatman
2110c7722f
Fix JWK payload key equality check 2021-07-17 20:29:12 +02:00
Herman Slatman
d44cd18b96
Add External Accounting Binding key "BoundAt" marking 2021-07-17 19:02:47 +02:00
Herman Slatman
f81d49d963
Add first working version of External Account Binding 2021-07-17 17:35:44 +02:00
Herman Slatman
258efca0fa
Improve revocation authorization 2021-07-10 00:28:31 +02:00
Herman Slatman
2b15230aa4
Add Serial to Cert ID ACME table and lookup 2021-07-09 17:51:31 +02:00
Herman Slatman
8f7e700f09
Merge branch 'master' into hs/acme-revocation 2021-07-09 11:22:25 +02:00
max furman
857a50434c Merge branch 'master' into max/cert-mgr-crud 2021-07-08 16:25:52 -07:00
max furman
9fdef64709 Admin level API for provisioner mgmt v1 2021-07-02 19:05:17 -07:00
Herman Slatman
0e56932e76
Add support for revocation using JWK 2021-07-03 01:57:27 +02:00
Herman Slatman
84e7d468f2
Improve handling of ACME revocation 2021-07-03 00:21:17 +02:00
Herman Slatman
d53bcaf830
Add base logic for ACME revoke-cert 2021-07-02 22:51:15 +02:00
Herman Slatman
64c15fde7e
Add tests for canonicalize function 2021-06-25 14:07:40 +02:00
Herman Slatman
523ae96749
Change identifier and challenge types to consts 2021-06-18 12:39:36 +02:00
Herman Slatman
84ea8bd67a
Fix PR comments 2021-06-18 12:03:46 +02:00
Herman Slatman
76dcf542d4
Fix mixed DNS and IP SANs in Order 2021-06-03 22:45:24 +02:00
Herman Slatman
a0e92f8e99
Verify IP identifier contains valid IP 2021-06-03 22:02:13 +02:00
Herman Slatman
6486e6016b
Make logic for which challenge types to use clearer 2021-05-29 00:37:22 +02:00
Herman Slatman
3e36522329
Add preliminary support for TLS-ALPN-01 challenge for IP identifiers 2021-05-29 00:19:14 +02:00
Herman Slatman
6d9710c88d
Add initial support for ACME IP validation 2021-05-28 16:40:46 +02:00
Joe Julian
0369151bfa
use InsecureSkipVerify for validation 
The server will not yet have a valid certificate so we need to disable
certificate validation in the HTTPGetter.
 2021-04-27 08:18:35 -07:00
Mariano Cano
2e1524ec2f Remove the creation on nonce on get acme directory. 
According to RFC 8555, the replay nonces are only required in POST
requests. And of course in the new-nonce request.
 2021-04-15 17:54:22 -07:00
max furman
93c3c2bf2e Error handle non existent provisioner downstream and disable debug route logging 2021-04-14 15:35:43 -07:00
max furman
497ec0c79b Fix linter issues 2021-04-14 15:14:27 -07:00
max furman
b1888fd34d Use different method for unescpaed paths for the router 2021-04-14 15:11:15 -07:00
max furman
672e3f976e Few ACME fixes ... 
- always URL escape linker output
- validateJWS should accept RSAPSS
- GetUpdateAccount -> GetOrUpdateAccount
 2021-04-12 19:06:07 -07:00
max furman
440678cb62 Add markInvalid arg to storeError for invalidating challenge 2021-03-29 22:58:26 -07:00
max furman
6b8585c702 PR review fixes / updates 2021-03-29 12:04:14 -07:00
max furman
a785131d09 Fix lint issues 2021-03-25 15:15:32 -07:00
max furman
80c8567d99 change errnotfound type for getAccount 
- more generalized NotFound type rather than the nosql
one we were using
- if the error is not recognized then the logic in create account will
break.
 2021-03-25 14:54:12 -07:00
max furman
1831920363 Finish order unit tests and remove unused mocklinker 2021-03-25 13:46:51 -07:00
max furman
b6ebc0fd25 more unit tests 2021-03-25 12:05:46 -07:00
max furman
df05340521 fixing broken unit tests 2021-03-25 12:05:46 -07:00
max furman
f72b2ff2c2 [acme db interface] nosql authz unit tests 2021-03-25 12:05:46 -07:00
max furman
074ab7b221 [acme db interface] add linker tests 2021-03-25 12:05:46 -07:00
max furman
8d2ebcfd49 [acme db interface] more unit tests 2021-03-25 12:05:46 -07:00
max furman
20b9785d20 [acme db interface] continuing unit test work 2021-03-25 12:05:46 -07:00
max furman
291fd5d45a [acme db interface] more unit tests 2021-03-25 12:05:46 -07:00
max furman
f71e27e787 [acme db interface] unit test progress 2021-03-25 12:05:46 -07:00
max furman
bb8d54e596 [acme db interface] unit tests compiling 2021-03-25 12:05:46 -07:00
max furman
f20fcae80e [acme db interface] wip unit test fixing 2021-03-25 12:05:46 -07:00
max furman
fc395f4d69 [acme db interface] compiles! 2021-03-25 12:05:46 -07:00
max furman
116869ebc5 [acme db interface] wip 2021-03-25 12:05:46 -07:00
max furman
80a6640103 [acme db interface] wip 2021-03-25 12:05:46 -07:00
max furman
1135ae04fc [acme db interface] wip 2021-03-25 12:05:46 -07:00
max furman
2ae43ef2dc [acme db interface] wip errors 2021-03-25 12:05:46 -07:00
Mariano Cano
c94a1c51be Merge branch 'master' into ssh-cert-templates 2020-08-24 15:08:28 -07:00
Mariano Cano
ba918100d0 Use go.step.sm/crypto/jose 
Replace use of github.com/smallstep/cli/crypto with the new package
go.step.sm/crypto/jose.
 2020-08-24 14:44:11 -07:00
Mariano Cano
d30a95236d Use always go.step.sm/crypto 2020-08-14 15:33:50 -07:00
max furman
55bf5a4526 Add cert logging for acme/certificate api 2020-08-12 15:50:45 -07:00
David Cowden
a26b5f322d acme/api: Brush up documentation on key-change 
Add more specific wording describing what a 501 means and add more color
explaining how official vs unofficial error types should be handled.
 2020-05-28 11:22:37 -07:00
David Cowden
b26e6e42b3 acme: Return 501 for the key-change route 
RFC 8555 § 7.3.5 is not listed as optional but we do not currently
support it. Rather than 404, return a 501 to inform clients that this
functionality is not yet implemented.

The notImplmented error type is not an official error registered in the
ietf:params:acme:error namespace, so prefix if with step:acme:error. An
ACME server is allowed to return other errors and clients should display
the message detail to users.

Fixes: https://github.com/smallstep/certificates/issues/209
 2020-05-26 01:47:08 -07:00