Commit graph

19 commits

Author SHA1 Message Date
David Cowden
c378e0043a acme: Move ordinal to application
The authority now receives the ordinal in its constructor rather than a
global variable set at package initialization time. The ordinal is
passed via the command line option `--ordinal`.
2020-05-13 19:22:07 -07:00
David Cowden
5e5a76c3b5 acme/api: Set Link and Location headers for all 200
On the challenge resource, set "Link" and "Location" headers for all
successful requests to the challenge resource.
2020-05-13 11:10:14 -07:00
David Cowden
5354906b9c acme/api: Add func name to beginning of comment 2020-05-13 10:56:19 -07:00
David Cowden
609e1312da acme/api: Write headers for invalid challenges
Include the "Link" and "Location" headers on invalid challenge
resources. An invalid challenge is still a perfectly acceptable
response.
2020-05-13 07:29:12 -07:00
David Cowden
794725bcc3 acme/api: Remove unused BackoffChallenge func
The mock has an old func that is no longer used. Remove it.
2020-05-13 04:03:47 -07:00
David Cowden
2514b58f58 acme/api: Fixup handler_test
Remove superfluous test. Add test checking for the Retry-After header if
the challenge's RetryAfter field is set.
2020-05-12 04:52:44 -07:00
David Cowden
2d0a00c4e1 acme/api: Add missing return
Stop execution when the error happens. This was previously a typo.
2020-05-11 21:22:40 -07:00
David Cowden
bdadea8a37 acme: go fmt 2020-05-07 09:27:16 -07:00
David Cowden
9af4dd3692 acme: Retry challenge validation attempts
Section 8.2 of RFC 8555 explains how retries apply to the validation
process. However, much is left up to the implementer.

Add retries every 12 seconds for 2 minutes after a client requests a
validation. The challenge status remains "processing" indefinitely until
a distinct conclusion is reached. This allows a client to continually
re-request a validation by sending a post-get to the challenge resource
until the process fails or succeeds.

Challenges in the processing state include information about why a
validation did not complete in the error field. The server also includes
a Retry-After header to help clients and servers coordinate.

Retries are inherently stateful because they're part of the public API.
When running step-ca in a highly available setup with replicas, care
must be taken to maintain a persistent identifier for each instance
"slot". In kubernetes, this implies a *stateful set*.
2020-05-06 07:39:13 -07:00
David Cowden
f56c449ea4 handler_test: Add BackoffChallenge
The mock acme authority needs to in order to conform to the updated acme
authority interface.
2020-04-30 04:44:08 -07:00
David Cowden
8fb558da10 handler_test: Remove unused field "Backoffs" 2020-04-30 04:44:08 -07:00
Wesley Graham
8d4356733e Implement standard backoff strategy 2020-04-30 04:44:08 -07:00
Wesley Graham
f9779d0bed Polish retry conditions 2020-04-30 04:44:08 -07:00
Wesley Graham
66b2c4b1a4 Add automated challenge retries, RFC 8555 2020-04-30 04:44:08 -07:00
Wesley Graham
40d7c42e33 Implement acme RFC 8555, challenge retries 2020-04-30 04:44:08 -07:00
max furman
c255274572 Should be returning status code 400 for ACME Account Not Found.
Issue #173
2020-02-01 17:35:41 -08:00
max furman
d368791606 Add x5c provisioner capabilities 2019-10-14 14:51:37 -07:00
max furman
7aec7c2612 Create ACME database tables when initializing ACME autority. 2019-10-14 14:51:03 -07:00
max furman
e3826dd1c3 Add ACME CA capabilities 2019-09-13 15:48:33 -07:00