Comments (12)
Sure. The plan for the manager is to support TLS-SNI challenges. It will do so using lower lever client API which is essentially done: https://go-review.googlesource.com/25450.
Once 25450 is submitted, we can go back to the manager, adjust its API and start implementing it. It shouldn't be too long once we figure out the best set of the manager API to expose.
from acme.
I'll try and cook up a PR tomorrow.
from acme.
@nhooyr sounds good.
You may also find #34 very useful.
from acme.
@crhym3 Before I submit a PR, I have a question about the API. In #34 you did not like how there was merely a comment above Key crypto.Signer
that said Key.Pub()
has to be an RSA key. I was planning on something similar to that PR.
In fact he finished it in his fork here
Here is the resulting diff:
diff --git a/acme.go b/acme.go
index 5f16a38..4836410 100644
--- a/acme.go
+++ b/acme.go
@@ -17,7 +17,7 @@ package acme
import (
"bytes"
- "crypto/rsa"
+ "crypto"
"crypto/x509"
"encoding/base64"
"encoding/json"
@@ -116,7 +116,8 @@ type AuthzID struct {
// Client implements ACME spec.
type Client struct {
http.Client
- Key *rsa.PrivateKey
+ // Key.Public() must be *rsa.PublicKey or *ecdsa.PublicKey
+ Key crypto.Signer
}
// CertSource creates new CertSource using client c.
@@ -268,6 +269,11 @@ func (c *Client) GetChallenge(url string) (*Challenge, error) {
//
// The server will then perform the validation asynchronously.
func (c *Client) Accept(chal *Challenge) (*Challenge, error) {
+ auth, err := keyAuth(c.Key.Public(), chal.Token)
+ if err != nil {
+ return nil, err
+ }
+
req := struct {
Resource string `json:"resource"`
Type string `json:"type"`
@@ -275,7 +281,7 @@ func (c *Client) Accept(chal *Challenge) (*Challenge, error) {
}{
Resource: "challenge",
Type: chal.Type,
- Auth: keyAuth(&c.Key.PublicKey, chal.Token),
+ Auth: auth,
}
res, err := c.PostJWS(chal.URI, req)
if err != nil {
@@ -322,7 +328,11 @@ func (c *Client) HTTP01Handler(token string) http.Handler {
return
}
w.Header().Set("content-type", "text/plain")
- w.Write([]byte(keyAuth(&c.Key.PublicKey, token)))
+ auth, err := keyAuth(c.Key.Public(), token)
+ if err != nil {
+ panic(err)
+ }
+ w.Write([]byte(auth))
})
}
@@ -494,6 +504,10 @@ func retryAfter(v string) time.Duration {
}
// keyAuth generates a key authorization string for a given token.
-func keyAuth(pub *rsa.PublicKey, token string) string {
- return fmt.Sprintf("%s.%s", token, JWKThumbprint(pub))
+func keyAuth(pub crypto.PublicKey, token string) (string, error) {
+ thumb, err := JWKThumbprint(pub)
+ if err != nil {
+ return "", err
+ }
+ return fmt.Sprintf("%s.%s", token, thumb), nil
}
diff --git a/cmd/acme/cert.go b/cmd/acme/cert.go
index 15a6d7a..69507e3 100644
--- a/cmd/acme/cert.go
+++ b/cmd/acme/cert.go
@@ -166,7 +166,11 @@ func authz(client *acme.Client, zurl, domain string) error {
if certManual {
// manual challenge response
- tok := fmt.Sprintf("%s.%s", chal.Token, acme.JWKThumbprint(&client.Key.PublicKey))
+ thumb, err := acme.JWKThumbprint(client.Key.Public())
+ if err != nil {
+ return err
+ }
+ tok := fmt.Sprintf("%s.%s", chal.Token, thumb)
file, err := challengeFile(domain, tok)
if err != nil {
return err
diff --git a/errors.go b/errors.go
index 1087bd6..85fc229 100644
--- a/errors.go
+++ b/errors.go
@@ -16,6 +16,7 @@ import (
"fmt"
"io/ioutil"
"net/http"
+ "reflect"
"time"
)
@@ -72,3 +73,11 @@ type RetryError time.Duration
func (re RetryError) Error() string {
return fmt.Sprintf("retry after %s", re)
}
+
+type UnsupportedKeyError struct {
+ Type reflect.Type
+}
+
+func (e *UnsupportedKeyError) Error() string {
+ return fmt.Sprintf("acme: unsupported key type: %s", e.Type)
+}
diff --git a/jws.go b/jws.go
index 9aa869a..7540a27 100644
--- a/jws.go
+++ b/jws.go
@@ -13,6 +13,7 @@ package acme
import (
"crypto"
+ "crypto/ecdsa"
"crypto/rand"
"crypto/rsa"
"crypto/sha256"
@@ -20,13 +21,17 @@ import (
"encoding/json"
"fmt"
"math/big"
+ "reflect"
)
// jwsEncodeJSON signs claimset using provided key and a nonce.
// The result is serialized in JSON format.
// See https://tools.ietf.org/html/rfc7515#section-7.
-func jwsEncodeJSON(claimset interface{}, key *rsa.PrivateKey, nonce string) ([]byte, error) {
- jwk := jwkEncode(&key.PublicKey)
+func jwsEncodeJSON(claimset interface{}, key crypto.Signer, nonce string) ([]byte, error) {
+ jwk, err := jwkEncode(key.Public())
+ if err != nil {
+ return nil, err
+ }
phead := fmt.Sprintf(`{"alg":"RS256","jwk":%s,"nonce":%q}`, jwk, nonce)
phead = base64.RawURLEncoding.EncodeToString([]byte(phead))
cs, err := json.Marshal(claimset)
@@ -36,7 +41,7 @@ func jwsEncodeJSON(claimset interface{}, key *rsa.PrivateKey, nonce string) ([]b
payload := base64.RawURLEncoding.EncodeToString(cs)
h := sha256.New()
h.Write([]byte(phead + "." + payload))
- sig, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, h.Sum(nil))
+ sig, err := key.Sign(rand.Reader, h.Sum(nil), crypto.SHA256)
if err != nil {
return nil, err
}
@@ -52,24 +57,48 @@ func jwsEncodeJSON(claimset interface{}, key *rsa.PrivateKey, nonce string) ([]b
return json.Marshal(&enc)
}
-// jwkEncode encodes public part of an RSA key into a JWK.
+// jwkEncode encodes public part of an RSA or ECDSA key into a JWK.
// The result is also suitable for creating a JWK thumbprint.
-func jwkEncode(pub *rsa.PublicKey) string {
- n := pub.N
- e := big.NewInt(int64(pub.E))
- // fields order is important
- // see https://tools.ietf.org/html/rfc7638#section-3.3 for details
- return fmt.Sprintf(`{"e":"%s","kty":"RSA","n":"%s"}`,
- base64.RawURLEncoding.EncodeToString(e.Bytes()),
- base64.RawURLEncoding.EncodeToString(n.Bytes()),
- )
+func jwkEncode(pub crypto.PublicKey) (string, error) {
+ switch pub := pub.(type) {
+ default:
+ return "", &UnsupportedKeyError{Type: reflect.TypeOf(pub)}
+ case *rsa.PublicKey:
+ n := pub.N
+ e := big.NewInt(int64(pub.E))
+ // fields order is important
+ // see https://tools.ietf.org/html/rfc7638#section-3.3 for details
+ return fmt.Sprintf(`{"e":"%s","kty":"RSA","n":"%s"}`,
+ base64.RawURLEncoding.EncodeToString(e.Bytes()),
+ base64.RawURLEncoding.EncodeToString(n.Bytes()),
+ ), nil
+ case *ecdsa.PublicKey:
+ p := pub.Curve.Params()
+ n := p.BitSize / 8
+ x := pub.X.Bytes()
+ if len(x) > n {
+ x = x[:n]
+ }
+ y := pub.Y.Bytes()
+ if len(y) > n {
+ y = y[:n]
+ }
+ return fmt.Sprintf(`{"crv":"%s","kty":"EC","x":"%s","y":"%s"}`,
+ p.Name,
+ base64.RawURLEncoding.EncodeToString(x),
+ base64.RawURLEncoding.EncodeToString(y),
+ ), nil
+ }
}
// JWKThumbprint creates a JWK thumbprint out of pub
// as specified in https://tools.ietf.org/html/rfc7638.
-func JWKThumbprint(pub *rsa.PublicKey) string {
- jwk := jwkEncode(pub)
+func JWKThumbprint(pub crypto.PublicKey) (string, error) {
+ jwk, err := jwkEncode(pub)
+ if err != nil {
+ return "", err
+ }
h := sha256.New()
h.Write([]byte(jwk))
- return base64.RawURLEncoding.EncodeToString(h.Sum(nil))
+ return base64.RawURLEncoding.EncodeToString(h.Sum(nil)), nil
}
diff --git a/jws_test.go b/jws_test.go
index 7aa6264..9d03837 100644
--- a/jws_test.go
+++ b/jws_test.go
@@ -139,7 +139,10 @@ func TestJWKThumbprint(t *testing.T) {
e := new(big.Int).SetBytes(bytes)
pub := &rsa.PublicKey{N: n, E: int(e.Uint64())}
- th := JWKThumbprint(pub)
+ th, err := JWKThumbprint(pub)
+ if err != nil {
+ t.Error(err)
+ }
if th != expected {
t.Errorf("th = %q; want %q", th, expected)
}
So if that is not how you want it done, how should I go about implementing this? Do you have any specific ideas in mind?
from acme.
Hey @nhooyr, sorry went off for a long weekend. When I commented on #34, he was just doing conversion without time checking, something like:
var key crypto.Signer
x := key.(*rsa.PrivateKey)
x.PublicKey()
which would obviously panic, not a good approach in this case. But the diff you show here is much better now: I can see the type checking and errors when an unsupported key is provided, which is what I was suggesting in #34.
from acme.
Alright, I understand. I'll prepare a PR with something similar to the above diff.
from acme.
@crhym3 crypto/acme/internal/acme
and this repository seem to differ. I think crypto/acme/internal/acme
is newer so I'm gonna create the PR there.
from acme.
yes, please, do it in crypto. I still need to sync this one with crypto/acme. will do it soon as I need to make sure cmd/acme works with the recent updates - that is the main reason I haven't done it yet.
from acme.
Submitted. Once you sync this with crypto/acme
, we should add ECDSA support into the acme command.
I can help with that as well.
from acme.
Sounds good. For reference to others, the CL in question is here: https://go-review.googlesource.com/25462.
from acme.
By the way, is there anything I can do to help with implementing the manager? https://go-review.googlesource.com/#/c/23970/
I need this sort of functionality in a program I am writing but I do not want to write everything myself and then switch to the standard library later.
from acme.
Fixed by golang/crypto@e0d166c
from acme.
Related Issues (20)
- Add support for wildcard certificates/ multiple CN names HOT 2
- Error when trying to reg HOT 3
- Remove acme package files and move cmd/acme to the top HOT 1
- Reverse proxy
- allow to listen on Unix socket
- allow to explicitly name host and cert files
- Provide the option to auto-generate the certificate's private key using RSA instead of ECDSA
- dns challenge feature with support for external dns tools like the dehydrated project
- Account.key path is not created when using acme reg -gen HOT 1
- Usability: reg fails when you take your time to read the license first... HOT 2
- Usability: default for -d when already registered ? HOT 2
- Reg fails if the config dir isn't created HOT 2
- example.com: acme: identifier authorization failed and 409 urn:acme:error:malformed: Registration key is already in use
- fail with staging, but not with prod? HOT 2
- golang ListenAndServeTLS
- Add support for wildcard certificates - ACME v2
- How can acme be configured to use a different CA (other than LetsEncrypt) ??
- identifier authorization failed
- ACMEv1 sunset at Let's Encrypt breaks `acme`
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from acme.