aboutsummaryrefslogtreecommitdiff
path: root/acme
AgeCommit message (Collapse)Author
2026-03-10ssh,acme: clean up tautological/impossible nil conditionsNeal Patel
Change-Id: I4c6b4b6d8dc1e8a9d2ebfb8d350b7617d3cf7949 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/739780 Auto-Submit: Neal Patel <nealpatel@google.com> Reviewed-by: David Chase <drchase@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com>
2026-02-13acme: only require prompt if server has terms of serviceSean Liao
Fixes golang/go#64881 Change-Id: I2b4415e6f987aab258c26c090ac7b1a465aa1697 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/719001 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2025-11-17acme/autocert: let automatic renewal work with short lifetime certsSean Liao
Fixes golang/go#64997 Fixes golang/go#36548 Change-Id: Idb7a426ad3bfa6ac3b796f4b466da6e3154f1ffa Reviewed-on: https://go-review.googlesource.com/c/crypto/+/719080 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Mark Freeman <markfreeman@google.com> Reviewed-by: Daniel McCarney <daniel@binaryparadox.net> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-12acme: pass context to requestSean Liao
Fixes golang/go#30183 Change-Id: Ic02b34bc87b9465f5c05b2ef5bec157c58809a91 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/719002 Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-27all: fix some commentscuishuang
Change-Id: I0395c5db6edd7d90f9ec1dadbe881a77c906c732 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/713120 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2025-10-08all: fix some typos in commentcuishuang
Change-Id: Ia209f0a6d9b19d14e655c65d1287a1416b48c487 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/707535 Reviewed-by: Carlos Amedee <carlos@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Sean Liao <sean@liao.dev>
2025-10-08acme: fix autocert TestHTTPHandlerDefaultFallbackDaniel McCarney
The Go 1.25.2 release made net/url stricter about parsing bracketed IPv6 hostnames, and is rejecting some test URLs used in the autocert TestHTTPHandlerDefaultFallback test with an error about the colon-separated fields requiring at least one hex digit. This commit replaces the invalid `xxxx` portion of some test URLS with valid hex digits, fixing the test regression. Change-Id: I84c192b1cd6daf53ef4199f7987437fd825f7041 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/710155 Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-09-04acme: include order problem in OrderErrorDaniel McCarney
If client.WaitOrder or client.CreateOrderCert return an acme.OrderError it's helpful to include the order's problem field (if available). This will often have detailed information about why a particular order became invalid that's invaluable for debugging (e.g. a challenge response was incorrect, a name couldn't be resolved, etc). While it's possible for a consumer to poll the order themselves as part of handling the order to extract a fresh Order.Error field value, it would take an extra round-trip network request. Since we have the underlying error in-hand when we produce the OrderError we might as well include it directly. Since this field is a structured object with a number of sub-fields the OrderError.Error() function isn't updated to include the order problem error in the String description. Interested callers should instead use errors.Is to extract the problem information directly. Resolves golang/go#74430 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Change-Id: I3158f064793bbfdc292dd6b5e1a6bfd7729bd980 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/681037 Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Ian Stapleton Cordasco <graffatcolmingov@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-08-06acme: fix pebble subprocess output data raceDaniel McCarney
Wait for process completion before reading stdout/stderr buffers to eliminate race between I/O Go routines and test cleanup. Updates golang/go#74437 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest-race Change-Id: I2e650c04db5be0d7a1e858ce40e25f13ad12223c Reviewed-on: https://go-review.googlesource.com/c/crypto/+/693596 Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-08-01acme: increase pebble test waitForServer attemptsDaniel McCarney
In CI it seems that occasionally we can't connect to the test servers within 10 tries, and the test flakes. Let's give the process more attempts. Updates golang/go#74437 Change-Id: I74d6cea83468a3a572ec4b52ff7314c778c664cf Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Reviewed-on: https://go-review.googlesource.com/c/crypto/+/692075 Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Mark Freeman <mark@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-07-11acme: capture pebble test subprocess stdout/stderrDaniel McCarney
When spawning the pebble and pebble-challtestserv processes redirect stdout/stderr to bytes.Buffer instances and print their content at test end as appropriate. The stdout/stderr content for each process is printed if the test failed, or if testing is being done in verbose mode. Otherwise the output is swallowed. This makes debugging test failures much easier as output from the subprocesses from independent tests isn't intermingled. Updates golang/go#74437 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Change-Id: Ia79a3609ce3522ef6248442de247554c39367162 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/686935 Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-06-30acme: fix TLSALPN01ChallengeCert for IP address identifiersDaniel McCarney
When creating a TLS-ALPN-01 challenge response certificate for an IP address identifier we need to configure the template IPAddresses field, not the DNSNames/Subject.CommonName. Along the way we can do some small tidying: * Updating the draft TLS-ALPN-01 reference to the finalized RFC * Adding a reference to the IP address identifier ACME RFC * Adding a mention of the form the challenge validation request's SNI will take when verifying an IP address identifier * Tidying the private tlsChallengeCert() function to take a single identifier as arg since the only call-sites provide singular values since the removal of the TLS-SNI-[01|02] challenge helpers. This allows enabling an IP address identifier in the Pebble integration tests that otherwise caused a validation failure for TLS-ALPN-01 challenge types because the IP address was used as a DNS SAN. Updates golang/go#73914 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Change-Id: Ic671e41b585f424f821db65206c7ffcc6dd386a0 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/677576 Reviewed-by: Ian Stapleton Cordasco <graffatcolmingov@gmail.com> Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2025-06-30acme: add Pebble integration testingDaniel McCarney
This commit adds integration test coverage for a complete TLS-ALPN-01 and HTTP-01 based issuance flow. For each tested challenge type we: * Spin up a pebble/pebble-challtestsrv environment * Spin up a small challenge response server * Create an ACME account * Create an order for multiple DNS type identifiers * Provision challenge responses based on the challenge type under test * Wait for the order to become ready for issuance * Finalize the order, issuing a certificate * Check the newly issued certificate chain validates with the Pebble trust anchor, and that the certificate is valid for each of the names from our initial order These tests are skipped in short mode (Pebble has variable delays for validation requests). The Pebble source is fetched through the Go module proxy (unless a local directory is specified to aid development), similar to how the stdlib crypto packages fetch BoGo tooling. More test coverage for various other parts of the protocol (key rollover, account/authz deactivation, revocation, etc) can be added as follow-up work now that the groundwork for integration testing is laid. Fixes golang/go#73914 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Change-Id: I4e79f4858f31ef290a0c91d345e15fbdc510e9ab Reviewed-on: https://go-review.googlesource.com/c/crypto/+/677575 Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Ian Stapleton Cordasco <graffatcolmingov@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-05-29acme: return err from deprecated TLS-SNI-[01|02] functionsDaniel McCarney
The TLSSNI01ChallengeCert and TLSSNI02ChallengeCert functions have been marked deprecated since 2022. The package documentation indicates pre-RFC 8555 functionality is retained for compilation success, but will return errors. This commit makes these two deprecated functions match that description. No meaningful support for these draft standard challenge types exists in the ACME ecosystem, and they are insecure for use in shared hosting environments. Change-Id: I1c17980a0630092c70eb971b3453a0f115834be0 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/676835 Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2025-05-28acme: remove dead codeDaniel McCarney
The private encodePem() and unique() functions under the acme package had no call-sites and so can be removed. Change-Id: Ic617392e7cc9b9e795456626a623ba02df108694 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/676875 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2025-04-17acme: return error from pre-authorization when unsupportedIan Stapleton Cordasco
Check the directory's AuthzURL to see if the server supports pre-authorization. If it's empty, then the server is not advertising support and we can encounter other bugs. Better to return early and give a clear error to the caller. From https://www.rfc-editor.org/rfc/rfc8555#section-7.4.1 If a CA wishes to allow pre-authorization within ACME, it can offer a "new authorization" resource in its directory by adding the field "newAuthz" with a URL for the newAuthz resource. Fixes golang/go#40839 Change-Id: Id3e92e8e2ae3c57285183d37544dd59b4988b3be Reviewed-on: https://go-review.googlesource.com/c/crypto/+/661675 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2025-04-16acme/autocert: use standard functions to pick the cache directoryAlberto Bertogli
acme/autocert currently has ad-hoc logic to find a reasonable default for a cache directory. Since that logic was written (in 2017), new functions were added to the os package to provide that functionality (in Go 1.13, 2019-09): `os.UserCacheDir` and `os.UserHomeDir`. This patch replaces the ad-hoc logic with a call to `os.UserCacheDir`. The fallback to `/` is kept, since it may be relied upon in some environments. Change-Id: I3bf692ca670b87bf3d329e5d3684eee15ed374aa Reviewed-on: https://go-review.googlesource.com/c/crypto/+/440195 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Sean Liao <sean@liao.dev>
2025-04-11acme: use built-in max/min to simplify the codecuishuang
Change-Id: I6ba8d07b9e53b01f25f4c1c8eac629aaa47de3a1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/664836 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2025-03-17acme: remove unnecessary []byte conversionMateusz Poliwczak
Change-Id: Iddbe6bcb7a5487678c48df65903571b4625fc9f9 GitHub-Last-Rev: 2552a8d99c7472f029d7da270fa814398793b564 GitHub-Pull-Request: golang/crypto#243 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/456438 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Sean Liao <sean@liao.dev>
2025-02-21acme/autocert: check host policy before probing the cachev0.34.0Roland Shoemaker
Avoid unnessecary cache probes for names that don't match the host policy. Fixes golang/go#71199 Change-Id: I11e8465b0416e960a549b0c0d74a622026c39931 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/651296 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2025-02-10all: update certs for go1.24Sean Liao
Fixes golang/go#71612 Change-Id: I5cb0596b33cb18016eb1883d1518319588ae1454 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/647975 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com>
2025-01-16acme: support challenges that require the ACME client to send a non-empty ↵Evgeny Shatokhin
JSON body in a response to the challenge. A new extension to the ACME protocol is proposed to support device attestation: https://datatracker.ietf.org/doc/draft-acme-device-attest/ Based on the recent IETF meetings, the proposal is likely to be accepted. To support the new extension, the ACME client will need to send a non-empty JSON body in the response to a "device-attest-01" challenge. Fixes golang/go#68674 Change-Id: I29b420ec837f682e3d59071a4a82af56dc319134 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/608975 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org>
2025-01-02all: make function and struct comments match the namescuishuang
Change-Id: Iba9c1fc2895adca0d3455f8068b040d0ca006408 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/639575 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com>
2024-09-04all: fix printf(var) mistakes detected by latest printf checkerv0.27.0Dmitri Shuralyov
These were problematic but previously easy to miss. They're now easy to spot thanks to build failures at Go tip as of CL 610736. For golang/go#68796. Change-Id: I167f2cce2376b4070460389c673d973e4521d3dc Reviewed-on: https://go-review.googlesource.com/c/crypto/+/610797 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Alan Donovan <adonovan@google.com>
2024-06-26all: bump go.mod version and drop compatibility shimsFilippo Valsorda
Also, remove the legacy import annotations. Fixes golang/go#68147 Change-Id: Ibfcc9322f27224c0ba92ea42cd56912a7d8783fd Reviewed-on: https://go-review.googlesource.com/c/crypto/+/594256 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2023-10-11all: update go directive to 1.18Dmitri Shuralyov
Done with: go get go@1.18 go mod tidy go fix ./... Using go1.21.3. Also update avo to v0.5.0 in the curve25519/internal/field/_asm module. It's newer and produces no diff in the generated code. For golang/go#60268. Change-Id: I9bd771ee8561595d7f68aaca76df6e3e33d35013 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/534141 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-01-30all: fix some commentscui fliter
Change-Id: I11030ee466c8cac6855ce4fe2cf72e0b8d7029f8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/463796 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-12-08acme: eliminate arbitrary timeouts in testsBryan C. Mills
Fixes golang/go#57107. Change-Id: I20b1f6ca85170c6b4731d7c7ea06f4db742526cc Reviewed-on: https://go-review.googlesource.com/c/crypto/+/456123 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Bryan Mills <bcmills@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Bryan Mills <bcmills@google.com>
2022-10-12all: use automatic RFC linkingAxel Wagner
pkgsite automatically links /RFC \d+/ to the mentioned RFC. Insert a bunch of spaces into doc-comments for that to match. Change-Id: I01834d7573428563f21c37e43316442e148dd8c4 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/442055 Reviewed-by: Joedian Reid <joedian@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2022-09-26acme/autocert: remove TestRenewFromCache skipsRoland Shoemaker
Removes the skips from TestRenewFromCache and TestRenewFromCacheAlreadyRenewed, which were added due to flakes which may have been fixed by the renewal timer change. Updates golang/go#51080 Change-Id: Ib953a24e610e89dfbbea450a4c257c105055ce7e Reviewed-on: https://go-review.googlesource.com/c/crypto/+/433815 Run-TryBot: Roland Shoemaker <roland@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-09-24acme/autocert: fix renewal timer issueRoland Shoemaker
Block when creating the renewal timer, rather than doing it in a goroutine. This fixes an issue where startRenew and stopRenew are called very closely together, and due to lock ordering, stopRenew may be called before startRenew, resulting in the appearance that the renewal timer has been stopped before it has actually been created. This is only an issue in tests, as that is the only place stopRenew is actually used. In particular this issue manifests in TestGetCertiifcate sub-tests, where a httptest server reuses a port across two of the sub-tests. In this case, the renewal calls end up creating dirty state for the subsequent test, which can cause confusing behavior (such as attempting to register an account twice.) Another solution to this problem would be introducing a bool, protected by renewalMu, which indicates if renewal has been halted, and to check it in startRenew to check if stopRenew has already been called, which would allow us to continue calling startRenew in a goroutine and relying on renewalMu locking for ordering. That said I don't see a particularly strong reason to call startRenew concurrently, so this seems like the simplest solution for now. Fixes golang/go#52494 Change-Id: I95420d3fd877572a0b9e408d2f8cd353f6a4e80e Reviewed-on: https://go-review.googlesource.com/c/crypto/+/433016 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-09-19all: replace io/ioutil with io and os packagecui fliter
For golang/go#45557 Change-Id: I447530cc66896aef7a8d528ccb8d095b80e3cf47 GitHub-Last-Rev: 5f385ff46487ac318bd1147cdbbd26bb0ffd0426 GitHub-Pull-Request: golang/crypto#230 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/430797 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Meng Zhuo <mzh@golangcn.org> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-08-17acme: gofmt code with Go 1.19 gofmtRuss Cox
Change-Id: Ib0fd6fcfa358df2bdb820a512b73e7cdb34120f8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/424174 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Russ Cox <rsc@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-05-25acme/autocert: properly clean DirCache pathsRoland Shoemaker
Don't assume the path passed into the DirCache methods is absolute, and clean it before further operating on it. Put and Delete are not attacker controlled, but clean them anyway. Fixes #53082 Fixes CVE-2022-30636 Change-Id: I755f525a737da60ccba07ebce4d41cc8faebfcca Reviewed-on: https://go-review.googlesource.com/c/crypto/+/408694 Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-05-18acme: DeactivateReg fix panicJason Baker
Currently discover is not called which results in a panic if just a key is added to an ACME client and then deactivation is attempted. This patch adds a discover call as well as missing unit tests for the API. Change-Id: I0719e5376eb2fccf62182e5f91e5b5eaa7bdd518 GitHub-Last-Rev: 501d7c6c1b75a3069dcad4254b4d4a0d2ccb02c8 GitHub-Pull-Request: golang/crypto#217 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/406734 TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2022-05-16acme: add AccountKeyRolloverJason Baker
Add support for AccountKeyRollover. API only returns an error since acme.Error will contain appropriate KID lookup information. Due to the requirements of double JWS encoding jwsEncodeJSON is also modified to support a missing Nonce header and raw string embedding in the payload. Fixes golang/go#42516 Change-Id: I959660a1a39b2c469b959accd48fda519daf4eb3 GitHub-Last-Rev: 8e8cc5b094743262939c145f56d3a3b57a057d64 GitHub-Pull-Request: golang/crypto#215 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/400274 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Heschi Kreinick <heschi@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org>
2022-05-11acme/autocert/internal/acmetest: don't validate in goroutineRoland Shoemaker
In the test server, rather than spawning a goroutine to validate challenges, block on the validation before responding to the client. This prevents a test race, where testing.T.Logf is called after the test is completed. While this has a slight behavioral difference to some production ACME server implementations (although is behavior allowed in the spec), the change has little material impact on what we are testing, since previously the validation would happen so quickly that it would be indistinguishable from the new blocking behavior (i.e. we would not be sending multiple requests during polling previously.) Fixes golang/go#52170 Change-Id: I75e3b2da69ddc2302be25a99f1b1151ed0f4af9b Reviewed-on: https://go-review.googlesource.com/c/crypto/+/405548 Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-04-11all: gofmtRuss Cox
Gofmt to update doc comments to the new formatting. For golang/go#51082. Change-Id: I076031b6613691eefbb0f21739366e3fd2011ec9 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/399356 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Russ Cox <rsc@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-04-08acme/autocert: support External Account Binding (EAB) tokensBen Burkert
Support External Account Binding (EAB) tokens to the Manager as defined in RFC 8555, Section 7.3.4. If the ExternalAccountBinding field is set on Manager, pass it into the acme Account during registration. Fixes golang/go#48809 Change-Id: I64c38b05ab577acbde9f526638cc8104d15ff055 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/354189 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Trust: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-02-14acme/autocert: skip renewal tests broken on windows/arm64Bryan C. Mills
For golang/go#51080 Change-Id: Icf4414ab58bdea44b793a66770b4c05f9faf5387 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/385675 Trust: Bryan Mills <bcmills@google.com> Run-TryBot: Bryan Mills <bcmills@google.com> Reviewed-by: Jeremy Faller <jeremy@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-02-10acme/autocert: fix races in renewal testsBryan C. Mills
TestRenewFromCache and TestRenewFromCacheAlreadyRenewed had several races and API misuses: 1. They called t.Fatalf from a goroutine other than the one invoking the Test function, which is explicitly disallowed (see https://pkg.go.dev/testing#T). 2. The test did not stop the renewal timers prior to restoring test-hook functions, and the process of stopping the renewal timers itself did not wait for in-flight calls to complete. That could cause data races if one of the renewals failed and triggered a retry with a short-enough randomized backoff. (One such race was observed in https://build.golang.org/log/1a19e22ad826bedeb5a939c6130f368f9979208a.) 3. The testDidRenewLoop hooks accessed the Manager.renewal field without locking the Mutex guarding that field. 4. TestGetCertificate_failedAttempt set a testDidRemoveState hook, but didn't wait for the timers referring to that hook to complete before restoring it, causing races with other timers. I tried pulling on that thread a bit, but couldn't untangle the numerous untracked goroutines in the package. Instead, I have made a smaller and more local change to copy the value of testDidRemoveState into a local variable in the timer's closure. Given the number of untracked goroutines in this package, it is likely that races and/or deadlocks remain. Notably, so far I have been unable to spot the actual cause of golang/go#51080. For golang/go#51080 Change-Id: I7797f6ac34ef3c272f16ca805251dac3aa7f0009 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/384594 Trust: Bryan Mills <bcmills@google.com> Run-TryBot: Bryan Mills <bcmills@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-02-09acme/autocert: include email in exampleJacob Hoffman-Andrews
At Let's Encrypt, we've found that most autocert users do not provide an email address, which makes it hard to get in touch when things go wrong with their client. Demonstrating how to provide an email will probably encourage more people to provide one. Change-Id: I0aa1ecea7cfbe55ae155804194fb57a8e695c658 GitHub-Last-Rev: 902b5fe2682a6be5af91e886272fd680fd67a94e GitHub-Pull-Request: golang/crypto#186 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/323313 Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> Trust: Katie Hockman <katie@golang.org>
2022-02-09acme, sha3, ssh: fix the typosHowJmay
Change-Id: I2287ab3492c105791b03f40d45b5dff5a56aa32a GitHub-Last-Rev: 02cdf82d8b1604fc47b656172b102a48a70e6f05 GitHub-Pull-Request: golang/crypto#183 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/319269 Trust: Alberto Donizetti <alb.donizetti@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2022-02-09acme: remove support for pre-RFC 8555 ACME specBen Burkert
LetsEncrypt removed it anyway. No API changes. Just a lot of deleted code. Fixes golang/go#46654 Co-authored-by: Brad Fitzpatrick <bradfitz@golang.org> Change-Id: I65cd0d33236033682b767403ad92aa572bee4fdd Reviewed-on: https://go-review.googlesource.com/c/crypto/+/380314 Trust: Filippo Valsorda <filippo@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Trust: Brad Fitzpatrick <bradfitz@golang.org>
2022-01-31acme: expose Client KID fieldRoland Shoemaker
Expose the previously private KID field of the Client type. This allows callers which have locally cached their key identity to avoid needing to make a call to the ACME service every time they construct a new client. Fixes golang/go#46303 Change-Id: I219167c5b941f56a2028c4bc253ff56386845549 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/354697 Trust: Katie Hockman <katie@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-01-28acme/autocert: replace all ACME server stubs with acmetestFilippo Valsorda
Change-Id: Ie5520f33674471b4a018feb9d0efaf6696ea38a2 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/381715 Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Trust: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-01-26acme/autocert: renew Let's Encrypt certificates likely to get revokedFilippo Valsorda
Let's Encrypt is revoking all certificates verified with TLS-ALPN-01 beofre January 26th due to a compliance issue. Detect them and force a renewal. Also, fix the tests which were not testing if expired certificates were renewed anymore, as the test certificates were always invalid due to not having SANs. Change-Id: If9d0632b2edfe0b7fb70f6cfd7e65e46e2d047dc Reviewed-on: https://go-review.googlesource.com/c/crypto/+/381114 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-01-12acme: in TestFetchCertCancel, do not reply before the cancellation propagatesBryan C. Mills
Fixes golang/go#44611 Change-Id: I81b3c3b7be25fe4e492695fa5935e70aa7b96c07 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/378074 Trust: Bryan Mills <bcmills@google.com> Run-TryBot: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2021-11-17all: upgrade x/net to latestDamien Neil
Update acme/autocert test to not depend on whether idna.Lookup uses transitional processing (Go 1.17 and earlier) or nontransitional processing (Go 1.18 and later). Change-Id: I29ca0aaca0ac75a932919a4c7cf8e9fca033b497 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/364014 Trust: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-09-21acme: implement Client.ListCertAlternatesJames Hartig
Let's Encrypt is defaulting to a longer cross-signed chain on May 4th, 2021 but will offer the ability to download the shorter chain via an alternate URL via a link header [1]. The shorter chain can be selected to workaround a validation bug in legacy versions of OpenSSL, GnuTLS, and LibreSSL. The alternate relation is described in section 7.4.2 of RFC 8555. ListCertAlternates should be passed the original certificate chain URL and will return a list of alternate chain URLs that can be passed to FetchCert to download. Fixes golang/go#42437 [1] https://community.letsencrypt.org/t/production-chain-changes/150739 Change-Id: Iaa32e49cb1322ac79ac1a5b4b7980d5401f4b86e Reviewed-on: https://go-review.googlesource.com/c/crypto/+/277294 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Go Bot <gobot@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 06:28:00 +0000