Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto/acme/autocert: NewOrder request did not include a SAN short enough to fit in CN #53194

Open
anacrolix opened this issue Jun 2, 2022 · 2 comments
Open

x/crypto/acme/autocert: NewOrder request did not include a SAN short enough to fit in CN #53194

anacrolix opened this issue Jun 2, 2022 · 2 comments
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Unreleased

Comments

@anacrolix
Copy link
Contributor

Using golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e, autocert.Manager requesting a domain with a length of 68 (including 5 . if that's relevant) gives an error that I think originates from Let's encrypt: 400 urn:ietf:params:acme:error:rejectedIdentifier: NewOrder request did not include a SAN short enough to fit in CN.

It might be possible to work around by allowing a shorter domain name to be provided, or somehow providing an alternate value to Let's Encrypt for the CN. I found https://community.letsencrypt.org/t/a-certificate-for-a-63-character-domain/78870 and letsencrypt/boulder#2093 that discuss this.

I experimented with passing in a shorter domain name that was also pointing to the same server, but the autocert code appears set on handling a single domain at a time and I wasn't able to change the final error.
@gopherbot gopherbot added this to the Unreleased milestone Jun 2, 2022
@anacrolix
Copy link
Contributor Author

Here's a simple workaround I've implemented: https://github.com/golang/crypto/compare/master...anacrolix:shortsan?expand=1.

@seankhliao seankhliao added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jun 3, 2022
@seankhliao
Copy link
Member

cc @bradfitz @golang/security

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
3 participants
@anacrolix @gopherbot @seankhliao