-
Notifications
You must be signed in to change notification settings - Fork 18k
proposal: x/crypto/acme: Support profiles for Let's Encrypt and new Internet Draft #73101
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
What does support mean for |
I believe it means a few small non-intrusive and backwards compatible changes.
I could do these in increments too to make it smaller/easier to review but the following is likely necessary:
I'd want to add plenty of test coverage here as well just to make sure this doesn't interfere with existing behaviour. I do believe this will be minimally invasive. This could also be "smarter" in that if someone provides |
Let's Encrypt is already supporting Profiles in requests made to the new-order endoint and returning them in the meta field of the directory. This parses those and adds a new OrderOption to enable specifying this when constructing the new order request via AuthorizeOrder. When Profiles are not supported, this returns an error early. When the specified profile name is not in the list of specified profiles, an error is returned early. Fixes golang/go#73101 Change-Id: I6a7cdba126d8a0bfb04c6ca6cd06fad9871239d5
It wasn't much work to stub out what I was thinking of above, so I pushed it to a fork before submitting via Gerrit in case that helps https://github.com/sigmavirus24/golang-x-crypto/tree/proposal/73101 |
@seankhliao how can I help drive this discussion further? |
Given it's still a draft, I don't really see it being added anytime soon. cc @rolandshoemaker @golang/security |
Proposal Details
https://datatracker.ietf.org/doc/draft-aaron-acme-profiles/ is a relatively new Internet-Draft with the ACME working group. It's already implemented in Let's Encrypt (a.k.a., Boulder) and it's test server (a.k.a., Pebble) as documented in:
This might be a bit over-eager but as someone using
x/crypto/acme
to talk to Let's Encrypt, I'm hoping to be able to leverage this and am willing to implement the code sa well.The text was updated successfully, but these errors were encountered: