letsencrypt
/
boulder
mirror of https://github.com/letsencrypt/boulder.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
boulder/wfe2
History
Daniel McCarney 5597a77ba2
WFE2: Allow legacy Key ID prefix for ACME v2 JWS. (#3705) 
While we intended to allow legacy ACME v1 accounts created through the WFE to work with the ACME v2 implementation and the WFE2 we neglected to consider that a legacy account would have a Key ID URL that doesn't match the expected for a V2 account. This caused `wfe2/verify.go`'s `lookupJWK` to reject all POST requests authenticated by a legacy account unless the ACME client took the extra manual step of "fixing" the URL.

This PR adds a configuration parameter to the WFE2 for an allowed legacy key ID prefix. The WFE2 verification logic is updated to allow both the expected key ID prefix and the configured legacy key ID prefix. This will allow us to specify the correct legacy URL in configuration for both staging/prod to allow unmodified V1 ACME accounts to be used with ACME v2.

Resolves https://github.com/letsencrypt/boulder/issues/3674
 		2018-05-11 15:57:56 -04:00
..
test Fix various WFE2 bugs. (#3292) 2017-12-19 13:13:29 -08:00
README.md Duplicate WFE to WFE2. (#2839) 2017-07-05 13:32:45 -07:00
stats.go ACME v2 Finalize order support (#3169) 2017-11-01 12:39:44 -07:00
verify.go WFE2: Allow legacy Key ID prefix for ACME v2 JWS. (#3705) 2018-05-11 15:57:56 -04:00
verify_test.go WFE2: Allow legacy Key ID prefix for ACME v2 JWS. (#3705) 2018-05-11 15:57:56 -04:00
wfe.go WFE2: Allow legacy Key ID prefix for ACME v2 JWS. (#3705) 2018-05-11 15:57:56 -04:00
wfe_test.go Remove various unnecessary uses of fmt.Sprintf (#3707) 2018-05-11 11:55:25 -07:00

README.md

WFE v2

The wfe2 package is copied from the wfe package in order to implement the "ACME v2" API. This design choice was made to facilitate a clean separation between v1 and v2 code and to support running a separate API process on a different port alongside the v1 API process.