diff options
author | Adrien Ferrand <adferrand@users.noreply.github.com> | 2020-03-12 23:53:19 +0300 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-03-12 23:53:19 +0300 |
commit | 07abe7a8d68961042ee301039dd4da87306cb1a0 (patch) | |
tree | 4270fd493857fd7ae53eda4e32e217a7cad28a08 /certbot-nginx/local-oldest-requirements.txt | |
parent | 2fd85a4f36c37cd7dfa96f129338c2b6d95dd0d8 (diff) |
Reimplement tls-alpn-01 in acme (#6886)
This PR is the first part of work described in #6724.
It reintroduces the tls-alpn-01 challenge in `acme` module, that was introduced by #5894 and reverted by #6100. The reason it was removed in the past is because some tests showed that with `1.0.2` branch of OpenSSL, the self-signed certificate containing the authorization key is sent to the requester even if the ALPN protocol `acme-tls/1` was not declared as supported by the requester during the TLS handshake.
However recent discussions lead to the conclusion that this behavior was not a security issue, because first it is coherent with the behavior with servers that do not support ALPN at all, and second it cannot make a tls-alpn-01 challenge be validated in this kind of corner case.
On top of the original modifications given by #5894, I merged the code to be up-to-date with our `master`, and fixed tests to match recent evolution about not displaying the `keyAuthorization` in the deserialized JSON form of an ACME challenge.
I also move the logic to verify if ALPN is available on the current system, and so that the tls-alpn-01 challenge can be used, to a dedicated static function `is_available` in `acme.challenge.TLSALPN01`. This function is used in the related tests to skip them, and will be used in the future from Certbot plugins to trigger or not the logic related to tls-alpn-01, depending on the OpenSSL version available to Python.
* Reimplement TLS-ALPN-01 challenge and standalone TLS-ALPN server from #5894.
* Setup a class method to check if tls-alpn-01 is supported.
* Add potential missing parameter in validation for tls-alpn
* Improve comments
* Make a class private
* Handle old versions of openssl that do not terminate the handshake when they should do.
* Add changelog
* Explicitly close the TLS connection by the book.
* Remove unused exception
* Fix lint
Diffstat (limited to 'certbot-nginx/local-oldest-requirements.txt')
0 files changed, 0 insertions, 0 deletions