[pve-devel] [PATCH acme v3 0/5] fix #4497: add support for external account bindings
Fabian Grünbichler
f.gruenbichler at proxmox.com
Fri Nov 10 12:18:13 CET 2023
On October 31, 2023 10:05 am, Folke Gleumes wrote:
> Changes since v2:
> * reverted the new_account abi to be non breaking
>
> Changes since v1:
> * fixed nit's
> * expanded meta endpoint by all return values defined in the rfc
> * expanded new_account signature by field for eab credentials
> * allow for eab even if not required
>
> This patch series adds functionality to use acme directiories
> that require the use of external account binding, as specified
> in rfc 8555 section 7.3.4.
>
> To avoid code duplication and redundant calls to the CA,
> the `/cluster/acme/tos` endpoint has been deprecated and
> it's function will be covered by the new `/cluster/acme/meta`
> endpoint, which exposes all meta information provided by the CA,
> including the flag indicating that EAB needs to be used.
> The underlying call to the CA remains the same.
>
> The CLI interface will only ask for the EAB credentials if needed,
> similar to how it works for the ToS.
>
> The patches have been tested to work with and without EAB
> by using pebble [0] as the CA.
>
> [0] https://github.com/letsencrypt/pebble
Reviewed-by: Fabian.Grünbichler <f.gruenbichler at proxmox.com>
Tested-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
Held off applying for now, since this requires a bump of proxmox-acme
(and a versioned depends, else the EAB part will be silently ignored by
the old version ;)), and we might want to update the plugins as well
while doing that..
> acme: Folke Gleumes (1):
> fix #4497: add support for external account bindings
>
> src/PVE/ACME.pm | 48 ++++++++++++++++++++++++++++++++++++++++++------
> 1 file changed, 42 insertions(+), 6 deletions(-)
>
>
> manager: Folke Gleumes (4):
> fix #4497: acme: add support for external account bindings
> api/acme: deprecate tos endpoint in favor of meta
> fix #4497: cli/acme: detect eab and ask for credentials
> ui/acme: switch to new meta endpoint
>
> PVE/API2/ACMEAccount.pm | 83 ++++++++++++++++++++++++++++++++++++++-
> PVE/CLI/pvenode.pm | 26 +++++++++++-
> www/manager6/node/ACME.js | 12 ++++--
> 3 files changed, 113 insertions(+), 8 deletions(-)
>
> --
> 2.39.2
>
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
>
>
More information about the pve-devel
mailing list