search

dehydrated-io / dehydrated

letsencrypt/acme client implemented as a shell-script – just add water
https://dehydrated.io
MIT License
5.96k stars 716 forks source link

Will dehydrated be broken after Sep 30th, 2024? #917

Closed mschiff closed 1 year ago

mschiff commented 1 year ago

From https://letsencrypt.org/2023/07/10/cross-sign-expiration.html:

If you are an ACME client author, please make sure that your client correctly downloads and installs the certificate chain provided by our API during every certificate issuance, including renewals. Failure modes we have seen in the past include a) never downloading the chain at all and only serving the end-entity certificate; b) never downloading the chain and instead serving a hard-coded chain; and c) only downloading the chain at first issuance and not re-downloading during renewals. Please ensure that your client does not fall into any of these buckets.

I opened this issue so it can be verifed if dehydrated will still function properly after the expiration of the cross-sign on 2024-09-30

dehydrated is caching chains and I could not tell whether this will be a problem or not in the future by having a quick look at it...

lukas2511 commented 1 year ago

Dehydrated does some funky stuff for the deprecated acme v1 API, walking issuer uris etc and caching by issuer name, but for v2/rfc8555 operation it always retrieves a fresh and full chain from the CA, on every renewal.