search

dns3l / dns3l-core

Core functionality of dns3l written in Go
1 stars 3 forks source link

How ACME client lib builds the chain #45

Closed iaean closed 1 year ago

iaean commented 1 year ago

We need to understand how daemons ACME client lib is retrieving and building the chain.

This is important to know to be able to manage and tackle issues where CA chain is impacted e.g. https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

lnobach commented 1 year ago

dns3ld relies on go-acme/lego's obtaining method. Here, the certificate chain is entirely built from information provided by the ACME provider. Function getAll and subfunctions traverse the server's issuer certificates whose URL is indicated by an up link in the HTTP headers of their child certificates.

See RFC 8555, Section 7.4.2

https://github.com/go-acme/lego/blob/86d9e5632cf4c978ea63f1ebc2197e20bbdf0180/acme/api/certificate.go#L34

https://github.com/go-acme/lego/blob/86d9e5632cf4c978ea63f1ebc2197e20bbdf0180/acme/api/certificate.go#L86

https://github.com/go-acme/lego/blob/86d9e5632cf4c978ea63f1ebc2197e20bbdf0180/acme/api/certificate.go#L120