search

dogtagpki / pki

The Dogtag Certificate System is an enterprise-class Certificate Authority (CA) which supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management.
https://www.dogtagpki.org
GNU General Public License v2.0
355 stars 133 forks source link

ACME server: RFC 8555 violation: Support ES256 #4638

Open mholt opened 8 months ago

mholt commented 8 months ago

Hi there,

Following up on https://github.com/dogtagpki/pki/issues/3729. "Unsupported JWS algorithm: ES256"

RFC 8555:

An ACME server MUST implement the "ES256" signature algorithm [RFC7518] and SHOULD implement the "EdDSA" signature algorithm using the "Ed25519" variant (indicated by "crv") [RFC8037].

Making new issue as requested. :) Thanks!

edewata commented 8 months ago

Hi, thanks for the ticket! Are you using ACME with IPA or with a standalone Dogtag PKI?

mholt commented 8 months ago

I don't know for sure, it's in relation to one of our users who hit the same error as in the linked issue above. Here's what I know:

https://caddy.community/t/caddy-and-freeipa-dogtag-signature-of-type-es256-not-supported-try-again-with-rs256/21972

I use FreeIPA’s built-in Dogtag instance as my central certificate authority. ... For me, the quickest and easiest way to integrate all internal services is to simply grab the certificates from Dogtag through ACME.

edewata commented 8 months ago

Looks like it's used with IPA. Thanks!

edewata commented 8 months ago

@rcritten FYI

Goju-Sulfam commented 8 months ago

Hello everyone. I am said user and I confirm that I use the FreeIPA embedded Dogtag. If I can be of assistance, please let me know.

bak-minsu commented 5 months ago

I put in some time to address this: https://github.com/bak-minsu/dogtagpki-pki

However, I'm quite new to contributing to open source projects. Will put in a PR once I figure out how to properly run the CI tests

francislavoie commented 5 months ago

You can probably just open the PR which will run CI via this repo. Mark your PR as draft until it's ready for someone's review.

bak-minsu commented 4 months ago

Opened Issue under JSS project as it does not currently support generating public key using Elliptic Curve, which needs to be used to validate the signature.