search

fxbox / dns-server

Server that helps the Box to announce its local IP address without relying on mDNS, and to register its LetsEncrypt cert for use on its local IP address.
4 stars 2 forks source link

Find a way to make client cert auth use the actual LetsEncrypt #16

Open michielbdejong opened 8 years ago

michielbdejong commented 8 years ago

Looking back at how we made this work, it seems that the client creates a self-signed cert whose hash determines its URL under .box.knilxof.org, but then it serves the LetsEncrypt cert, which will have a different hash altogether. It would be better if we use the hash of the actual LetsEncrypt cert, but the client already needs to edit DNS when only a csr exists, so not sure if/how we can extract the public key hash from the csr. Will have a look at which files letsencrypt.sh produces.

michielbdejong commented 8 years ago

The client cert used for api call is client/scripts/certs/server/my-server.crt.pem, so that's the one that should determine the URL used (through client/scripts/domains.txt) in the Common Name when creating the actual LetsEncrypt cert. It's impossible to know what the hash of the LetsEncrypt cert will be before we generate it (because the CN needs to be inside the cert).