Open benburkert opened 8 months ago
Note the field comment:
To always accept the terms, the callers can use AcceptTOS.
cc @golang/security
Yes, and even setting Prompt
to func(string) { return false }
works for this ACME provider, since they do account provisioning beforehand. It seems quirky to require the Prompt
field when the part of the RFC that it maps to is marked as optional. Changing this m.Prompt == nil
to a m.Prompt == nil && (m.Client == nil || m.Client.DirectoryURL == "")
would keep the check for the default provider (Let's Encrypt requires it) and drop it for a custom provider.
Go version
go version go1.21.4 darwin/arm64
What operating system and processor architecture are you using (
go env
)?What did you do?
Use
(x/crypto/acme/autocert).Manager
without initializing thePrompt
field to request a certificate from an ACME provider (https://zerossl.com/ for example) that doesn't require the optionaltermsOfServiceAgreed
portion ofnewAccount
requests:What did you expect to see?
A valid certificate via the
autocert.Manager
. TheManager.Client.DirectoryURL
is explicitly being set so the check for nilPrompt
field does not seem necessary.What did you see instead?
An error message log:
http: TLS handshake error from <redacted>: acme/autocert: Manager.Prompt not set