grindsa / acme2certifier

library implementing ACME server functionality
GNU General Public License v3.0
173 stars 36 forks source link

Adding allowed_domainlist to the mscert_srv cahandler #161

Closed gbit-is closed 6 months ago

gbit-is commented 6 months ago

I added the allowed_domainlist functionality from acme_ca_handler.py to the mscert_srv.py to add the option to restrict to allowed domains for microsoft cert server usage

https://github.com/grindsa/acme2certifier/issues/160

grindsa commented 6 months ago

Thank you for raising a PR. Although i merged it i will do some refactoring to avoid code-duplication across the different handlers.

Reviewing the code i came across. the following issue and would be interested in your feedback how a2c should behave in such situation:

Currently the handler reads the allowed_domainlist parameter and expects a list of allowed domains/regex. In case the parameter is other than a list parsing fails the allowed_domainlist parameter will be left empty which would disable the domain list check completely. That means that any fqdn can be send as part of a CSR and would pass the handler, which might not be in your interest.

I am wondering if this is the right behavior or if we should rather change the implementation in a way that the domain_check always fails.

Any thoughts?