search

letsencrypt / pebble

A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server not suited for a production certificate authority.
Mozilla Public License 2.0
625 stars 150 forks source link

POST-as-GET for directory and newNonce endpoints #291

Closed eggsampler closed 4 years ago

eggsampler commented 4 years ago

While doing some testing for the upcoming POST-as-GET changes, I noticed that RFC8555 Section 6.3 states that,

The server MUST allow GET requests for the directory and newNonce resources (see Section 7.1), in addition to POST-as-GET requests for these resources.

From what I can tell, this isn't supported in either pebble or boulder: repro / test.

Is this something you think should be supported? I doubt anyone has run into this, but it seems like it should be supported per the rfc.

It's a relatively easy fix in pebble, this seems to do the trick (but may need some adjusting of the linter).

cpu commented 4 years ago

Hey @eggsampler, thanks for opening an issue.

Is this something you think should be supported? I doubt anyone has run into this, but it seems like it should be supported per the rfc.

Yup, I think supporting it makes sense. I don't have any philosophical opposition. I think we probably just overlooked that sentence in the RFC when implementing POST-as-GET support.

Thanks for catching that.

cpu commented 4 years ago

It's a relatively easy fix in pebble, this seems to do the trick (but may need some adjusting of the linter).

LGTM, I went ahead and stole your fix to make a PR: https://github.com/letsencrypt/pebble/pull/292 Thanks for making that easy :-)

I'll look to get that merged next week when my American counterparts are back from holiday. I think this fix merits a new release tag so I'll make a note to do that next week too.

Thanks again!

cpu commented 4 years ago

this isn't supported in either pebble or boulder

Filed https://github.com/letsencrypt/boulder/issues/4584 for fixing the Boulder side. Probably won't get a chance to take a whack at that until later next week.