natemcmaster / LettuceEncrypt

Free, automatic HTTPS certificate generation for ASP.NET Core web apps
https://nuget.org/packages/LettuceEncrypt
Apache License 2.0
1.58k stars 153 forks source link

Terms of Service is not required, and throws an exception when missing #121

Closed BryanCAlcorn closed 4 years ago

BryanCAlcorn commented 4 years ago

Describe the bug Version: LettuceEncrypt 1.1.0-beta.60

Per RFC8555 § 7.1.1 the TOS URL is not required by the ACME protocol, and is an optional metadata field. See also here.

If an ACME implementation does not support TOS, an exception gets thrown when trying to run an app targeting that ACME server, due to missing TOS URL. Stack trace below:

Failed to automatically create a certificate for {MY URL} System.NullReferenceException: Object reference not set to an instance of an object. at Certes.IAcmeContextExtensions.TermsOfService(IAcmeContext context) at LettuceEncrypt.Internal.AcmeClient.GetTermsOfServiceAsync() at LettuceEncrypt.Internal.AcmeCertificateFactory.CreateAccount(CancellationToken cancellationToken) at LettuceEncrypt.Internal.AcmeCertificateFactory.GetOrCreateAccountAsync(CancellationToken cancellationToken) at LettuceEncrypt.Internal.AcmeStates.BeginCertificateCreationState.MoveNextAsync(CancellationToken cancellationToken

To Reproduce Steps to reproduce the behavior:

  1. Set up a step-ca ACME server (see here)
  2. Trust the root CA cert on your test machine.
  3. Add LettuceEncrypt 1.1.0-beta.60 to a .NET Core 3.1 app and configure (see Additional info for sample Startup file)
  4. Override the default ICertificateAuthorityConfiguration to target your step-ca ACME server URI
  5. See exception when you run the application.

Expected behavior Client certificate should be issued without TOS available.

Additional Info Included my Startup.cs.txt file. This implementation expects the step-ca URI in the appsettings.json "CAUri" setting.

BryanCAlcorn commented 4 years ago

Actually, found that there was a separate cause to this issue. My Step-CA server was not set up properly.