sendnrw/goacme
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Changes
Some checks failed
release-tag / release-image (push) Failing after 2m5s
Details

Browse Source
This commit is contained in:
jbergner
2025-04-29 10:31:33 +02:00
parent 9c293716cf
commit b6c39eda74
1 changed files with 543 additions and 545 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
main.go
View File

@@ -24,14 +24,12 @@ import (
"bytes" "bytes"
"context" "context"
"crypto" "crypto"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand" "crypto/rand"
"crypto/sha256" "crypto/sha256"
"crypto/x509" "crypto/x509"
"crypto/x509/pkix" "crypto/x509/pkix"
"database/sql" "database/sql"
"encoding/asn1" "encoding/base64"
"encoding/json" "encoding/json"
"encoding/pem" "encoding/pem"
"errors" "errors"
@@ -93,7 +91,7 @@ var (
// MySQL store (non‑exhaustive) // MySQL store (non‑exhaustive)
// ----------------------------------------------------------------------------- // -----------------------------------------------------------------------------
type mysqlStore struct{ type mysqlStore struct {
db *sql.DB db *sql.DB
} }
@@ -224,7 +222,7 @@ type ca struct {
db *mysqlStore db *mysqlStore
mu sync.RWMutex // guards ocspCache / crlCache mu sync.RWMutex // guards ocspCache / crlCache
ocspCache []byte //ocspCache []byte
crlCache []byte crlCache []byte
} }
@@ -586,10 +584,8 @@ func (s *server) handleFinalize(ctx context.Context, w http.ResponseWriter, r *h
return return
} }
// order ID is last element
orderID := path.Base(r.URL.Path) orderID := path.Base(r.URL.Path)
// Parse CSR (DER) – payload contains base64‑encoded CSR per RFC 8555 §7.4
var in struct { var in struct {
CSR string `json:"csr"` CSR string `json:"csr"`
} }
@@ -597,7 +593,7 @@ func (s *server) handleFinalize(ctx context.Context, w http.ResponseWriter, r *h
http.Error(w, "bad csr wrapper", 400) http.Error(w, "bad csr wrapper", 400)
return return
} }
csrDER, err := jose.Base64URLDecode(in.CSR) csrDER, err := base64.RawURLEncoding.DecodeString(in.CSR)
if err != nil { if err != nil {
http.Error(w, "bad csr b64", 400) http.Error(w, "bad csr b64", 400)
return return
@@ -613,8 +609,10 @@ func (s *server) handleFinalize(ctx context.Context, w http.ResponseWriter, r *h
return return
} }
// Build leaf cert (valid 90 days, key‑usage TLS‑server) // --- FIX: sha256.Sum256 liefert ein [32]byte – zuerst in Variable legen
serial := big.NewInt(0).SetBytes(sha256.Sum256([]byte(uuid.New().String()))[:]) hash := sha256.Sum256([]byte(uuid.New().String()))
serial := new(big.Int).SetBytes(hash[:])
tmpl := &x509.Certificate{ tmpl := &x509.Certificate{
SerialNumber: serial, SerialNumber: serial,
Subject: csr.Subject, Subject: csr.Subject,
@@ -640,14 +638,12 @@ func (s *server) handleFinalize(ctx context.Context, w http.ResponseWriter, r *h
return return
} }
// Link order → valid & cert URL
certURL := fmt.Sprintf("https://%s/acme/cert/%s", r.Host, certID) certURL := fmt.Sprintf("https://%s/acme/cert/%s", r.Host, certID)
if _, err := s.db.db.ExecContext(ctx, `UPDATE orders SET status='valid',payload=?,finalize_url=? WHERE id=?`, pay.Data, certURL, orderID); err != nil { if _, err := s.db.db.ExecContext(ctx, `UPDATE orders SET status='valid',payload=?,finalize_url=? WHERE id=?`, pay.Data, certURL, orderID); err != nil {
http.Error(w, "db", 500) http.Error(w, "db", 500)
return return
} }
// Response must include chain (leaf + CA) in PEM order per RFC 8555 §7.4
var buf bytes.Buffer var buf bytes.Buffer
_ = pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: der}) _ = pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: der})
_ = pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: s.ca.cert.Raw}) _ = pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: s.ca.cert.Raw})
@@ -687,7 +683,9 @@ func (s *server) handleRevoke(ctx context.Context, w http.ResponseWriter, r *htt
nonce := uuid.New().String() nonce := uuid.New().String()
_ = s.db.putNonce(ctx, nonce) _ = s.db.putNonce(ctx, nonce)
s.jsonResponse(w, 200, struct{ Status string `json:"status"` }{Status: "revoked"}, nonce) s.jsonResponse(w, 200, struct {
Status string `json:"status"`
}{Status: "revoked"}, nonce)
} }
func (s *server) handleOCSP(ctx context.Context, w http.ResponseWriter, r *http.Request) { func (s *server) handleOCSP(ctx context.Context, w http.ResponseWriter, r *http.Request) {