Comments (12)
That seems like my fault during the go-jose v4 upgrade with supported algorithms. It should be straightforward to fix. I’m out today but I can do that this week.
from pebble.
Yes, we will tag a new release soon. There’s a few other changes in progress I’d like to get in, such as the ARI PR, and a few docker container changes. That should all be done in the next week or two.
from pebble.
yes, but there’s several other higher priority things we’re working on elsewhere. It’ll get fixed soon.
from pebble.
It's not quite that simple, but not much more complicated either.
Fix PR opened - #459
The big thing I need is a test still, as this functionality was clearly broken.
from pebble.
OK, writing an integration test was actually not that bad, so it's done now :)
We'll tag a new release with this fix, too.
from pebble.
I pushed a v2.5.2 tag now. We will do another release with ARI etc later.
from pebble.
When testing with certbot main and latest pebble running in docker with the EAB config, I get the reported failure. (Technically you'll need to volume mount - ./test/config:/test/config
to work around the container not having the EAB config inside it.)
$ certbot_test certonly --standalone -d test.example.com --eab-kid zWNDZM6eQGHWpSRTPal5eIUYFTu7EajVIoguysqZ9wG44nMEtx3MUAsUDkMTQ12W --eab-hmac-key phil
https://localhost:14000 "POST /sign-me-up HTTP/1.1" 400 240
Received response:
HTTP 400
Cache-Control: public, max-age=0, no-cache
Content-Type: application/problem+json; charset=utf-8
Link: <https://localhost:14000/dir>;rel="index"
Replay-Nonce: V-GoNIeXrRUXYE7jD52Fhw
Date: Mon, 08 Apr 2024 16:54:33 GMT
Content-Length: 240
{
"type": "urn:ietf:params:acme:error:malformed",
"detail": "failed to decode external account binding: go-jose/go-jose: unexpected signature algorithm \"HS256\"; expected [\"RS256\" \"ES256\" \"ES384\" \"ES512\"]",
"status": 400
}
from pebble.
RFC 8555 says about EAB in 7.3.4: The "alg" field MUST indicate a MAC-based algorithm
, so the current set of algorithms in Pebble (ES*, RS*) is straightforwardly incorrect
from pebble.
Hi.
Is there a planned fix for this, or instruction on how to generate and use suitable keys ?
from pebble.
I guess that mean the fix is a bit more involved than adding jose.HS256
to goodJWSSignatureAlgorithms
then (ie not fixable by someone with limited knowledge about JWS like me).
Would you happen to know ressources that explain how to generate new kid with a supported algorithm ?
from pebble.
Thanks for the fast fix @mcpherrinm 🙏
from pebble.
@mcpherrinm do you think a new tagged release that include the fix could be possible ?
from pebble.
Related Issues (20)
- Golang, apk and zlib versions are outdated HOT 2
- Allow to force auth challenge HOT 1
- Implement the "dns-account-01" Challenge in Pebble HOT 9
- Full http logging HOT 1
- fix appveyor CI
- Support must-staple extension HOT 1
- Fix `golangci-lint` HOT 3
- Regression time limit exceeded / TimeoutError HOT 5
- Request for a new release HOT 6
- v2.5.0 docker push failed HOT 9
- ci: AppVeyor is broken HOT 1
- Remove DockerHub images of pebble and pebble-challtestsrv HOT 4
- Cannot set DNS server in Docker image HOT 10
- Docker: Use hostname instead of IP addresses HOT 7
- New Certificates aren't getting Ready HOT 2
- Pebble fails to start with externalAccountBinding test config
- The request specified an account that does not exist, [certbot and pebble] HOT 2
- The key authorization file from the server did not match this challenge HOT 1
- Pebble seems to reuse challenges object for different orders HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pebble.