| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
buypass.com acme api.
From Bartosz Kuzma (bartosz.kuzma AT release11.com), thanks!
OK beck, deraadt
|
|
|
|
|
| |
http error.
OK beck
|
|
|
|
|
|
| |
challenge objects that the server hopefully provides.
input & OK deraadt
OK beck, benno
|
|
|
|
|
|
| |
definitions in every source file that includes extern.h.
From Michael Forney (mforney AT mforney DOT org), thanks!
OK jca
|
|
|
|
|
| |
OK benno
Input & OK tb
|
|
|
|
|
|
|
|
|
|
|
| |
This uses less code and unveil(2) seems to be the better tool here.
The directory one chroots into needs to be carefully setup (they are
not) and comon wisedom is that root can break out of chroots.
There is probably nothing wrong with the chroot code because of pledge
but it still makes me feel uneasy.
input & OK on previous version mestre
OK on previous version deraadt
bug found, input & OK benno
|
|
|
|
|
| |
Originaly from Renaud Allard following input from benno, tweaked by me.
OK benno
|
|
|
|
| |
diff from Renaud Allard <renaud@allard.it>, ok to get in from florian@
|
|
|
|
|
| |
One could always use them on the command line and acme-client would do
the right thing.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(ACME)" to be able to talk to the v02 Let's Encrypt API.
With this acme-client(1) will no longer be able to talk to the v01
API. Users must change the api url in /etc/acme-client.conf to
https://acme-v02.api.letsencrypt.org/directory
Existing accounts (and certs of course) stay valid and after the url
change acme-client will be able to renew certs.
Tested by Renaud Allard and benno
Input & OK benno
|
|
|
|
| |
ok florian@
|
|
|
|
|
|
|
|
| |
directory call. This way we don't need to update the acme-client.conf
file every time it changes. Still parse the option, ignore and warn about
it for a release. Sysmerge should be able to handle the removal.
"nice" deraadt@
OK benno
|
|
|
|
|
|
|
|
|
| |
This way we can still chroot to certdir but the the certificate file
is not fixed to "cert.pem".
Writing of chain.pem and fullchain.pem is currently broken with this.
OK benno
|
|
|
|
|
| |
in the way.
OK benno
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
start using the configuration file and delete command line arguments:
-a agreement -> agreement url ...
-c certdir -> domain certificate "path"
-f accountkey -> account key "path"
-k domainkey -> domain key "path"
-s authority -> sign with "name"
new argument:
-f configfile
the changes needed to use the new configuration are local to main.c for now.
While the configuration could be passed directly to netproc(), keyproc() etc,
the diff is smaller this way.
This also removes the multidir (-m) mode for now - specify different paths in
each domain {} block instead.
ok florian
|
|
|
|
|
|
|
|
|
| |
talk.
Suggest by and OK deraadt, OK benno.
(Later on deraadt and benno discussed if this should be handled with a
config file. This seems to be good enough for now. We can do a config
file later.)
|
| |
|
|
|
|
|
| |
pledge directly as needed.
ok florian
|
| |
|
|
OK to get it in deraadt@ (and probably beck@)
At least deraadt@, beck@ and otto@ are fine with the name and the
disagreements stopped.
|