From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <f.gleumes@proxmox.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 3DC349C168 for <pve-devel@lists.proxmox.com>; Mon, 23 Oct 2023 15:18:49 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 22529140F5 for <pve-devel@lists.proxmox.com>; Mon, 23 Oct 2023 15:18:49 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for <pve-devel@lists.proxmox.com>; Mon, 23 Oct 2023 15:18:47 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 33203444A9 for <pve-devel@lists.proxmox.com>; Mon, 23 Oct 2023 15:18:47 +0200 (CEST) From: Folke Gleumes <f.gleumes@proxmox.com> To: pve-devel@lists.proxmox.com Date: Mon, 23 Oct 2023 15:18:03 +0200 Message-Id: <20231023131808.172494-1-f.gleumes@proxmox.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.037 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH acme/manager 0/5] fix #4497: add external account binding support X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/> List-Post: <mailto:pve-devel@lists.proxmox.com> List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe> X-List-Received-Date: Mon, 23 Oct 2023 13:18:49 -0000 This patch series adds functionality to use acme directiories that require the use of external account binding, as specified in rfc 8555 section 7.3.4. To avoid code duplication and redundant calls to the CA, the `/cluster/acme/tos` endpoint has been deprecated and it's function will be covered by the new `/cluster/acme/meta` endpoint, which exposes all meta information provided by the CA, including the flag indicating that EAB needs to be used. The underlying call to the CA remains the same. The CLI interface will only ask for the EAB credentials if needed, similar to how it works for the ToS. The patches have been tested to work with and without EAB by using pebble [0] as the CA. [0] https://github.com/letsencrypt/pebble acme: Folke Gleumes (1): fix #4497: add support for external account bindings src/PVE/ACME.pm | 43 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 8 deletions(-) manager: Folke Gleumes (4): fix #4497: acme: add support for external account bindings fix #4497: api/acme: deprecate tos endpoint in favor of meta fix #4497: cli/acme: detect eab and ask for credentials fix #4497: ui/acme: switch to new meta endpoint PVE/API2/ACMEAccount.pm | 73 +++++++++++++++++++++++++++++++++++++-- PVE/CLI/pvenode.pm | 16 +++++++-- www/manager6/node/ACME.js | 12 ++++--- 3 files changed, 93 insertions(+), 8 deletions(-) -- 2.39.2