Add simplified Order::finalize() method

[djc]

Slicing off some more boilerplate. Doesn't feel like a big win, but might be a small one. What do you think?

[cpu]

Generally looks good, but I think we can make the API a bit easier. WDYT? I'm also open to landing this as-is and then iterating.

[djc]

@cpu any clue what this might be about off the top of your head?

 ---- dns_01 stdout ----
Error: Api(Problem { type: Some("urn:ietf:params:acme:error:unauthorized"), detail: Some("CSR is missing Order domain \"*.wildcard.example.com\""), status: Some(403), subproblems: [] })

I guess the fact that it's about a wildcard is not a coincidence...

[cpu]

Nice!

[cpu]

@cpu any clue what this might be about off the top of your head?

Oh! I have a hunch....

We're collecting up the identifiers from the order authorizations now, but wildcard identifiers are handled specially (ugh) in the authz representation. RFC 8555 7.1.4 says:

Wildcard domain names (with "*" as the first label) MUST NOT be included in authorization objects. If an authorization object conveys authorization for the base domain of a newOrder DNS identifier containing a wildcard domain name, then the optional authorizations "wildcard" field MUST be present with a value of true.

E.g. I think an order that includes *.example.com gets an authorization server-side that has the identifier "example.com", with "wildcard: true". When we process the stream for the purpose of making a CSR I think we need to respect that boolean & prepend the wildcard label ourselves.

I have to switch gears to other work this morning but can look closer if my hunch is wrong.

[djc]

We're collecting up the identifiers from the order authorizations now, but wildcard identifiers are handled specially (ugh) in the authz representation. RFC 8555 7.1.4 says:

Wildcard domain names (with "*" as the first label) MUST NOT be included in authorization objects. If an authorization object conveys authorization for the base domain of a newOrder DNS identifier containing a wildcard domain name, then the optional authorizations "wildcard" field MUST be present with a value of true.

E.g. I think an order that includes *.example.com gets an authorization server-side that has the identifier "example.com", with "wildcard: true". When we process the stream for the purpose of making a CSR I think we need to respect that boolean & prepend the wildcard label ourselves.

Oh wow, that's pretty interesting stuff... Reworked the code to try and encode this into the type system, please have a look when you have a moment.

[cpu]

Just a few doc nits from the latest updates 👍

[cpu]

Oh wow, that's pretty interesting stuff...

I wish I remembered why it ended up this way 🤔 I think there was some consternation around keeping the authz identifiers as valid domain names and the wildcard stuff is a (poorly specified) property of X.509/TLS.

[cpu]

🎉 Very cool.

It was also nice to see the Pebble integration tests (and cc92a3e) pulling their weight and catching a bug before it lands!!