Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto/autocert: should trim trailing dots #18114

Closed
jeffallen opened this issue Nov 30, 2016 · 10 comments
Closed

x/crypto/autocert: should trim trailing dots #18114

jeffallen opened this issue Nov 30, 2016 · 10 comments
Labels
FrozenDueToAge
Milestone
Unreleased

Comments

@jeffallen
Copy link
Contributor

What did you do?

When accessing a server that gets certificates using autocert via a url like https://server.domain.com./ (note the trailing dot) you get an error from the ACME server. See letsencrypt/boulder#2367 for why. They propose that clients should resolve this situation by removing the trailing dot in the certificate request.

Thus, autocert should trim trailing dots.
@bradfitz bradfitz added this to the Unreleased milestone Nov 30, 2016
@bradfitz
Copy link
Contributor

Thanks. Seems easy enough.

/cc @x1ddos

@bradfitz bradfitz self-assigned this Nov 30, 2016
@bradfitz
Copy link
Contributor

Sent https://go-review.googlesource.com/33711 ... reviews welcome!

@x1ddos
Copy link

x1ddos commented Nov 30, 2016

Yeah, sounds good. I'll create a change.

Although, hard to imagine someone typing a url with a trailing dot... Out of curiosity, does it happen regularly in your case? Never happened to me or visitors of domains that I own.

@x1ddos
Copy link

x1ddos commented Nov 30, 2016

Ah, Brad already did.

@gopherbot
Copy link

CL https://golang.org/cl/33711 mentions this issue.

@mikioh mikioh changed the title autocert should trim trailing dots x/crypto/autocert: should trim trailing dots Dec 1, 2016
@mikioh
Copy link
Contributor

mikioh commented Dec 1, 2016

For the record, absolute FQDN that ends with a dot is not permitted for SNI of TLS. See https://tools.ietf.org/html/rfc6066#section-3 and #14404.

@bradfitz
Copy link
Contributor

bradfitz commented Dec 1, 2016

Oh, yeah? So which browser is sending it, @jeffallen, and why are we accepting it, @agl?

@jeffallen
Copy link
Contributor Author

When I hacked autocert to nuke the dot, what I saw is that the URL bar had a dot on the end, but I still had a green padlock even though the SNI had no dot on the end. Don't recall if it was ff or chrome.

@agl
Copy link
Contributor

agl commented Dec 5, 2016

We shouldn't accept this. Too late for the current cycle, but this should do it in the future.

@gopherbot
Copy link

CL https://golang.org/cl/33904 mentions this issue.

gopherbot pushed a commit that referenced this issue Feb 1, 2017
@agl @bradfitz
crypto/tls: reject SNI values with a trailing dot.
3f45916 
SNI values may not include a trailing dot according to
https://tools.ietf.org/html/rfc6066#section-3. Although crypto/tls
handled this correctly as a client, it didn't reject this as a server.

This change makes sending an SNI value with a trailing dot a fatal
error.

Updates #18114.

Change-Id: Ib7897ab40e98d4a7a4646ff8469a55233621f631
Reviewed-on: https://go-review.googlesource.com/33904
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
@golang golang locked and limited conversation to collaborators Dec 5, 2017
c-expert-zigbee pushed a commit to c-expert-zigbee/crypto_go that referenced this issue Mar 28, 2022
@bradfitz
acme/autocert: remove trailing dot from domain before requesting cert
944303f 
Browsers can send an SNI name of "example.com." for
https://example.com./ but LetsEncrypt rejects the trailing dot.

Fixes golang/go#18114

Change-Id: Ie38e355e5b5566a7eb18f77a2449660e22e21b4c
Reviewed-on: https://go-review.googlesource.com/33711
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
c-expert-zigbee pushed a commit to c-expert-zigbee/crypto_go that referenced this issue Mar 29, 2022
@bradfitz
acme/autocert: remove trailing dot from domain before requesting cert
42c48ba 
Browsers can send an SNI name of "example.com." for
https://example.com./ but LetsEncrypt rejects the trailing dot.

Fixes golang/go#18114

Change-Id: Ie38e355e5b5566a7eb18f77a2449660e22e21b4c
Reviewed-on: https://go-review.googlesource.com/33711
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
LewiGoddard pushed a commit to LewiGoddard/crypto that referenced this issue Feb 16, 2023
@bradfitz
acme/autocert: remove trailing dot from domain before requesting cert
497c493 
Browsers can send an SNI name of "example.com." for
https://example.com./ but LetsEncrypt rejects the trailing dot.

Fixes golang/go#18114

Change-Id: Ie38e355e5b5566a7eb18f77a2449660e22e21b4c
Reviewed-on: https://go-review.googlesource.com/33711
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
BiiChris pushed a commit to BiiChris/crypto that referenced this issue Sep 15, 2023
@bradfitz
acme/autocert: remove trailing dot from domain before requesting cert
7e42065 
Browsers can send an SNI name of "example.com." for
https://example.com./ but LetsEncrypt rejects the trailing dot.

Fixes golang/go#18114

Change-Id: Ie38e355e5b5566a7eb18f77a2449660e22e21b4c
Reviewed-on: https://go-review.googlesource.com/33711
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
6 participants
@bradfitz @agl @x1ddos @mikioh @jeffallen @gopherbot