Allow certificate_key to be specified like account_key #93
Conversation
Codecov Report
@@ Coverage Diff @@
## master #93 +/- ##
=========================================
- Coverage 93.39% 93.2% -0.19%
=========================================
Files 6 6
Lines 469 471 +2
=========================================
+ Hits 438 439 +1
- Misses 31 32 +1
|
Repository owner
deleted a comment
May 1, 2018
OK, I added that in c34a91b. CircleCI seems to fail on that, but I cannot comprehend its error message. It seems like some kind of internal error during the flake8 test, however flake8 reports no problems on my machine. (And the CircleCI output only contains stack traces showing that it couldn't run flake8...) |
@dnet Thanks for working on this. ci is failing because of this upstream bugs in flake8: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
What
I added an option to the
Client
constructor namedcertificate_key
which behaves just like the optional parameteraccount_key
-- it allows the user to specify a private key instead of generating one.Why
While I'm all for generating new keys upon each renewal as it dramatically lowers the time window in which a leaked key can be abused, there are situations when a pre-existing key must be used.
For example if HPKP is already set up and clients expects private keys to be selected from a limited pool already advertised in the header, there's no other option but to generate a certificate that matches at least one of the entries already known by User-Agents.