Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ACME v2 Finalize order support #3169

Merged
merged 27 commits into from
Nov 1, 2017
Merged

ACME v2 Finalize order support #3169

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
50ffccc
ACMEv2 Finalize Order Support
Oct 5, 2017
803e269
Add missing pb-marshalling test
Oct 12, 2017
768706d
Remove commented import
Oct 12, 2017
f58950c
Remove comment cruft from test
Oct 12, 2017
8b2efa0
Remove comment
Oct 12, 2017
cefd8eb
Merge remote-tracking branch 'le/master' into cpu-v2-finalize-order
Oct 12, 2017
d571522
Fix merge errors
Oct 12, 2017
55c4ac2
Remove legacy OpenSSL CSR bug check
Oct 16, 2017
5115791
Fix inaccurate comment in finalizeOrder
Oct 16, 2017
5b13d17
Return 404 for bad Order req paths
Oct 16, 2017
ed9c502
Remove redundant identifier conversion
Oct 16, 2017
4039dcd
Remove inaccurate/old orderToOrderJSON comment.
Oct 16, 2017
8643d17
Normalize orderID/accountID param order, use types.
Oct 17, 2017
e7eb1a2
Replace `UpdateOrder` SA RPC with `FinalizeOrder`.
Oct 17, 2017
5217e30
Reject finalization of expired orders
Oct 17, 2017
9496ef5
Replace `tx.Update` with `tx.Exec` of an `UPDATE` stmnt.
Oct 17, 2017
5de4af3
Update `orderValid` to allow nil `CertificateSerial`
Oct 20, 2017
a682049
Fix `TestOrderValid`, remove RA CSR check duplication.
Oct 20, 2017
43eee64
Rename `OrderAuthorizationsRequest` to `GetOrderAuthorizationsRequest`.
Oct 20, 2017
6f46f03
Clean up `NewOrder` rollbacks/error handling.
Oct 20, 2017
9db6b71
Remove duplicated Goodkey check
Oct 20, 2017
e9effd6
Remove unused `idents` from `finalizeOrder`.
Oct 20, 2017
c42bacd
Add index to reversedName, reduce reversedName size.
Oct 20, 2017
5d8f6a2
Mark order as processing before finalization.
Oct 30, 2017
e3b8d73
Merge remote-tracking branch 'le/master' into cpu-v2-finalize-order
Oct 30, 2017
ddffce0
Fix typo.
Nov 1, 2017
b74f159
Don't return Order from SA processing/finalize RPCs.
Nov 1, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions ca/ca.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -413,6 +413,14 @@ func (ca *CertificateAuthorityImpl) IssueCertificate(ctx context.Context, issueR
return emptyCert, berrors.InternalServerError("RegistrationID is nil")
}

// OrderID is an optional field only used by the "ACME v2" issuance flow. If
// it isn't nil, then populate the `orderID` var with the request's OrderID.
// If it is nil, use the default int64 value of 0.
var orderID int64
if issueReq.OrderID != nil {
orderID = *issueReq.OrderID
}

serialBigInt, validity, err := ca.generateSerialNumberAndValidity()
if err != nil {
return emptyCert, err
Expand All @@ -423,7 +431,7 @@ func (ca *CertificateAuthorityImpl) IssueCertificate(ctx context.Context, issueR
return emptyCert, err
}

return ca.generateOCSPAndStoreCertificate(ctx, *issueReq.RegistrationID, serialBigInt, certDER)
return ca.generateOCSPAndStoreCertificate(ctx, *issueReq.RegistrationID, orderID, serialBigInt, certDER)
}

func (ca *CertificateAuthorityImpl) IssuePrecertificate(ctx context.Context, issueReq *caPB.IssueCertificateRequest) (*caPB.IssuePrecertificateResponse, error) {
Expand Down Expand Up @@ -591,7 +599,12 @@ func (ca *CertificateAuthorityImpl) issueCertificateOrPrecertificate(ctx context
return certDER, nil
}

func (ca *CertificateAuthorityImpl) generateOCSPAndStoreCertificate(ctx context.Context, regID int64, serialBigInt *big.Int, certDER []byte) (core.Certificate, error) {
func (ca *CertificateAuthorityImpl) generateOCSPAndStoreCertificate(
ctx context.Context,
regID int64,
orderID int64,
serialBigInt *big.Int,
certDER []byte) (core.Certificate, error) {
ocspResp, err := ca.GenerateOCSP(ctx, core.OCSPSigningRequest{
CertDER: certDER,
Status: "good",
Expand All @@ -610,11 +623,12 @@ func (ca *CertificateAuthorityImpl) generateOCSPAndStoreCertificate(ctx context.
// Note: This log line is parsed by cmd/orphan-finder. If you make any
// changes here, you should make sure they are reflected in orphan-finder.
ca.log.AuditErr(fmt.Sprintf(
"Failed RPC to store at SA, orphaning certificate: serial=[%s] cert=[%s] err=[%v], regID=[%d]",
"Failed RPC to store at SA, orphaning certificate: serial=[%s] cert=[%s] err=[%v], regID=[%d], orderID=[%d]",
core.SerialToString(serialBigInt),
hex.EncodeToString(certDER),
err,
regID,
orderID,
))
return core.Certificate{}, err
}
Expand Down
65 changes: 37 additions & 28 deletions ca/proto/ca.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions ca/proto/ca.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ service OCSPGenerator {
message IssueCertificateRequest {
optional bytes csr = 1;
optional int64 registrationID = 2;
optional int64 orderID = 3;
}

message IssuePrecertificateResponse {
Expand Down
6 changes: 6 additions & 0 deletions core/interfaces.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,9 @@ type RegistrationAuthority interface {
// [WebFrontEnd]
NewOrder(ctx context.Context, req *rapb.NewOrderRequest) (*corepb.Order, error)

// [WebFrontEnd]
FinalizeOrder(ctx context.Context, req *rapb.FinalizeOrderRequest) (*corepb.Order, error)

// [AdminRevoker]
AdministrativelyRevokeCertificate(ctx context.Context, cert x509.Certificate, code revocation.Reason, adminName string) error
}
Expand Down Expand Up @@ -125,6 +128,7 @@ type StorageGetter interface {
CountFQDNSets(ctx context.Context, window time.Duration, domains []string) (count int64, err error)
FQDNSetExists(ctx context.Context, domains []string) (exists bool, err error)
GetOrder(ctx context.Context, req *sapb.OrderRequest) (*corepb.Order, error)
GetOrderAuthorizations(ctx context.Context, req *sapb.GetOrderAuthorizationsRequest) (map[string]*Authorization, error)
CountInvalidAuthorizations(ctx context.Context, req *sapb.CountInvalidAuthorizationsRequest) (count *sapb.Count, err error)
GetAuthorizations(ctx context.Context, req *sapb.GetAuthorizationsRequest) (*sapb.Authorizations, error)
}
Expand All @@ -143,6 +147,8 @@ type StorageAdder interface {
DeactivateRegistration(ctx context.Context, id int64) error
DeactivateAuthorization(ctx context.Context, id string) error
NewOrder(ctx context.Context, order *corepb.Order) (*corepb.Order, error)
SetOrderProcessing(ctx context.Context, order *corepb.Order) error
FinalizeOrder(ctx context.Context, order *corepb.Order) error
AddPendingAuthorizations(ctx context.Context, req *sapb.AddPendingAuthorizationsRequest) (*sapb.AuthorizationIDs, error)
}

Expand Down
1 change: 0 additions & 1 deletion core/objects.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -576,7 +576,6 @@ type Order struct {
ID int64
RegistrationID int64
Expires time.Time
CSR []byte
Error error
CertificateSerial string
Authorizations []Authorization
Expand Down
Loading