Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

uacme.sh can generate invalid challenge due to echo -n #48

Closed
s-u opened this issue Dec 8, 2021 · 1 comment
Closed

uacme.sh can generate invalid challenge due to echo -n #48

s-u opened this issue Dec 8, 2021 · 1 comment

Comments

@s-u
Copy link

s-u commented Dec 8, 2021

uacme.sh uses /bin/sh in the shebang which often forces shells such as bash into compatibility mode which interprets echo -n as literal output and thus creates an invalid challenge:

uacme: the server reported the following error:
{
    "type": "urn:ietf:params:acme:error:unauthorized",
    "detail": "The key authorization file from the server did not match this challenge \"tt[...]Wuo\" != \"-n tt[...]Wuo\"",
    "status": 403
}

above example was produced with

$ /bin/sh --version
GNU bash, version 3.2.57(1)-release (arm64-apple-darwin20)

and the echo behavior can be checked with

$ /bin/sh -c 'echo -n'
-n

The specs say that servers SHOULD accept challenges with trailing whitespace so the easiest fix is to remove -n. A more advanced fix would be to first check that -n is safe and not use it if it's not.

@s-u
Copy link
Author

s-u commented Dec 8, 2021

@ndilieto thanks for the prompt response! I can confirm this fixes the issue on macOS where printf isn an external utility so is not impacted by the shell choice (quick check suggests same is true on Linux and OpenWrt).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant