Writeing a acme extension for onion address

Issuance Policy
1

This will be almost scribble like, so it may hard to read.
add onion identifier -
chllenges ::
http/tls-alpn (both over tor network)
dns challenge can’t be used
new csr based challenge (LE want to use it because it doesn’t need tor daemon running on VA), but are we send json payload to VA backend from WFE.
from pebble wte updateChallenge function.
// In strict mode we reject any challenge POST with a body other than {}.
// This matches RFC 8555 Section 7.5.1 and the ACME challenge types that
// Pebble has implemented. Per ACME errata 5729[0] it may not be true for
// extensions to ACME that add new challenge types.
Boulder will need a new column for this csr data saved at challange object: will it able to work on production without massive downtime?

signing would be same as before (except the need to set SNI as dns, not maked up onion identifier obviously

2

Is there any reason to store the CSR?

We could just send the CSR directly to the RA, that will check with the VA that it contains the signed keyAuthz, update the challenge status, and then just discard the CSR.

Are you working on a Pebble version of this?

3

Yeap, and pebble don’t have ra so I forgot about it.

4

hit a wall: tor onionv3 address is a hash of ed25519 key, while golang x509 package doesn’t support csr signed with ed25519

5

Are you sure?

https://play.golang.org/p/U2ejd1DKqWW

I realize that the example is for signing, but since it calls x509.ParseCertificateRequest on the DER-form of the CSR, we know it can handle reading and validating it also.

$ openssl req -in a.pem -noout -text
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: CN = foobar
        Subject Public Key Info:
            Public Key Algorithm: ED25519
                ED25519 Public-Key:
                pub:
                    96:17:55:00:f3:81:f8:03:bd:e5:ef:18:75:35:45:
                    9e:5d:fe:70:11:8a:b2:5f:19:7f:d8:a5:ed:11:af:
                    30:c0
        Attributes:
        Requested Extensions:
            X509v3 Subject Alternative Name:
                DNS:foobar
    Signature Algorithm: ED25519
        16:7e:7e:61:54:4b:33:3d:c8:a4:58:8b:01:de:93:87:25:7b:
        8c:2d:d7:03:b8:bd:5f:50:17:94:ab:ee:84:48:09:a9:83:2b:
        b0:b9:bc:21:76:97:b4:6d:e2:99:9c:17:38:95:65:dc:fb:9f:
        41:46:a7:4b:5e:cf:7e:03:29:03
1 Like
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.