feat: Implement ACME ALPN-01 challenge type #1897
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit introduces support for the ACME `tls-alpn-01` challenge type,
as specified in RFC 8737. This allows for domain validation by presenting
a specific certificate during a TLS handshake using the ALPN extension.
Key changes include:
- **Challenge Definition:** Added `tls-alpn-01` as a recognized challenge type.
- **Certificate Generation:** Implemented `AcmeClient.generateAlpnCertificate()`
to create the required self-signed certificate with a
`subjectAlternativeName` and a critical `acmeIdentifier` extension
containing the SHA-256 digest of the key authorization.
- **TLS Handshake Modification:**
- `AcmeSSLContext` now uses a custom `X509ExtendedKeyManager`
(`AlpnKeyManager`).
- This key manager dynamically selects the ALPN challenge certificate
when the `acme-tls/1` protocol is negotiated via ALPN and the SNI
hostname matches a domain undergoing ALPN-01 validation.
- **`AcmeClient` Update:**
- `AcmeClient.provision()` now handles the `tls-alpn-01` challenge,
including generating the certificate, instructing `AcmeSSLContext` to
use it, and providing a cleanup mechanism.
- **Configuration:**
- You can now specify preferred challenge types via the
`challengeTypes` attribute on the `<acme>` element in the XML
configuration (e.g., `challengeTypes="tls-alpn-01,http-01"`).
- `AcmeClient` will attempt challenges based on this preferred order.
- **Testing:**
- Added unit tests for certificate generation, `AlpnKeyManager`
(conceptual tests due to private inner class), end-to-end
`AcmeClient` provisioning flow for ALPN-01, and configuration parsing.
This allows you to leverage ALPN-01 for domain validation, which can
be particularly useful in environments where modifying HTTP request
handling for `http-01` is difficult, such as behind certain load
balancers or CDNs.
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
This pull request needs "/ok-to-test" from an authorized committer. |
|
/ok-to-test |
|
@t-burch this doesn't even compile... ;) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit introduces support for the ACME
tls-alpn-01challenge type, as specified in RFC 8737. This allows for domain validation by presenting a specific certificate during a TLS handshake using the ALPN extension.Key changes include:
tls-alpn-01as a recognized challenge type.AcmeClient.generateAlpnCertificate()to create the required self-signed certificate with asubjectAlternativeNameand a criticalacmeIdentifierextension containing the SHA-256 digest of the key authorization.AcmeSSLContextnow uses a customX509ExtendedKeyManager(AlpnKeyManager).acme-tls/1protocol is negotiated via ALPN and the SNI hostname matches a domain undergoing ALPN-01 validation.AcmeClientUpdate:AcmeClient.provision()now handles thetls-alpn-01challenge, including generating the certificate, instructingAcmeSSLContextto use it, and providing a cleanup mechanism.challengeTypesattribute on the<acme>element in the XML configuration (e.g.,challengeTypes="tls-alpn-01,http-01").AcmeClientwill attempt challenges based on this preferred order.AlpnKeyManager(conceptual tests due to private inner class), end-to-endAcmeClientprovisioning flow for ALPN-01, and configuration parsing.This allows you to leverage ALPN-01 for domain validation, which can be particularly useful in environments where modifying HTTP request handling for
http-01is difficult, such as behind certain load balancers or CDNs.