pebble

pebble copied to clipboard

Render `expired` on Authorizations when they are expired

1

This is a partial fix to #303 I am not sure if this is the correct place or way (does it persist?) to implement this. I would not be offended...

jvanasco

Changing these percentages can simplify creating test suites where certain tests exercise authorization reuse or nonce error handling.

mbaynton

We need to port the specification fix from https://github.com/letsencrypt/boulder/pull/5916 to Pebble. Specifically, that the certificate presented during the "acme-tls/1" handshake has "a subjectAltName extension containing the dNSName being validated and...

jcjones

Proposal: Add /etc/nsswitch.conf to image to enable usage of /etc/hosts file

1

As Go ignores `/etc/hosts` if no `/etc/nsswitch.conf` is present, name resolution using the hosts file is impossible. To make matters worse, the Go binary of pebble seems to read those...

Schrottfresse

We've stopped using Travis for Boulder; working with two different systems between these two repos is needlessly confusing. Let's switch Pebble to use GHA too.

aarongable

Does not work on macOS

2

With the same configuration file, Pebble behaves differently on Linux and on macOS. Specifically, on macOS, Pebble does not: - Set the OCSP responder URL - Has different root issuer...

aral

It would help to know that we’re running the latest version of Pebble (and to compare versions of Pebble on different machines), if it had a version string. e.g., ```shell...

aral

JWS url calculation can't handle absoluteURI form Request-URIs

2

https://tools.ietf.org/html/rfc2616#section-5.1.2 >To allow for transition to absoluteURIs in all requests in future versions of HTTP, all HTTP/1.1 servers MUST accept the absoluteURI form in requests, even though HTTP/1.1 clients will...

alexzorin

CN maxlength vs. empty CN vs. boulder

3

I added a test in ```mod_md``` for domain names longer than 63 octets. I see different behaviour between pebble and boulder. This is not an issue per se, I can...

icing

The current behavior of Boulder and Letsencrypt is to offer alternate chain support. I believe this should therefore be the default behavior of this project.

jvanasco