Implement latest draft-ietf-acme-ari spec

[pgporada]

The draft spec version at the time of this PR was draft-ietf-acme-ari-03, but failed replacement order handling is from the yet-to-be-released draft-ietf-acme-ari-04.

• Add a renewalInfo entry to the directory object which provides the base URL for ARI requests.
• Add a new WFE handlefunc which parses incoming requests and returns reasonable renewalInfo for determining when the client should attempt renewal of a certificate.
• Add support for marking orders as replaced. Replacement orders can be chained, but there can be no duplicate replacement of orders, just like boulder.
• Restructured the asynchronous finalization anonymous go func to handle storing replaced orders. To be replaced, an order must previously have been finalized and have an issued certificate.

Fixes #403

[pgporada]

I've got a fork of eggsampler/acme that I've been working against. To test that against this branch:

# In the pebble dir
$ tmux

# Run challtestsrv, version doesn't particularly matter because we're not touching this code
$ docker rm challtestsrv 2>&1; docker run -p 5001:5001 -p 5002:5002 -p 5003:5003 -p 8053:8053 -p 8055:8055 -p 8443:8443 --name challtestsrv ghcr.io/letsencrypt/pebble-challtestsrv:latest

# Get the IP of that container
$ CHALLTESTSRV=$(docker inspect challtestsrv | jq -r '.[].NetworkSettings.Networks.bridge.IPAddress')

# Run pebble
$ go run cmd/pebble/main.go -config ./test/config/pebble-config.json -dnsserver ${CHALLTESTSRV}:8053

-----------------------------
# In the eggsampler repo
$ export PEBBLE_PATH=/path/to/pebble/on/your/computer
$ go test -test.run TestClient_IssueReplacementCert

[pgporada]

Replacement orders are now supported

Pebble 2024/05/14 16:36:21 Order "6it4fspAVD-CNbSI06L4iPf9l29mNpL6rkQi-XnICBo" is not a replacement
Pebble 2024/05/14 16:36:21 There are now 1 orders in the db
Pebble 2024/05/14 16:36:28 Order "4gw9BYS8UnmQnymq8HnxSQA8hOs5le0SkB34Ux1cfDQ" is a replacement of "6it4fspAVD-CNbSI06L4iPf9l29mNpL6rkQi-XnICBo"
Pebble 2024/05/14 16:36:28 There are now 2 orders in the db
Pebble 2024/05/14 16:37:11 Order "vOKNgiDK8aoTvYWC8Q6GJp49UYK-iGPD34vBDEwhnTs" is not a replacement
Pebble 2024/05/14 16:37:11 There are now 3 orders in the db
Pebble 2024/05/14 16:37:20 Order "s7mJpikMeEy8OL57wlwB54_kakew2g6ns6nit8VWuKQ" is a replacement of "vOKNgiDK8aoTvYWC8Q6GJp49UYK-iGPD34vBDEwhnTs"
Pebble 2024/05/14 16:37:20 There are now 4 orders in the db

[pgporada]

There's a race condition in wfe.FinalizeOrder at existingOrder := wfe.db.GetOrderByID(orderID) causing an error during manual testing with my eggsample/acme fork.

=== RUN   TestClient_IssueReplacementCert
    ari_test.go:66: Issuing initial order
    ari_test.go:73: Issuing first replacement order
    ari_test.go:80: Issuing second replacement order
    ari_test.go:83: unexpected error: acme: error code 403 "urn:ietf:params:acme:error:orderNotReady": Order's status ("pending") was not ready

vs

=== RUN   TestClient_IssueReplacementCert
    ari_test.go:66: Issuing initial order
    ari_test.go:73: Issuing first replacement order
    ari_test.go:80: Issuing second replacement order
    ari_test.go:87: Should not be able to create a duplicate replacement
--- PASS: TestClient_IssueReplacementCert (19.05s)
PASS

EDIT: This whole entire detour was actually an implementation bug in my eggsampler fork. 🤦🏼

[beautifulentropy]

Thanks for taking the time to get this added to Pebble!

Some nits regarding contexts that we're dropping, but nothing that means we can't merge. I think these are just some contexts params from the Boulder implementation which aren't necessary in the Pebble implementation?

[orangepizza]

it's sad that this mission latest release by just a day 😢

[pgporada]

We'll make a new release soon.

…

On Sat, May 25, 2024, 7:10 AM orangepizza ***@***.***> wrote: it's sad that this mission latest release by just a day 😢 — Reply to this email directly, view it on GitHub <#461 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AASFVZLU66RJQX3LJ6TGHWTZEBWQ7AVCNFSM6AAAAABHEL4TVWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZRGIYTOMBVGE> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>