From 2307c38b59c6bc8f1e3dae4748a17d7943f4009f Mon Sep 17 00:00:00 2001 From: =?utf8?q?Fabian=20Gr=C3=BCnbichler?= Date: Fri, 8 Oct 2021 10:18:21 +0200 Subject: [PATCH] support downloading alternate chains MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit the current default chains end with an expired root certificate for maximum compatibility with old Android versions. this breaks some other older clients (openssl, gnutls) which don't expect chains to contain any expired certificates, even if they are 'above' the trust anchor. by setting $root, it is possible to specify which root the ACME provided certificate chain should end with, downloading alternate chains as necessary. Signed-off-by: Fabian Grünbichler Reviewed-by: Stoiko Ivanov Tested-by: Stoiko Ivanov --- src/PVE/ACME.pm | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm index 265482d..57578d7 100644 --- a/src/PVE/ACME.pm +++ b/src/PVE/ACME.pm @@ -442,17 +442,50 @@ sub deactivate_authorization { # Get certificate # GET-as-POST to order's certificate URL +# if $root is specified, attempts to find a matching (alternate) chain # Expects a '200 OK' reply # returns certificate chain in PEM format sub get_certificate { - my ($self, $order) = @_; + my ($self, $order, $root) = @_; $self->fatal("no certificate URL available (yet?)", $order) if !$order->{certificate}; + my $check_root = sub { + my ($chain) = @_; + + my @certs = PVE::Certificate::split_pem($chain); + my $root_pem = $certs[-1]; + + my ($file, $fh) = PVE::Tools::tempfile_contents($root_pem); + my $info = PVE::Certificate::get_certificate_info($file); + + return defined($info->{issuer}) && $info->{issuer} =~ m/\Q$root\E/i; + }; + my $r = $self->do(POST => $order->{certificate}, ''); my $return = eval { + # default chain my $res = __get_result($r, 200, 1); + if ($root && !$check_root->($res)) { + # alternate chains if requested and default didn't match + $res = undef; + my @links = $r->header('link'); + for my $link (@links) { + if ($link =~ /^<(.*)>;rel="alternate"$/) { + my $url = $1; + my $chain = eval { __get_result($self->do(POST => $url, ''), 200, 1); }; + die "failed to retrieve alternate chain from '$url' - $@\n" if $@; + if ($check_root->($chain)) { + $res = $chain; + last; + } + } + } + die "no matching alternate chain for '$root' returned by server\n" + if !defined($res); + } + if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint return $1 . $2 . $3; } -- 2.39.2