letsencrypt / letsencrypt/boulder
Confirm profile Issuer URL returns correct issuer
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
Making web queries is something we don't like to do during linting, so we don't actually check that the certificate served by the AIA Issuer URL corresponds to the key which is about to (for pre-issuance linting) or just did (for post-issuance linting) issue the new certificate.
However, we could query the Issuer URL during system startup. And we could query the URL as part of linting with the ceremony tool. Both of those are maybes: the CA and the Ceremony hosts don't usually have unrestricted internet access.
Let's think about this, and other ways to continually audit that our Issuer URLs are correct.
Inspired by https://bugzilla.mozilla.org/show_bug.cgi?id=1568356
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by locating the Issuer URL handling and certificate issuance or linting paths in the Boulder codebase, then review how startup and ceremony-tool checks could access those URLs. Done should mean a defined, continually auditable way to confirm that each Issuer URL serves the correct issuer certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100