starred/dehydrated
1
0
Fork 0
mirror of https://github.com/dehydrated-io/dehydrated.git synced 2026-07-06 04:55:22 +02:00
Code Issues 79 Packages Projects Releases 10 Wiki Activity

extend ec algorithms with secp521r1 (not yet supported by LetsEncrypt, but maybe by other CAs)

Browse Source
This commit is contained in:
Lukas Schauer
2021-10-31 22:31:09 +01:00
parent 93573cda3c
commit f4cf92bae5
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dehydrated
+5 -2
View File
@@ -317,7 +317,7 @@ verify_config() {
if [[ "${CHALLENGETYPE}" = "http-01" && ! -d "${WELLKNOWN}" && ! "${COMMAND:-}" = "register" ]]; then if [[ "${CHALLENGETYPE}" = "http-01" && ! -d "${WELLKNOWN}" && ! "${COMMAND:-}" = "register" ]]; then
_exiterr "WELLKNOWN directory doesn't exist, please create ${WELLKNOWN} and set appropriate permissions." _exiterr "WELLKNOWN directory doesn't exist, please create ${WELLKNOWN} and set appropriate permissions."
fi fi
[[ "${KEY_ALGO}" == "rsa" || "${KEY_ALGO}" == "prime256v1" || "${KEY_ALGO}" == "secp384r1" ]] || _exiterr "Unknown public key algorithm ${KEY_ALGO}... cannot continue." [[ "${KEY_ALGO}" == "rsa" || "${KEY_ALGO}" == "prime256v1" || "${KEY_ALGO}" == "secp384r1" || "${KEY_ALGO}" == "secp521r1" ]] || _exiterr "Unknown public key algorithm ${KEY_ALGO}... cannot continue."
if [[ -n "${IP_VERSION}" ]]; then if [[ -n "${IP_VERSION}" ]]; then
[[ "${IP_VERSION}" = "4" || "${IP_VERSION}" = "6" ]] || _exiterr "Unknown IP version ${IP_VERSION}... cannot continue." [[ "${IP_VERSION}" = "4" || "${IP_VERSION}" = "6" ]] || _exiterr "Unknown IP version ${IP_VERSION}... cannot continue."
fi fi
@@ -615,7 +615,7 @@ init_system() {
tmp_account_key="$(_mktemp)" tmp_account_key="$(_mktemp)"
case "${ACCOUNT_KEY_ALGO}" in case "${ACCOUNT_KEY_ALGO}" in
rsa) _openssl genrsa -out "${tmp_account_key}" "${ACCOUNT_KEYSIZE}";; rsa) _openssl genrsa -out "${tmp_account_key}" "${ACCOUNT_KEYSIZE}";;
prime256v1|secp384r1) _openssl ecparam -genkey -name "${ACCOUNT_KEY_ALGO}" -out "${tmp_account_key}" -noout;; prime256v1|secp384r1|secp521r1) _openssl ecparam -genkey -name "${ACCOUNT_KEY_ALGO}" -out "${tmp_account_key}" -noout;;
esac esac
cat "${tmp_account_key}" > "${ACCOUNT_KEY}" cat "${tmp_account_key}" > "${ACCOUNT_KEY}"
rm "${tmp_account_key}" rm "${tmp_account_key}"
@@ -638,6 +638,8 @@ init_system() {
account_key_sigalgo="ES256" account_key_sigalgo="ES256"
elif [ "${curve}" = "P-384" ]; then elif [ "${curve}" = "P-384" ]; then
account_key_sigalgo="ES384" account_key_sigalgo="ES384"
elif [ "${curve}" = "P-521" ]; then
account_key_sigalgo="ES512"
else else
_exiterr "Unknown account key curve: ${curve}" _exiterr "Unknown account key curve: ${curve}"
fi fi
@@ -953,6 +955,7 @@ signed_request() {
case "${account_key_sigalgo}" in case "${account_key_sigalgo}" in
"ES256") siglen=64;; "ES256") siglen=64;;
"ES384") siglen=96;; "ES384") siglen=96;;
"ES512") siglen=132;;
esac esac
while [[ ${#dgst_parm_1} -lt $siglen ]]; do dgst_parm_1="0${dgst_parm_1}"; done while [[ ${#dgst_parm_1} -lt $siglen ]]; do dgst_parm_1="0${dgst_parm_1}"; done
while [[ ${#dgst_parm_2} -lt $siglen ]]; do dgst_parm_2="0${dgst_parm_2}"; done while [[ ${#dgst_parm_2} -lt $siglen ]]; do dgst_parm_2="0${dgst_parm_2}"; done