From e6b1200d11b062b0e525730044b7de555b7ed66d Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Wed, 13 Jun 2018 13:00:12 -0700 Subject: [PATCH] acme: fix encoding of the TLS-ALPN challenge extension To comply with the specification the value of the extension should be a ASN.1 OCTET STRING rather than a raw SHA 256 hash. This change uses asn1.Marshal to wrap the hash before putting it in the extension. Change-Id: I4ebe88a00238c6f928555d605e4b5dd98aad8128 Reviewed-on: https://go-review.googlesource.com/118696 Reviewed-by: Brad Fitzpatrick Run-TryBot: Brad Fitzpatrick TryBot-Result: Gobot Gobot --- acme/acme.go | 6 +++++- acme/acme_test.go | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/acme/acme.go b/acme/acme.go index 9fbe72c..8257ffb 100644 --- a/acme/acme.go +++ b/acme/acme.go @@ -598,10 +598,14 @@ func (c *Client) TLSALPN01ChallengeCert(token, domain string, opt ...CertOption) return tls.Certificate{}, err } shasum := sha256.Sum256([]byte(ka)) + extValue, err := asn1.Marshal(shasum[:]) + if err != nil { + return tls.Certificate{}, err + } acmeExtension := pkix.Extension{ Id: idPeACMEIdentifierV1, Critical: true, - Value: shasum[:], + Value: extValue, } tmpl := defaultTLSChallengeCertTemplate() diff --git a/acme/acme_test.go b/acme/acme_test.go index aa6ecaf..ef1fe47 100644 --- a/acme/acme_test.go +++ b/acme/acme_test.go @@ -1166,7 +1166,7 @@ func TestTLSALPN01ChallengeCert(t *testing.T) { token = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA" keyAuth = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA." + testKeyECThumbprint // echo -n | shasum -a 256 - h = "dbbd5eefe7b4d06eb9d1d9f5acb4c7cda27d320e4b30332f0b6cb441734ad7b0" + h = "0420dbbd5eefe7b4d06eb9d1d9f5acb4c7cda27d320e4b30332f0b6cb441734ad7b0" domain = "example.com" )