eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
808 Commits 11 Branches 57 Tags
release-branch.go1.13
Commit Graph
3 Commits
Author SHA1 Message Date
Aofei Sheng f8560614ba acme/autocert: make host of TLS certificate to be obtained always Punycode 
According to the [RFC 5280, section 4.2.1.6](https://tools.ietf.org/html/rfc5280#section-4.2.1.6):

> ...
> When the subjectAltName extension contains a domain name system
> label, the domain name MUST be stored in the dNSName (an IA5String).
> The name MUST be in the "preferred name syntax", as specified by
> Section 3.5 of [RFC1034] and as modified by Section 2.1 of
> [RFC1123].  Note that while uppercase and lowercase letters are
> allowed in domain names, no significance is attached to the case.
> ...

And the [RFC 1034, section 3.5](https://tools.ietf.org/html/rfc1034#section-3.5):

> ...
> Note that while upper and lower case letters are allowed in domain
> names, no significance is attached to the case.  That is, two names with
> the same spelling but different case are to be treated as if identical.
> ...

We should return the same TLS certificate for both `example.com` and `EXAMPLE.COM`. But the `autocert.Manager.GetCertificate` treats the two as totally different, it signs and returns two different TLS certificates.

Moreover, now the `autocert.Manager.GetCertificate` and the `autocert.HostWhitelist` can only handle Punycode IDN. If the client sends a Unicode IDN to `autocert.Manager.GetCertificate` (cURL is doing this), the "Invalid character in DNS name" error will be triggered.

This PR corrects these problems by converting the host of the TLS certificate to be obtained to Punycode via `idna.Lookup.ToASCII`.

Change-Id: I993821b3a6ae532a53772e2db00524479ef111af
GitHub-Last-Rev: 6c12694574b6ac71a920da8a8bdb130c0b6e0272
GitHub-Pull-Request: golang/crypto#85
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/171997
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2019-04-22 17:19:13 +00:00
Brad Fitzpatrick 8e1b8d32e6 crypto: update go.mod for s390x x/sys/cpu changes 
To fix broken builds like:
https://build.golang.org/log/4c3d8463f5c2b2478dc2315f6c685b2f77bfcdd1

Change-Id: I4c4866e5928a73856ca8a411ed97588e6f66e490
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/170623
Reviewed-by: Michael Munday <mike.munday@ibm.com>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2019-04-03 20:25:08 +00:00
Michael Matloob 215aa809ca all: add a go.mod file 
This change adds a go.mod and go.sum file to this repo, following the
requirements stated in bcmills's comment here:
https://golang.org/issue/28136#issuecomment-462971974. It's
important to note that we will not be
adding versions to the repo for now.

The change was generated by running "go mod init" and "go mod tidy" using Go
1.11.5 in the top-level directory of the repository.

Updates golang/go#28136

Change-Id: I17b2ac9eaae028a172a5adc260cffba5e0997619
Reviewed-on: https://go-review.googlesource.com/c/162911
Run-TryBot: Michael Matloob <matloob@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Andrew Bonventre <andybons@golang.org>
 2019-02-27 17:51:34 +00:00