Filippo Valsorda 8f8078c97f acme/autocert: support both RSA and ECDSA clients on the fly ...

GetCertificate has all the information it needs to know if a client
supports ECDSA in ClientHelloInfo. Deprecate and ignore ForceRSA, and
just obtain a RSA certificate on the fly when a client that doesn't
support ECDSA connects.

This changes the cache key format to have a "+rsa" suffix for RSA
certificates. The default (ForceRSA = false) cache key is unchanged,
so most DirCache instances will still be valid. Caches created with
ForceRSA set will be silently ignored and certificates reissued.

The cache keys for HTTP tokens and the account key are changed to be
guaranteed not to overlap with valid domain names as well.

Note that ECDSA support detection is more strict in following RFC 5246
than crypto/tls, which ignores signature_algorithms.

Fixes golang/go#22066

Change-Id: I70227747b563d6849cb693f83a950d57040b3f39
Reviewed-on: https://go-review.googlesource.com/114501
Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

2018-06-06 00:31:03 +00:00

..

autocert

acme/autocert: support both RSA and ECDSA clients on the fly

2018-06-06 00:31:03 +00:00

acme_test.go

acme: clarify retries and backoff algorithm

2018-06-02 22:01:24 +00:00

acme.go

acme: clarify retries and backoff algorithm

2018-06-02 22:01:24 +00:00

http_test.go

acme: clarify retries and backoff algorithm

2018-06-02 22:01:24 +00:00

http.go

acme: clarify retries and backoff algorithm

2018-06-02 22:01:24 +00:00

jws_test.go

acme: generate correct ES512 signatures

2017-04-25 15:34:59 +00:00

jws.go

acme: generate correct ES512 signatures

2017-04-25 15:34:59 +00:00

types_test.go

acme: add function to check rate limits

2017-04-25 18:26:15 +00:00

types.go

acme: clarify retries and backoff algorithm

2018-06-02 22:01:24 +00:00