mirror of https://github.com/shred/acme4j
parent
ae96894c09
commit
544be26376
|
@ -19,12 +19,7 @@ import org.shredzone.acme4j.Session;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Implements the {@value TYPE} challenge.
|
* Implements the {@value TYPE} challenge.
|
||||||
*
|
|
||||||
* @deprecated Use {@link TlsSni02Challenge} if supported by the CA. This challenge will
|
|
||||||
* be removed when Let's Encrypt removes support for
|
|
||||||
* {@link TlsSni01Challenge}.
|
|
||||||
*/
|
*/
|
||||||
@Deprecated
|
|
||||||
public class TlsSni01Challenge extends TokenChallenge {
|
public class TlsSni01Challenge extends TokenChallenge {
|
||||||
private static final long serialVersionUID = 7370329525205430573L;
|
private static final long serialVersionUID = 7370329525205430573L;
|
||||||
|
|
||||||
|
|
|
@ -26,6 +26,7 @@ import org.shredzone.acme4j.challenge.Challenge;
|
||||||
import org.shredzone.acme4j.challenge.Dns01Challenge;
|
import org.shredzone.acme4j.challenge.Dns01Challenge;
|
||||||
import org.shredzone.acme4j.challenge.Http01Challenge;
|
import org.shredzone.acme4j.challenge.Http01Challenge;
|
||||||
import org.shredzone.acme4j.challenge.OutOfBand01Challenge;
|
import org.shredzone.acme4j.challenge.OutOfBand01Challenge;
|
||||||
|
import org.shredzone.acme4j.challenge.TlsSni01Challenge;
|
||||||
import org.shredzone.acme4j.challenge.TlsSni02Challenge;
|
import org.shredzone.acme4j.challenge.TlsSni02Challenge;
|
||||||
import org.shredzone.acme4j.connector.Connection;
|
import org.shredzone.acme4j.connector.Connection;
|
||||||
import org.shredzone.acme4j.connector.DefaultConnection;
|
import org.shredzone.acme4j.connector.DefaultConnection;
|
||||||
|
@ -62,12 +63,11 @@ public abstract class AbstractAcmeProvider implements AcmeProvider {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@SuppressWarnings("deprecation") // must still provide deprecated challenges
|
|
||||||
private static Map<String, Function<Session, Challenge>> challengeMap() {
|
private static Map<String, Function<Session, Challenge>> challengeMap() {
|
||||||
Map<String, Function<Session, Challenge>> map = new HashMap<>();
|
Map<String, Function<Session, Challenge>> map = new HashMap<>();
|
||||||
|
|
||||||
map.put(Dns01Challenge.TYPE, Dns01Challenge::new);
|
map.put(Dns01Challenge.TYPE, Dns01Challenge::new);
|
||||||
map.put(org.shredzone.acme4j.challenge.TlsSni01Challenge.TYPE, org.shredzone.acme4j.challenge.TlsSni01Challenge::new);
|
map.put(TlsSni01Challenge.TYPE, TlsSni01Challenge::new);
|
||||||
map.put(TlsSni02Challenge.TYPE, TlsSni02Challenge::new);
|
map.put(TlsSni02Challenge.TYPE, TlsSni02Challenge::new);
|
||||||
map.put(Http01Challenge.TYPE, Http01Challenge::new);
|
map.put(Http01Challenge.TYPE, Http01Challenge::new);
|
||||||
map.put(OutOfBand01Challenge.TYPE, OutOfBand01Challenge::new);
|
map.put(OutOfBand01Challenge.TYPE, OutOfBand01Challenge::new);
|
||||||
|
|
|
@ -30,7 +30,6 @@ import org.shredzone.acme4j.toolbox.TestUtils;
|
||||||
/**
|
/**
|
||||||
* Unit tests for {@link TlsSni01Challenge}.
|
* Unit tests for {@link TlsSni01Challenge}.
|
||||||
*/
|
*/
|
||||||
@SuppressWarnings("deprecation") // must test a deprecated challenge
|
|
||||||
public class TlsSni01ChallengeTest {
|
public class TlsSni01ChallengeTest {
|
||||||
private static final String KEY_AUTHORIZATION =
|
private static final String KEY_AUTHORIZATION =
|
||||||
"VNLBdSiZ3LppU2CRG8bilqlwq4DuApJMg3ZJowU6JhQ.HnWjTDnyqlCrm6tZ-6wX-TrEXgRdeNu9G71gqxSO6o0";
|
"VNLBdSiZ3LppU2CRG8bilqlwq4DuApJMg3ZJowU6JhQ.HnWjTDnyqlCrm6tZ-6wX-TrEXgRdeNu9G71gqxSO6o0";
|
||||||
|
|
|
@ -121,7 +121,6 @@ public class AbstractAcmeProviderTest {
|
||||||
* Test that challenges are generated properly.
|
* Test that challenges are generated properly.
|
||||||
*/
|
*/
|
||||||
@Test
|
@Test
|
||||||
@SuppressWarnings("deprecation") // must test deprecated challenges
|
|
||||||
public void testCreateChallenge() {
|
public void testCreateChallenge() {
|
||||||
Session session = mock(Session.class);
|
Session session = mock(Session.class);
|
||||||
|
|
||||||
|
|
|
@ -344,7 +344,6 @@ public class ClientTest {
|
||||||
* Domain name to be authorized
|
* Domain name to be authorized
|
||||||
* @return {@link Challenge} to verify
|
* @return {@link Challenge} to verify
|
||||||
*/
|
*/
|
||||||
@SuppressWarnings("deprecation") // until tls-sni-02 is supported
|
|
||||||
public Challenge tlsSniChallenge(Authorization auth, String domain) throws AcmeException {
|
public Challenge tlsSniChallenge(Authorization auth, String domain) throws AcmeException {
|
||||||
// Find a single tls-sni-01 challenge
|
// Find a single tls-sni-01 challenge
|
||||||
org.shredzone.acme4j.challenge.TlsSni01Challenge challenge = auth.findChallenge(org.shredzone.acme4j.challenge.TlsSni01Challenge.TYPE);
|
org.shredzone.acme4j.challenge.TlsSni01Challenge challenge = auth.findChallenge(org.shredzone.acme4j.challenge.TlsSni01Challenge.TYPE);
|
||||||
|
|
|
@ -177,10 +177,7 @@ public final class CertificateUtils {
|
||||||
* @param subject
|
* @param subject
|
||||||
* Subject to create a certificate for
|
* Subject to create a certificate for
|
||||||
* @return Created certificate
|
* @return Created certificate
|
||||||
* @deprecated Will be removed when
|
|
||||||
* {@link org.shredzone.acme4j.challenge.TlsSni01Challenge} is removed
|
|
||||||
*/
|
*/
|
||||||
@Deprecated
|
|
||||||
public static X509Certificate createTlsSniCertificate(KeyPair keypair, String subject) throws IOException {
|
public static X509Certificate createTlsSniCertificate(KeyPair keypair, String subject) throws IOException {
|
||||||
return createCertificate(keypair, subject);
|
return createCertificate(keypair, subject);
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
# tls-sni-01 Challenge
|
# tls-sni-01 Challenge
|
||||||
|
|
||||||
> **DEPRECATED:** According to the ACME specifications, this challenge will be replaced by [tls-sni-02](./tls-sni-02.html). However, _Let's Encrypt_ does not currently support `tls-sni-02`. For the time being, _acme4j_ supports both challenges. To be on the safe side, request both challenges and process the one that is returned.
|
> **NOTE:** In ACMEv2, this challenge is going to be replaced by [tls-sni-02](./tls-sni-02.html). However, the _Let's Encrypt_ ACMEv1 server is still offering this challenge as the only TLS-SNI based challenge. To be on the safe side, request both challenges and process the one that is returned.
|
||||||
|
|
||||||
With the `tls-sni-01` challenge, you prove to the CA that you are able to control the web server of the domain to be authorized, by letting it respond to a SNI request with a specific self-signed cert.
|
With the `tls-sni-01` challenge, you prove to the CA that you are able to control the web server of the domain to be authorized, by letting it respond to a SNI request with a specific self-signed cert.
|
||||||
|
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
# tls-sni-02 Challenge
|
# tls-sni-02 Challenge
|
||||||
|
|
||||||
> **NOTE:** According to the ACME specifications, this challenge will replace [tls-sni-01](./tls-sni-01.html). However, _Let's Encrypt_ does not currently support `tls-sni-02`. For the time being, _acme4j_ supports both challenges. To be on the safe side, request both challenges and process the one that is returned.
|
> **NOTE:** According to the ACME specifications, this challenge will replace [tls-sni-01](./tls-sni-01.html). However, _Let's Encrypt_ does not currently support `tls-sni-02`. To be on the safe side, request both challenges and process the one that is returned.
|
||||||
|
|
||||||
With the `tls-sni-02` challenge, you prove to the CA that you are able to control the web server of the domain to be authorized, by letting it respond to a SNI request with a specific self-signed cert.
|
With the `tls-sni-02` challenge, you prove to the CA that you are able to control the web server of the domain to be authorized, by letting it respond to a SNI request with a specific self-signed cert.
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue