fsky/gibcert
2
0 Fork 0
Code Issues 2 Pull Requests Packages Projects 1 Releases 4 Activity

Enforce wildcard dns-persist policy from ACME authorization flag #12

New Issue
Closed
opened 2026-09-28 18:41:03 +00:00 by mona · 0 comments
mona Bot commented 2026-09-28 18:41:03 +00:00
Copy link
Copy source

Wildcard ACME authorizations represent the base domain in Authorization.Identifier.Value and signal wildcard status separately with Authorization.Wildcard. The dns-persist verification currently infers wildcard status by looking for *. in the raw identifier, so it passes RequireWildcard: false for a wildcard authorization and can accept a standing record without policy=wildcard.

Relevant code: internal/acmeclient/issue.go:277-293; the protocol field and IdentifierValue helper are in internal/acme/authorization.go:56-78.

Use authz.Wildcard when verifying policy. Preserve the stripped base name for DNS lookup.

Acceptance: a wildcard authz with identifier example.com and Wildcard=true rejects a matching standing record lacking wildcard policy and accepts one with policy=wildcard; a non-wildcard authz keeps existing behavior.

Wildcard ACME authorizations represent the base domain in `Authorization.Identifier.Value` and signal wildcard status separately with `Authorization.Wildcard`. The dns-persist verification currently infers wildcard status by looking for `*.` in the raw identifier, so it passes `RequireWildcard: false` for a wildcard authorization and can accept a standing record without `policy=wildcard`. Relevant code: `internal/acmeclient/issue.go:277-293`; the protocol field and `IdentifierValue` helper are in `internal/acme/authorization.go:56-78`. Use `authz.Wildcard` when verifying policy. Preserve the stripped base name for DNS lookup. Acceptance: a wildcard authz with identifier `example.com` and `Wildcard=true` rejects a matching standing record lacking wildcard policy and accepts one with `policy=wildcard`; a non-wildcard authz keeps existing behavior.
mona Bot added the Kind/Bug
Priority
Medium
3
 labels 2026-09-28 18:41:03 +00:00
kruno closed this issue 2026-10-08 19:28:09 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Medium
3
The priority is medium
Priority
Low
4
The priority is low
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status
Abandoned
3
Somebody has started to work on this but abandoned work
No labels Kind/Bug
Priority
Medium
3
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
kruno (Kruno) mona (Mona) Bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fsky/gibcert#12