Project

General

Profile

Actions
Copy link

Feature #8613

closed

pfSense-pkg-acme: acme_certificates_edit.php - Add support for --challenge-alias acme.sh flag

Added by Kage - almost 6 years ago. Updated almost 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
ACME
Target version:
-
Start date:
07/02/2018
Due date:
% Done:

0%

Estimated time:
Plus Target Version:

Description

User Story

As a pfSense-pkg-acme user
I want to be able to use the --challenge-alias flag
So that I can use CNAME aliasing of my _acme-challenge subdomain.

Description

As described in references 1 and 2 below, acme.sh supports using DNS aliases (CNAME redirection of the _acme-challenge subdomain), but it requires adding the --challenge-alias flag to the acme.sh call to supply the required Le_ChallengeAlias parameter to the ACME server. Currently there is no way to enable this, thus aliased DNS-01 challenges fail.

Suggested Implementation

acme_certificates_edit.php:

  • Add a checkbox for "Enable DNS alias mode", linking to reference 2 below. For example, after line 382 (end of OCSP Stapling code):
    $section->addInput(new \Form_Checkbox(
    'challengealias',
    'Enable DNS alias mode',
    'Add the --challenge-alias flag to the acme.sh call.',
    $pconfig['challengealias']
))->setHelp('More information can be found <a href="https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode" target="_new">here</a>.');

acme_sh.inc:

  • Add a class variable such as public $challengealias;
  • In function signCertificate(..), add after line 156 code block (starts with if ($this->ocspstaple == "yes") {):
            if ($this->challengealias == "yes") {
            $cmdparameters .= " --challenge-alias ";
        }

acme.inc:

  • In function issue_certificate(..), add after line 973 (after $acmesh->ocspstaple ...):
    $acmesh->challengealias = $certificate['challengealias'];

References

  1. http://strugglers.net/~andy/blog/2018/03/19/lets-encrypt-wildcard-certificates-acme-sh-and-automated-dns-verification/
  2. https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
Actions
Copy link

Also available in: Atom PDF