gen-certurl: Read SCT files from directory specified with -sctDir #259
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Instead of reading a serialized SignedCertificateTimestampList from a file, read all *.sct files in a directory given by the -sctDir flag and serialize them into SignedCertificateTimestampList. This matches the way how nginx-ct and Apache's mod_ssl_ct module work, and allows users to use existing SCT generation tools.
irori
commented
Jul 18, 2018
| # Fill in dummy data for OCSP/SCT, since the certificate is self-signed. | ||
| gen-certurl -pem cert.pem -ocsp <(echo ocsp) -sct <(echo sct) > cert.cbor | ||
| # Fill in dummy data for OCSP, since the certificate is self-signed. | ||
| gen-certurl -pem cert.pem -ocsp <(echo ocsp) > cert.cbor |
There was a problem hiding this comment.
I removed -sct here since SCT is not necessary for self-signed certs.
I plan to add a separate section for instructions to create signed exchanges with trusted certificates, and will explain the usage of -sctDir there.
nyaxt
requested changes
Jul 18, 2018
| # Fill in dummy data for OCSP/SCT, since the certificate is self-signed. | ||
| gen-certurl -pem cert.pem -ocsp <(echo ocsp) -sct <(echo sct) > cert.cbor | ||
| # Fill in dummy data for OCSP, since the certificate is self-signed. | ||
| gen-certurl -pem cert.pem -ocsp <(echo ocsp) > cert.cbor |
go/signedexchange/certurl/sct.go
Outdated
| } | ||
|
|
||
| var buf bytes.Buffer | ||
| buf.Grow(total_length + 2) // +2 for length |
go/signedexchange/certurl/sct.go
Outdated
|
|
||
| var buf bytes.Buffer | ||
| buf.Grow(total_length + 2) // +2 for length | ||
| binary.Write(&buf, binary.BigEndian, uint16(total_length)) |
There was a problem hiding this comment.
please catch err:
if err := binary.Write(...); err != nil {
panic(err) or return nil, err
}
There was a problem hiding this comment.
Done (here and elsewhere).
go/signedexchange/certurl/sct.go
Outdated
| buf.Grow(total_length + 2) // +2 for length | ||
| binary.Write(&buf, binary.BigEndian, uint16(total_length)) | ||
| for _, sct := range scts { | ||
| binary.Write(&buf, binary.BigEndian, uint16(len(sct))) |
go/signedexchange/certurl/sct.go
Outdated
| binary.Write(&buf, binary.BigEndian, uint16(total_length)) | ||
| for _, sct := range scts { | ||
| binary.Write(&buf, binary.BigEndian, uint16(len(sct))) | ||
| buf.Write(sct) |
nyaxt
approved these changes
Jul 18, 2018
aarongable
pushed a commit
to chromium/chromium
that referenced
this pull request
Jul 30, 2018
gen-certurl's -sct option is deprecated in WICG/webpackage#259. Bug: 803774 Change-Id: I4fbc575366aba978b262418d2cf415121e840099 Reviewed-on: https://chromium-review.googlesource.com/1154745 Commit-Queue: Kunihiko Sakamoto <ksakamoto@chromium.org> Reviewed-by: Kouhei Ueno <kouhei@chromium.org> Cr-Commit-Position: refs/heads/master@{#578999}
This was referenced Feb 27, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Instead of reading a serialized SignedCertificateTimestampList from a
file, read all
*.sctfiles in a directory given by the-sctDirflagand serialize them into SignedCertificateTimestampList.
This matches the way how nginx-ct and Apache's mod_ssl_ct module work,
and allows users to use existing SCT generation tools.