Index | Thread | Search

From:
Stuart Henderson <stu@spacehopper.org>
Subject:
NEW: security/pebble
To:
ports <ports@openbsd.org>
Cc:
Florian Obser <florian@narrans.de>
Date:
Mon, 9 Jun 2025 10:18:45 +0100

Download raw body.

Thread
here's a little port for Pebble, Let's Encrypt's minimal test CA software
intended for integration testing of clients etc.

ok to import?

(a couple of small notes; there are only a few deps so I just put them
in the main Makefile rather than a separate modules.inc; it is only for
tests and absolutely not for production use so I didn't include an rc
script).

---
Pebble is a small RFC 8555 ACME test server - it is not suited for a
production certificate authority, it is provided for testing operation
of other software. It has several top level goals:

- Provide a simplified ACME testing front end
- Provide a test-bed for new and compatibility breaking ACME features
- Encourage ACME client best-practices
- Aggressively build in guardrails against non-testing usage

Compared to Boulder (the much larger production CA software used by
Let's Encrypt), Pebble aims to make different choices in places where
the ACME specification allows customization/CA choice. For instance,
Pebble changes the path structures for its resources and directory
endpoints to differ from Boulder.

Where possible Pebble will make decisions that force clients to
implement ACME correctly (e.g. randomizing /directory endpoint URLs to
ensure clients are not hardcoding URLs.)

The goal is to emphasize client specification compatibility and to avoid
"over-fitting" on Boulder and the Let's Encrypt production service.
---