Index | Thread | Search

From:
Florian Obser <florian@openbsd.org>
Subject:
Re: NEW: security/pebble
To:
ports <ports@openbsd.org>
Date:
Tue, 10 Jun 2025 16:22:52 +0200

Download raw body.

Thread
works for me with acme-client.

OK florian fwiw


On 2025-06-09 10:18 +01, Stuart Henderson <stu@spacehopper.org> wrote:
> here's a little port for Pebble, Let's Encrypt's minimal test CA software
> intended for integration testing of clients etc.
>
> ok to import?
>
> (a couple of small notes; there are only a few deps so I just put them
> in the main Makefile rather than a separate modules.inc; it is only for
> tests and absolutely not for production use so I didn't include an rc
> script).
>
> ---
> Pebble is a small RFC 8555 ACME test server - it is not suited for a
> production certificate authority, it is provided for testing operation
> of other software. It has several top level goals:
>
> - Provide a simplified ACME testing front end
> - Provide a test-bed for new and compatibility breaking ACME features
> - Encourage ACME client best-practices
> - Aggressively build in guardrails against non-testing usage
>
> Compared to Boulder (the much larger production CA software used by
> Let's Encrypt), Pebble aims to make different choices in places where
> the ACME specification allows customization/CA choice. For instance,
> Pebble changes the path structures for its resources and directory
> endpoints to differ from Boulder.
>
> Where possible Pebble will make decisions that force clients to
> implement ACME correctly (e.g. randomizing /directory endpoint URLs to
> ensure clients are not hardcoding URLs.)
>
> The goal is to emphasize client specification compatibility and to avoid
> "over-fitting" on Boulder and the Let's Encrypt production service.
> ---
>
>

-- 
In my defence, I have been left unsupervised.