tls-sni-02: bad SAN-B calculation

[shred]

In va.go, the tls-sni-02 challenge's SAN-B is calculated by accessing task.Challenge.KeyAuthorization. However, that value seems to be empty there, so the calculated SAN-B is bad and the challenge fails.

After I replaced it with this code:

	// Compute the digest for the SAN B that will appear in the certificate
	expectedKeyAuthorization := task.Challenge.ExpectedKeyAuthorization(task.Registration.Key)
	hb := sha256.Sum256([]byte(expectedKeyAuthorization))
	zb := hex.EncodeToString(hb[:])
	sanBName := fmt.Sprintf("%s.%s.%s.%s", zb[:32], zb[32:], tlsSNIKaID, tlsSNISuffix)

the challenge could be completed successfully. I'm not fluent with Go, so I don't know if this is an acceptable solution.

dns-01 also accesses the task.Challenge.KeyAuthorization field, so I guess it would fail as well, but I couldn't test it.

(Background: I am the author of the Java client acme4j. I am preparing the client to be compliant with the latest ACME draft, and I'd like to use pebble for integration tests.)

[cpu]

Hi @shred, thanks for the bug report!

In va.go, the tls-sni-02 challenge's SAN-B is calculated by accessing task.Challenge.KeyAuthorization. However, that value seems to be empty there, so the calculated SAN-B is bad and the challenge fails.

Good catch - you're totally right. This field was for the client to provide a key authentication value in a challenge response to HTTP-01 challenges.

the challenge could be completed successfully. I'm not fluent with Go, so I don't know if this is an acceptable solution.

You were spot on :-) I submitted #22 to add this fix to both the SNI-02 and the DNS-01 challenge validation code.

(Background: I am the author of the Java client acme4j. I am preparing the client to be compliant with the latest ACME draft, and I'd like to use pebble for integration tests.)

That's great! I'm excited to hear that a client developer is using Pebble already. Please let us know if you have other issues/requests as you go. acme4j might be the very first draft-06 compliant client!

[shred]

I will let you know if #22 fixed the issue. But with my patch, I was already able to fetch a certificate from pebble via http-01 and tls-sni-02. I couldn't test dns-01 yet because I cannot run my DNS test server on a privileged port.