According to draft-05, the "kid" JWK protected header field must always be used, except on new-reg and revoke-cert. The "kid" field must contain the account URL that was returned by new-account.
When setting the "kid" header to a valid account URL, pebble does not seem to be able to locate the account: Account http://localhost:14000/my-reg/a838...2ca6 not found.
When I only set the account hash a838...2ca6 as "kid", pebble crashes with a nil pointer dereference.
There seem to be two issues with wfe.go's verifyPOST():
- when "kid" contains a valid account URL,
wfe.db.GetRegistrationByID(keyID) is unable to find the account, but it should.
- when "kid" only contains the account hash,
wfe.db.GetRegistrationByID(keyID) finds the account. However, it then leaves the pubkey variable unset, which leads to a nil pointer dereference a few lines below.
The only way to make pebble work at the moment is to provide the "jwk" field all the time.
According to draft-05, the "kid" JWK protected header field must always be used, except on
new-regandrevoke-cert. The "kid" field must contain the account URL that was returned bynew-account.When setting the "kid" header to a valid account URL, pebble does not seem to be able to locate the account:
Account http://localhost:14000/my-reg/a838...2ca6 not found.When I only set the account hash
a838...2ca6as "kid", pebble crashes with a nil pointer dereference.There seem to be two issues with wfe.go's
verifyPOST():wfe.db.GetRegistrationByID(keyID)is unable to find the account, but it should.wfe.db.GetRegistrationByID(keyID)finds the account. However, it then leaves thepubkeyvariable unset, which leads to a nil pointer dereference a few lines below.The only way to make pebble work at the moment is to provide the "jwk" field all the time.