ca: Pass OCSP Must-Staple from CSR into generated certificate (#436)

Fixes #433

ca/ca.go

@@ -1,6 +1,7 @@
 package ca
 
 import (
+	"bytes"
 	"crypto"
 	"crypto/rand"
 	"crypto/rsa"
@@ -252,7 +253,7 @@ func (ca *CAImpl) newChain(intermediateKey crypto.Signer, intermediateSubject pk
 	return c
 }
 
-func (ca *CAImpl) newCertificate(domains []string, ips []net.IP, key crypto.PublicKey, accountID, notBefore, notAfter string) (*core.Certificate, error) {
+func (ca *CAImpl) newCertificate(domains []string, ips []net.IP, key crypto.PublicKey, accountID, notBefore, notAfter string, extensions []pkix.Extension) (*core.Certificate, error) {
 	if len(domains) == 0 && len(ips) == 0 {
 		return nil, errors.New("must specify at least one domain name or IP address")
 	}
@@ -299,6 +300,7 @@ func (ca *CAImpl) newCertificate(domains []string, ips []net.IP, key crypto.Publ
 		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 		SubjectKeyId:          subjectKeyID,
+		ExtraExtensions:       extensions,
 		BasicConstraintsValid: true,
 		IsCA:                  false,
 	}
@@ -373,6 +375,22 @@ func New(log *log.Logger, db *db.MemoryStore, ocspResponderURL string, alternate
 	return ca
 }
 
+var ocspMustStapleExt = pkix.Extension{
+	Id:    asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 24},
+	Value: []byte{0x30, 0x03, 0x02, 0x01, 0x05},
+}
+
+// Returns whether the given extensions array contains an OCSP Must-Staple
+// extension.
+func extensionsContainsOCSPMustStaple(extensions []pkix.Extension) bool {
+	for _, ext := range extensions {
+		if ext.Id.Equal(ocspMustStapleExt.Id) && bytes.Equal(ext.Value, ocspMustStapleExt.Value) {
+			return true
+		}
+	}
+	return false
+}
+
 func (ca *CAImpl) CompleteOrder(order *core.Order) {
 	// Lock the order for reading
 	order.RLock()
@@ -397,9 +415,17 @@ func (ca *CAImpl) CompleteOrder(order *core.Order) {
 		authz.RUnlock()
 	}
 
+	// Build a list of approved extensions to include in the certificate
+	var extensions []pkix.Extension
+	if extensionsContainsOCSPMustStaple(order.ParsedCSR.Extensions) {
+		// If the user requested an OCSP Must-Staple extension, use our
+		// pre-baked one to ensure a reasonable value for Critical
+		extensions = append(extensions, ocspMustStapleExt)
+	}
+
 	// issue a certificate for the csr
 	csr := order.ParsedCSR
-	cert, err := ca.newCertificate(csr.DNSNames, csr.IPAddresses, csr.PublicKey, order.AccountID, order.NotBefore, order.NotAfter)
+	cert, err := ca.newCertificate(csr.DNSNames, csr.IPAddresses, csr.PublicKey, order.AccountID, order.NotBefore, order.NotAfter, extensions)
 	if err != nil {
 		ca.log.Printf("Error: unable to issue order: %s", err.Error())
 		return

ca/ca_test.go

@@ -0,0 +1,138 @@
+package ca
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"log"
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/letsencrypt/pebble/v2/acme"
+	"github.com/letsencrypt/pebble/v2/core"
+	"github.com/letsencrypt/pebble/v2/db"
+)
+
+var (
+	ocspID    = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 24}
+	ocspValue = []byte{0x30, 0x03, 0x02, 0x01, 0x05}
+)
+
+func makeCa() *CAImpl {
+	logger := log.New(os.Stdout, "Pebble ", log.LstdFlags)
+	db := db.NewMemoryStore()
+	return New(logger, db, "", 0, 1, 0)
+}
+
+func makeCertOrderWithExtensions(extensions []pkix.Extension) core.Order {
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		panic(err)
+	}
+	csr := x509.CertificateRequest{
+		DNSNames:    []string{"fake.domain"},
+		IPAddresses: []net.IP{[]byte{192, 0, 2, 1}},
+		PublicKey:   &privateKey.PublicKey,
+		Extensions:  extensions,
+	}
+	return core.Order{
+		ID:              "randomstring",
+		AccountID:       "accountid",
+		ParsedCSR:       &csr,
+		BeganProcessing: true,
+		Order: acme.Order{
+			Status:      acme.StatusPending,
+			Expires:     time.Now().AddDate(0, 0, 1).UTC().Format(time.RFC3339),
+			Identifiers: []acme.Identifier{},
+			NotBefore:   time.Now().UTC().Format(time.RFC3339),
+			NotAfter:    time.Now().AddDate(30, 0, 0).UTC().Format(time.RFC3339),
+		},
+		ExpiresDate: time.Now().AddDate(0, 0, 1).UTC(),
+	}
+}
+
+func getOCSPMustStapleExtension(cert *x509.Certificate) *pkix.Extension {
+	for _, ext := range cert.Extensions {
+		if ext.Id.Equal(ocspID) && bytes.Equal(ext.Value, ocspValue) {
+			return &ext
+		}
+	}
+	return nil
+}
+
+func TestNoExtensions(t *testing.T) {
+	ca := makeCa()
+	order := makeCertOrderWithExtensions([]pkix.Extension{})
+	ca.CompleteOrder(&order)
+	foundOCSPExtension := getOCSPMustStapleExtension(order.CertificateObject.Cert)
+	if foundOCSPExtension != nil {
+		t.Error("Expected no OCSP Must-Staple extension in complete cert, but found one")
+	}
+}
+
+func TestSettingOCSPMustStapleExtension(t *testing.T) {
+	// Base case
+	ca := makeCa()
+	order := makeCertOrderWithExtensions([]pkix.Extension{
+		{
+			Id:       ocspID,
+			Critical: false,
+			Value:    ocspValue,
+		},
+	})
+	ca.CompleteOrder(&order)
+	foundOCSPExtension := getOCSPMustStapleExtension(order.CertificateObject.Cert)
+	if foundOCSPExtension == nil {
+		t.Error("Expected OCSP Must-Staple extension in complete cert, but didn't find it")
+	} else if foundOCSPExtension.Critical {
+		t.Error("Expected foundOCSPExtension.Critical to be false, but it was true")
+	}
+
+	// Test w/ improperly set Critical value
+	ca = makeCa()
+	order = makeCertOrderWithExtensions([]pkix.Extension{
+		{
+			Id:       ocspID,
+			Critical: true,
+			Value:    ocspValue,
+		},
+	})
+	ca.CompleteOrder(&order)
+	foundOCSPExtension = getOCSPMustStapleExtension(order.CertificateObject.Cert)
+	if foundOCSPExtension == nil {
+		t.Error("Expected OCSP Must-Staple extension in complete cert, but didn't find it")
+	} else if foundOCSPExtension.Critical {
+		t.Error("Expected foundOCSPExtension.Critical to be false, but it was true")
+	}
+
+	// Test w/ duplicate extensions
+	ca = makeCa()
+	order = makeCertOrderWithExtensions([]pkix.Extension{
+		{
+			Id:       ocspID,
+			Critical: true,
+			Value:    ocspValue,
+		},
+		{
+			Id:       ocspID,
+			Critical: true,
+			Value:    ocspValue,
+		},
+	})
+	ca.CompleteOrder(&order)
+	numOCSPMustStapleExtensions := 0
+	for _, ext := range order.CertificateObject.Cert.Extensions {
+		if ext.Id.Equal(ocspID) && bytes.Equal(ext.Value, ocspValue) {
+			numOCSPMustStapleExtensions++
+		}
+	}
+	if numOCSPMustStapleExtensions != 1 {
+		t.Errorf("Expected exactly 1 OCSP Must-Staple extension, found %d", numOCSPMustStapleExtensions)
+	}
+}