letsencrypt / pebble / 1695

8%

push

travis-ci

WIP: Adds external account binding support (#288)

Signed-off-by: JoshVanL <vleeuwenjoshua@gmail.com>

This PR adds basic support for External Account Binding (EAB) as defined in the
[ACME protocol](https://tools.ietf.org/html/rfc8555#section-7.3.4).

The pebble config takes an extra argument `requireExternalBinding` which will
require new account ACME request to contain the `externalAccountBinding` object
to be present. Pebble will then verify the contents of the object as per the
spec.

The Pebble config takes an optional object of `externalAccountBindings`
containing a string map to 
KIDs to MAC symmetric keys. These are stored statically in memory.

An extra config example has been made to show both options available
(test/config/pebble-config-external-account-bindings.json).

This has been tested using https://github.com/go-acme/lego. The following
command will successfully create a new account with Pebble using one of the keys
defined in the example config.

```
lego --server https://localhost:14000/dir --domains foo.com  --email \
  joshua.vanleeuwen@jetstack.io --http --kid kid-1 --hmac \
  zWNDZM6eQGHWpSRTPal5eIUYFTu7EajVIoguysqZ9wG44nMEtx3MUAsUDkMTQ12W --eab run
```

**The keys in the example config are public and should never be used in
production**

5 of 5 new or added lines in 1 file covered. (100.0%)

0 of 70 relevant lines covered (0.0%)

0.0 hits per line