letsencrypt / pebble / 36477763631

9%

master: 8%

push

github

Normalize the serial in NewCertID so ARI replaces lookups match (#556)

When a certificate's serial starts with a byte >= 0x80, ACME clients put
an extra `00` in front of it in the ARI certID. That's correct, since
RFC 9773 asks for the DER integer bytes. But Pebble stores issued
certificates under the serial without that `00`, so a new order with
`replaces` for one of those certificates can't find the original and
fails with a 500. This happens for about 1 in 256 certificates.

The fix builds the certID's lookup key from the parsed number instead of
the raw bytes, so both forms give the same key. This is the same way the
certificate is stored in `ca.go`, and the renewalInfo endpoint already
looks things up this way.

Fixes https://github.com/letsencrypt/pebble/issues/550

3 of 3 new or added lines in 1 file covered. (100.0%)

442 of 4664 relevant lines covered (9.48%)

1.71 hits per line