> Am 15.05.2016 um 18:56 schrieb Kristaps Dzonsons <krist...@bsd.lv>: > > A few days ago, there was a thread regarding letsencrypt clients and > their, um, cavalier approach to security. Since I like my free certs > and I like automation, and I also like not worrying about being owned, I > reckoned I could do better than mystery-meat clients. > > https://github.com/kristapsdz/letskencrypt > > This isolates the steps of refreshing a certificate into isolated > processes, each of which is priv-dropped, chrooted, pledged, etc. The > manpage says it all: > > https://github.com/kristapsdz/letskencrypt/blob/master/letskencrypt.1 > > It's obviously brand-new, but it works and I thought I'd see if > anybody's interested in looking over the libcrypto bits--if not the > approach in general. The stuff that has manpages I think I get, but > there's some (e.g., X509v3 extension handling, properly seeding RAND, > calling XXXX_free if the ptr is NULL, memory management, ...) that's > undocumented and is just shot in the dark. Moreover, the answers > offered on OpenSSL mailing lists seem... questionable. > > It's designed to run on OpenBSD but works crappily on Mac OS X and > Linux. Crappily because both are hostile to good security practises. > I'm not going to put any extra effort into these for compatibility.
I think you already added a lot of compatibility goo. Might have been better if you started with a clean OpenBSD only client. > (Side note: this requires the patch to json-c posted 09/05/2015 to the > ports list. Or is there a better json parser in C?) This one looks promising: http://zserge.bitbucket.org/jsmn.html > Thoughts? Letsencrypt experts? > > Best, > > Kristaps
