X Tutup
Skip to content

Commit 910dde9

Browse files
aarongableaarongable
authored
Clean up goodkey configs (letsencrypt#5993)
Fixes letsencrypt#5851
1 parent 3f26ac0 commit 910dde9

File tree

8 files changed

+18
-47
lines changed

8 files changed

+18
-47
lines changed

‎cmd/boulder-ca/main.go‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -62,14 +62,6 @@ type Config struct {
6262
// GoodKey is an embedded config stanza for the goodkey library.
6363
GoodKey goodkey.Config
6464

65-
// WeakKeyFile is DEPRECATED. Populate GoodKey.WeakKeyFile instead.
66-
// TODO(#5851): Remove this.
67-
WeakKeyFile string
68-
69-
// WeakKeyFile is DEPRECATED. Populate GoodKey.BlockedKeyFile instead.
70-
// TODO(#5851): Remove this.
71-
BlockedKeyFile string
72-
7365
// Path to directory holding orphan queue files, if not provided an orphan queue
7466
// is not used.
7567
OrphanQueueDir string
@@ -211,13 +203,6 @@ func main() {
211203
cmd.FailOnError(err, "Failed to load credentials and create gRPC connection to SA")
212204
sa := sapb.NewStorageAuthorityClient(conn)
213205

214-
// TODO(#5851): Remove these fallbacks when the old config keys are gone.
215-
if c.CA.GoodKey.WeakKeyFile == "" && c.CA.WeakKeyFile != "" {
216-
c.CA.GoodKey.WeakKeyFile = c.CA.WeakKeyFile
217-
}
218-
if c.CA.GoodKey.BlockedKeyFile == "" && c.CA.BlockedKeyFile != "" {
219-
c.CA.GoodKey.BlockedKeyFile = c.CA.BlockedKeyFile
220-
}
221206
kp, err := goodkey.NewKeyPolicy(&c.CA.GoodKey, sa.KeyBlocked)
222207
cmd.FailOnError(err, "Unable to create key policy")
223208

‎cmd/boulder-ra/main.go‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -65,14 +65,6 @@ type Config struct {
6565
// GoodKey is an embedded config stanza for the goodkey library.
6666
GoodKey goodkey.Config
6767

68-
// WeakKeyFile is DEPRECATED. Populate GoodKey.WeakKeyFile instead.
69-
// TODO(#5851): Remove this.
70-
WeakKeyFile string
71-
72-
// WeakKeyFile is DEPRECATED. Populate GoodKey.BlockedKeyFile instead.
73-
// TODO(#5851): Remove this.
74-
BlockedKeyFile string
75-
7668
OrderLifetime cmd.ConfigDuration
7769

7870
// CTLogGroups contains groupings of CT logs which we want SCTs from.
@@ -229,13 +221,6 @@ func main() {
229221
}
230222
pendingAuthorizationLifetime := time.Duration(c.RA.PendingAuthorizationLifetimeDays) * 24 * time.Hour
231223

232-
// TODO(#5851): Remove these fallbacks when the old config keys are gone.
233-
if c.RA.GoodKey.WeakKeyFile == "" && c.RA.WeakKeyFile != "" {
234-
c.RA.GoodKey.WeakKeyFile = c.RA.WeakKeyFile
235-
}
236-
if c.RA.GoodKey.BlockedKeyFile == "" && c.RA.BlockedKeyFile != "" {
237-
c.RA.GoodKey.BlockedKeyFile = c.RA.BlockedKeyFile
238-
}
239224
kp, err := goodkey.NewKeyPolicy(&c.RA.GoodKey, sac.KeyBlocked)
240225
cmd.FailOnError(err, "Unable to create key policy")
241226

‎cmd/boulder-wfe2/main.go‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -105,10 +105,6 @@ type Config struct {
105105
// GoodKey is an embedded config stanza for the goodkey library.
106106
GoodKey goodkey.Config
107107

108-
// WeakKeyFile is DEPRECATED. Populate GoodKey.BlockedKeyFile instead.
109-
// TODO(#5851): Remove this.
110-
BlockedKeyFile string
111-
112108
// StaleTimeout determines how old should data be to be accessed via Boulder-specific GET-able APIs
113109
StaleTimeout cmd.ConfigDuration
114110

@@ -394,11 +390,6 @@ func main() {
394390

395391
rac, sac, rns, npm := setupWFE(c, logger, stats, clk)
396392

397-
// TODO(#5851): Remove these fallbacks when the old config keys are gone.
398-
// The WFE does not do weak key checking, just blocked key checking.
399-
if c.WFE.GoodKey.BlockedKeyFile == "" && c.WFE.BlockedKeyFile != "" {
400-
c.WFE.GoodKey.BlockedKeyFile = c.WFE.BlockedKeyFile
401-
}
402393
kp, err := goodkey.NewKeyPolicy(&c.WFE.GoodKey, sac.KeyBlocked)
403394
cmd.FailOnError(err, "Unable to create key policy")
404395

‎cmd/cert-checker/main.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -389,7 +389,6 @@ func main() {
389389
// Validate PA config and set defaults if needed.
390390
cmd.FailOnError(config.PA.CheckChallenges(), "Invalid PA configuration")
391391

392-
// TODO(#5851): Remove these fallbacks when the old config keys are gone.
393392
if config.CertChecker.GoodKey.WeakKeyFile != "" {
394393
cmd.Fail("cert-checker does not support checking against weak key files")
395394
}

‎test/config/ca-a.json‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,11 @@
8484
"serialPrefix": 255,
8585
"maxNames": 100,
8686
"lifespanOCSP": "96h",
87-
"weakKeyFile": "test/example-weak-keys.json",
88-
"blockedKeyFile": "test/example-blocked-keys.yaml",
87+
"goodkey": {
88+
"weakKeyFile": "test/example-weak-keys.json",
89+
"blockedKeyFile": "test/example-blocked-keys.yaml",
90+
"fermatRounds": 100
91+
},
8992
"orphanQueueDir": "/tmp/orphaned-certificates-a",
9093
"ocspLogMaxLength": 4000,
9194
"ocspLogPeriod": "500ms",

‎test/config/ca-b.json‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,11 @@
8484
"serialPrefix": 255,
8585
"maxNames": 100,
8686
"lifespanOCSP": "96h",
87-
"weakKeyFile": "test/example-weak-keys.json",
88-
"blockedKeyFile": "test/example-blocked-keys.yaml",
87+
"goodkey": {
88+
"weakKeyFile": "test/example-weak-keys.json",
89+
"blockedKeyFile": "test/example-blocked-keys.yaml",
90+
"fermatRounds": 100
91+
},
8992
"orphanQueueDir": "/tmp/orphaned-certificates-b",
9093
"ocspLogMaxLength": 4000,
9194
"ocspLogPeriod": "500ms",

‎test/config/ra.json‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,11 @@
88
"reuseValidAuthz": true,
99
"authorizationLifetimeDays": 30,
1010
"pendingAuthorizationLifetimeDays": 7,
11-
"weakKeyFile": "test/example-weak-keys.json",
12-
"blockedKeyFile": "test/example-blocked-keys.yaml",
11+
"goodkey": {
12+
"weakKeyFile": "test/example-weak-keys.json",
13+
"blockedKeyFile": "test/example-blocked-keys.yaml",
14+
"fermatRounds": 100
15+
},
1316
"orderLifetime": "168h",
1417
"issuerCertPath": "/hierarchy/intermediate-cert-rsa-a.pem",
1518
"tls": {

‎test/config/wfe2.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@
1111
"directoryCAAIdentity": "happy-hacker-ca.invalid",
1212
"directoryWebsite": "https://github.com/letsencrypt/boulder",
1313
"legacyKeyIDPrefix": "http://boulder:4000/reg/",
14-
"blockedKeyFile": "test/example-blocked-keys.yaml",
14+
"goodkey": {
15+
"blockedKeyFile": "test/example-blocked-keys.yaml"
16+
},
1517
"tls": {
1618
"caCertFile": "test/grpc-creds/minica.pem",
1719
"certFile": "test/grpc-creds/wfe.boulder/cert.pem",

0 commit comments

Comments
 (0)
X Tutup