Hardcoded scheme in expectedURL at wfe.verifyPost() about pebble HOT 2 CLOSED

@marsangr That sounds good 👍. The URL scheme should be populated from the request protocol.

from pebble.

Hi @marsangr,

Revisiting this issue I realize what I thought would be an acceptable fix (populating the expectedURL.Scheme based on the request.Proto or request.TLS state) won't work for the scenario you describe where TLS is terminated by another daemon and Pebble remains running on HTTP.

I'd suggest just allowing for both schemes in the url parameter of the JWS header

I think this sort of flexibility is the wrong approach - we don't want requests authenticated by a client expecting it was talking to an HTTPS service to be replayable against the same endpoint on HTTP.

I think a better approach is to drop HTTP support and make Pebble operate on HTTPS by default. I've opened an issue (#63) for a simple implementation using MiniCA. I'm going to close this issue in favour of 63. Thanks!

from pebble.