Add "TLS Feature" Extension to ACME cert template

[logopk]

Hi,

how would I add this x509Extension for "OCSP must staple" to my leaf-template?

Adding

"extensions": [{"id": "TLS Feature", "value": "status_request"}]

leads to an error on acme.sh

 authority.Sign: error unmarshaling certificate: error unmarshaling json: TLS Feature is not an ASN1 object identifier"

Apparently it differs from

    "crlDistributionPoints": "http://<url>/step.crl.pem",
    "ocspServer": "http://<url>",

Is this even possibel?

Thanks

[tashian]

I think based on this blog post you could try something like:

"extensions": [{"id": "1.3.6.1.5.5.7.1.24", "value": "MAMCAQU="}]

The ID is the OID for OCSP must staple.
The value is base64 encoded ASN.1 DER for the RFC7633 Features module. I'm not sure if I got that value right, but the DER (from the blog post) is 30:03:02:01:05.

[logopk]

That works! Great!

Is there a way to trigger this using acme.sh --ocsp-must-staple?

Right now I have duplicated the provisioner and template. One with the extension (acme-ocsp) and one without (acme).
can I get this into one template and use if then else ?

[maraino]

If the CSR has a special extension you can configure the template to add the extension.

[logopk]

Oh, I see. it contains exactly this extension! Interesting: --ocsp-must-staple triggers no special request param but adds to the CSR!

1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05

How would I set this in the template? Mind to help me? Thank you!

[maraino]

I got it working with something like this:

{
	"subject": {{ toJson .Subject }},
	"sans": {{ toJson .SANs }},
{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
	"keyUsage": ["keyEncipherment", "digitalSignature"],
{{- else }}
	"keyUsage": ["digitalSignature"],
{{- end }}
	"extKeyUsage": ["serverAuth", "clientAuth"]
{{- range .Insecure.CR.Extensions }}
	{{- if toJson .ID | eq "\"1.3.6.1.5.5.7.1.24\"" }}
	, "extensions": [
		{"id": "1.3.6.1.5.5.7.1.24", "value": "MAMCAQU=" }
	]
	{{- end }}
{{- end }}
}

But it's more complex that it should be if we improve how the CSR is encoded.

[logopk]

Perfect! It works!

Thank you for your always quick and helpful responses 👏🏼👍🏼