Package: csr-proxy
CSR ProxyCSR Proxy is a simple service to sign the clients' CSR via the ACME server.Documentation:https://docs.gufolabs.com/csr_proxy/Source Code:https://github.com/gufolabs/csr_proxy/The self-signed certificates are no longer sufficient, posing challenges in distributing trial and evaluation versions of software with web interfaces. To address this, software publishers typically consider the following options:Delegate Certificate Signing to the User:Pros: Gives control to advanced users.Cons: Requires user knowledge of PKI, complex infrastructure, or additional expenses.Generate Self-Signed Certificate with mkcert:Pros: Suitable for developers.Cons: Compromises system security, demands browser reloading, and adds complexity.Order a Certificate from Global CA:Pros: Secure, but expensive.Cons: Violates TLS security principles by exposing the private key.Uselocalhost.directCertificate or Similar Services:Pros: Similar to the previous approach.Cons: Public exposure of the public key.Order Separate Certificates for Each User:Pros: Secure but time-consuming and costly.Cons: Mutual trust issue; the publisher generates and knows the client's private key.Generate Client's Key and Certificate via ACME Server:Pros: Less expensive.Cons: Mutual trust issue persists; the publisher generates and knows the client's private key.Negotiate with ACME Server from Client's Site:Pros: Reliable, but requires additional infrastructure setup.Cons: Suitable for advanced users, not the default choice.Considering the need for mutual trust and simplicity in software evaluation,
the publisher should generate a private certificate on the user's side without touching it.
The published also needs to maintain all necessary infrastructure for the certificate signing.
Enter the CSR Proxy.CSR Proxy OverviewThe CSR Proxy is a straightforward service executed on the publisher's side. It:Receives the Certificate Signing Request (CSR) from the client.Proxies the CSR to the ACME server for signing.Handles ACME challenge fulfillment, shielding the end user from complexity.The sequence diagram is shown below. The primal parties are:Client: An entity demanding the certificate signing.CSR Proxy: The certificate signing service, consists of two parts:API: The client-facing API, performing ACME interaction on behalf of the client. Also performs DNS provisioning.DNS: PowerDNS service, providing a provisioning interface to API and serving DNS requests.ACME: Any RFC-8555 compatible ACME server, like Let's Encrypt.sequenceDiagram
    participant Client
    box CSR Proxy
    participant API
    participant DNS
    end
    participant ACME
    Client->>Client: Generate private RSA key
    Client->>Client: Create CSR
    Client->>API: CSR sign request
    activate API
    API->>ACME: New order
    activate ACME
    ACME->>API: Order authorization
    deactivate ACME
    API->>ACME: Get challenges
    activate ACME
    ACME->>API: Challenges
    deactivate ACME
    API->>DNS: Put _acme-challenges RR
    activate DNS
    DNS->>API: RR is ready
    deactivate DNS
    API->>ACME: Respond dns-01 challenge
    activate ACME
    ACME->>API: Status
    ACME->>DNS: Query _acme-challenge RR
    activate DNS
    DNS->>ACME: _acme-challenge RR
    deactivate DNS
    API->>ACME: Check autorization
    ACME->>API: Authorization status
    API->>ACME: Finalize
    ACME->>API: Order status    
    deactivate ACME
    API->>Client: Signed certificate
    deactivate APIOn Gufo StackThis product is a part ofGufo Stack- the collaborative effort
led byGufo Labs. Our goal is to create a robust and flexible
set of tools to create network management software and automate
routine administration tasks.To do this, we extract the key technologies that have proven themselves
in theNOCand bring them as separate packages. Then we work on API,
performance tuning, documentation, and testing. TheNOCuses the final result
as the external dependencies.Gufo Stackmakes theNOCbetter, and this is our primary task. But other products
can benefit fromGufo Stacktoo. So we believe that our effort will make
the other network management products better.