{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/1224","labels_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1224/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1224/comments","events_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1224/events","html_url":"https://github.com/letsencrypt/boulder/pull/1224","id":120495551,"number":1224,"title":"Add support for Must-Staple / TLS-Feature","user":{"login":"bifurcation","id":75597,"avatar_url":"https://avatars.githubusercontent.com/u/75597?v=3","gravatar_id":"","url":"https://api.github.com/users/bifurcation","html_url":"https://github.com/bifurcation","followers_url":"https://api.github.com/users/bifurcation/followers","following_url":"https://api.github.com/users/bifurcation/following{/other_user}","gists_url":"https://api.github.com/users/bifurcation/gists{/gist_id}","starred_url":"https://api.github.com/users/bifurcation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bifurcation/subscriptions","organizations_url":"https://api.github.com/users/bifurcation/orgs","repos_url":"https://api.github.com/users/bifurcation/repos","events_url":"https://api.github.com/users/bifurcation/events{/privacy}","received_events_url":"https://api.github.com/users/bifurcation/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/needs-revision","name":"needs-revision","color":"5319e7"},{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/r?","name":"r?","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":26,"created_at":"2015-12-04T22:03:14Z","updated_at":"2016-01-25T22:57:00Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/letsencrypt/boulder/pulls/1224","html_url":"https://github.com/letsencrypt/boulder/pull/1224","diff_url":"https://github.com/letsencrypt/boulder/pull/1224.diff","patch_url":"https://github.com/letsencrypt/boulder/pull/1224.patch"},"body":"This PR updates the vendorized copy of CFSSL to the latest version, which allows calling code to request extensions.  It then inspects submitted CSRs to see if they request the TLS-Feature extension and if so, adds that extension to the request that is passed to CFSSL.\r\n\r\nObviously, we don't want to accept arbitrary extensions from clients.  CFSSL has a configuration option that whitelists extensions, so I think we should rely on that for filtering.  As it is now, extensions that boulder doesn't support are silently ignored; extensions supported by boulder but not turned on in CFSSL will result in an error.  For now, hard-coding TLS-Feature seems like an OK compromise, but we might want to revisit the config story here."},"comment":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/comments/174713863","html_url":"https://github.com/letsencrypt/boulder/pull/1224#issuecomment-174713863","issue_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1224","id":174713863,"user":{"login":"bifurcation","id":75597,"avatar_url":"https://avatars.githubusercontent.com/u/75597?v=3","gravatar_id":"","url":"https://api.github.com/users/bifurcation","html_url":"https://github.com/bifurcation","followers_url":"https://api.github.com/users/bifurcation/followers","following_url":"https://api.github.com/users/bifurcation/following{/other_user}","gists_url":"https://api.github.com/users/bifurcation/gists{/gist_id}","starred_url":"https://api.github.com/users/bifurcation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bifurcation/subscriptions","organizations_url":"https://api.github.com/users/bifurcation/orgs","repos_url":"https://api.github.com/users/bifurcation/repos","events_url":"https://api.github.com/users/bifurcation/events{/privacy}","received_events_url":"https://api.github.com/users/bifurcation/received_events","type":"User","site_admin":false},"created_at":"2016-01-25T22:57:00Z","updated_at":"2016-01-25T22:57:00Z","body":"Actually, as a compromise we could:\r\n* Ignore unknown extensions\r\n* Error on invalid TLS Feature extension value\r\n\r\nI wouldn't expect people to be using TLS Feature right now unless they know what they're doing, so it shouldn't cause surprising breakage if we just error in that case.\r\n\r\n@hlandau, @jsha, what say ye?"}}