{"action":"created","issue":{"url":"https://api.github.com/repos/golang/go/issues/17053","repository_url":"https://api.github.com/repos/golang/go","labels_url":"https://api.github.com/repos/golang/go/issues/17053/labels{/name}","comments_url":"https://api.github.com/repos/golang/go/issues/17053/comments","events_url":"https://api.github.com/repos/golang/go/issues/17053/events","html_url":"https://github.com/golang/go/issues/17053","id":176199560,"number":17053,"title":"proposal: add ACME (LetsEncrypt, etc) support to net/http","user":{"login":"bradfitz","id":2621,"avatar_url":"https://avatars.githubusercontent.com/u/2621?v=3","gravatar_id":"","url":"https://api.github.com/users/bradfitz","html_url":"https://github.com/bradfitz","followers_url":"https://api.github.com/users/bradfitz/followers","following_url":"https://api.github.com/users/bradfitz/following{/other_user}","gists_url":"https://api.github.com/users/bradfitz/gists{/gist_id}","starred_url":"https://api.github.com/users/bradfitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradfitz/subscriptions","organizations_url":"https://api.github.com/users/bradfitz/orgs","repos_url":"https://api.github.com/users/bradfitz/repos","events_url":"https://api.github.com/users/bradfitz/events{/privacy}","received_events_url":"https://api.github.com/users/bradfitz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"bradfitz","id":2621,"avatar_url":"https://avatars.githubusercontent.com/u/2621?v=3","gravatar_id":"","url":"https://api.github.com/users/bradfitz","html_url":"https://github.com/bradfitz","followers_url":"https://api.github.com/users/bradfitz/followers","following_url":"https://api.github.com/users/bradfitz/following{/other_user}","gists_url":"https://api.github.com/users/bradfitz/gists{/gist_id}","starred_url":"https://api.github.com/users/bradfitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradfitz/subscriptions","organizations_url":"https://api.github.com/users/bradfitz/orgs","repos_url":"https://api.github.com/users/bradfitz/repos","events_url":"https://api.github.com/users/bradfitz/events{/privacy}","received_events_url":"https://api.github.com/users/bradfitz/received_events","type":"User","site_admin":false},"assignees":[{"login":"bradfitz","id":2621,"avatar_url":"https://avatars.githubusercontent.com/u/2621?v=3","gravatar_id":"","url":"https://api.github.com/users/bradfitz","html_url":"https://github.com/bradfitz","followers_url":"https://api.github.com/users/bradfitz/followers","following_url":"https://api.github.com/users/bradfitz/following{/other_user}","gists_url":"https://api.github.com/users/bradfitz/gists{/gist_id}","starred_url":"https://api.github.com/users/bradfitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradfitz/subscriptions","organizations_url":"https://api.github.com/users/bradfitz/orgs","repos_url":"https://api.github.com/users/bradfitz/repos","events_url":"https://api.github.com/users/bradfitz/events{/privacy}","received_events_url":"https://api.github.com/users/bradfitz/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/golang/go/milestones/30","html_url":"https://github.com/golang/go/milestones/Proposal","labels_url":"https://api.github.com/repos/golang/go/milestones/30/labels","id":1373555,"number":30,"title":"Proposal","description":"Proposals that are pending (not yet accepted/rejected).\r\n","creator":{"login":"rsc","id":104030,"avatar_url":"https://avatars.githubusercontent.com/u/104030?v=3","gravatar_id":"","url":"https://api.github.com/users/rsc","html_url":"https://github.com/rsc","followers_url":"https://api.github.com/users/rsc/followers","following_url":"https://api.github.com/users/rsc/following{/other_user}","gists_url":"https://api.github.com/users/rsc/gists{/gist_id}","starred_url":"https://api.github.com/users/rsc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rsc/subscriptions","organizations_url":"https://api.github.com/users/rsc/orgs","repos_url":"https://api.github.com/users/rsc/repos","events_url":"https://api.github.com/users/rsc/events{/privacy}","received_events_url":"https://api.github.com/users/rsc/received_events","type":"User","site_admin":false},"open_issues":58,"closed_issues":48,"state":"open","created_at":"2015-10-24T01:40:49Z","updated_at":"2016-09-10T19:58:16Z","due_on":null,"closed_at":null},"comments":26,"created_at":"2016-09-10T19:58:15Z","updated_at":"2016-09-10T21:17:04Z","closed_at":null,"body":"Thanks to @crhym3, we now have a suitably-licensed & CLA-clean ACME implementation in https://godoc.org/golang.org/x/crypto/acme (and a high-level package in https://godoc.org/golang.org/x/crypto/acme/autocert).\r\n\r\nI'd like to consider privately vendoring that into Go 1.8 and making HTTPS even easier.\r\n\r\nI'd like a complete user program with automatic HTTPS certs to look something like:\r\n\r\n```go\r\npackage main\r\n\r\nimport (\r\n\t\"log\"\r\n\t\"net/http\"\r\n)\r\n\r\nfunc main() {\r\n\thttp.HandleFunc(\"/\", websiteHandler)\r\n\tsrv := &http.Server{\r\n\t\tAddr:         \"example.com:443\",\r\n\t\tACMEServer:   http.LetsEncrypt, // non-empty enables autocert support\r\n\t\tACMEAgreeTOS: func(tosURL string) bool { return true },\r\n\t\tACMEEmail:    \"foo@bar.com\", // (but optional)\r\n\t}\r\n\tlog.Fatal(srv.ListenAndServeTLS(\"\", \"\"))\r\n}\r\n```\r\n\r\nMisc notes:\r\n\r\n* The `ACMEFoo` names are placeholders. Maybe they'd deserve their own struct.\r\n\r\n* `ACMEServer` would be required as the opt-in, and we wouldn't make LetsEncrypt be automatic or preferred, but we would add a constant `const LetsEncrypt = \"https://acme-v01.api.letsencrypt.org/directory\"` like the `acme` package has.\r\n\r\n* `ACMEAgreeTOS` would be required for now. The ACME protocol requires a TOS agreement because the CAB Forum requires cert issuers to have a legal relationship with the people getting certs or something. It's mostly a formality, but we shouldn't make it automatically say \"yes\" either, even though I don't think LetsEncrypt themselves care. Maybe we could export the https://godoc.org/golang.org/x/crypto/acme#AcceptTOS func in the `net/http` package to reduce the boilerplate.\r\n\r\n* `ACMEEmail` is optional. If provided, your ACME cert provider can keep you updated on problems or changes.\r\n\r\n* the default cache directory would be automatic. We could provide a string to let people pick an alternate directory. If you want to do something more complicated (e.g. cache coordination over a cluster), then you can just import the `golang.org/x/crypto/acme/autocert` package yourself. This is analogous to the HTTP/2 situation where common HTTP/2 is provided automatically, but weird uses require importing the guts.\r\n\r\n* `srv.ListenAndServeTLS(\"\", \"\")` is already valid for the past few releases, since 6a208efbdfa939dc236a63383df19c7ab44aa50a for #14268 requested by @willchan specifically for LetsEncrypt stuff. It's a little ugly but works. Maybe we could provide instead a new method or option which also listens on an cleartext port 80 and redirects HTTP to HTTPS, optionally with a HSTS header.\r\n\r\nMy goal is for HTTPS to be dead simple out of the box.\r\n\r\nThoughts?\r\n\r\n/cc @adg @broady @campoy @quentinmit @rsc @robpike @ianlancetaylor @mholt @crhym3\r\n"},"comment":{"url":"https://api.github.com/repos/golang/go/issues/comments/246140924","html_url":"https://github.com/golang/go/issues/17053#issuecomment-246140924","issue_url":"https://api.github.com/repos/golang/go/issues/17053","id":246140924,"user":{"login":"nhooyr","id":10180857,"avatar_url":"https://avatars.githubusercontent.com/u/10180857?v=3","gravatar_id":"","url":"https://api.github.com/users/nhooyr","html_url":"https://github.com/nhooyr","followers_url":"https://api.github.com/users/nhooyr/followers","following_url":"https://api.github.com/users/nhooyr/following{/other_user}","gists_url":"https://api.github.com/users/nhooyr/gists{/gist_id}","starred_url":"https://api.github.com/users/nhooyr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nhooyr/subscriptions","organizations_url":"https://api.github.com/users/nhooyr/orgs","repos_url":"https://api.github.com/users/nhooyr/repos","events_url":"https://api.github.com/users/nhooyr/events{/privacy}","received_events_url":"https://api.github.com/users/nhooyr/received_events","type":"User","site_admin":false},"created_at":"2016-09-10T21:17:04Z","updated_at":"2016-09-10T21:17:04Z","body":"@bradfitz \r\nWhy would we need a second public (free) CA for ACME? StartCom/StartSSL wants to use it for customers which according to your earlier comment means it wouldn't be included (and I agree). For anyone starting another public free ACME CA [this](http://neugierig.org/content/unix/) seems relevant."}}
{"actor":{"display_login":"nhooyr"}}