{"action":"created","issue":{"url":"https://api.github.com/repos/xenolf/lego/issues/569","repository_url":"https://api.github.com/repos/xenolf/lego","labels_url":"https://api.github.com/repos/xenolf/lego/issues/569/labels{/name}","comments_url":"https://api.github.com/repos/xenolf/lego/issues/569/comments","events_url":"https://api.github.com/repos/xenolf/lego/issues/569/events","html_url":"https://github.com/xenolf/lego/issues/569","id":329876871,"node_id":"MDU6SXNzdWUzMjk4NzY4NzE=","number":569,"title":"Allow non-standard CA for validating ACME server HTTPS in development","user":{"login":"cpu","id":292650,"node_id":"MDQ6VXNlcjI5MjY1MA==","avatar_url":"https://avatars1.githubusercontent.com/u/292650?v=4","gravatar_id":"","url":"https://api.github.com/users/cpu","html_url":"https://github.com/cpu","followers_url":"https://api.github.com/users/cpu/followers","following_url":"https://api.github.com/users/cpu/following{/other_user}","gists_url":"https://api.github.com/users/cpu/gists{/gist_id}","starred_url":"https://api.github.com/users/cpu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpu/subscriptions","organizations_url":"https://api.github.com/users/cpu/orgs","repos_url":"https://api.github.com/users/cpu/repos","events_url":"https://api.github.com/users/cpu/events{/privacy}","received_events_url":"https://api.github.com/users/cpu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-06-06T13:51:15Z","updated_at":"2018-06-06T16:56:52Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Hi folks :wave:,\r\n\r\nIt would be wonderful if Lego was able to easily interact with a [Pebble](https://github.com/letsencrypt/pebble) instance. This is my own preferred way to debug issues with an ACME client and it may prove useful for integration testing now that Lego has the required ACME v2 support. \r\n\r\nThe only stumbling block that I'm aware of is that Lego doesn't facilitate interacting with an ACME server that has a HTTPS certificate from a CA that isn't part of the system trust store. This _can_ be worked around by adding the Pebble CA certificate to the system's CA trust store but we [specifically recommend against this](https://github.com/letsencrypt/pebble#avoiding-client-https-errors) because it can easily compromise the security of a developer's system if done carelessly or forgotten about.\r\n\r\nWould you be interested in a feature to specify a non-standard CA certificate via command line flag or an environment variable? For instance, Certbot can be made to trust the Pebble CA by using the `REQUESTS_CA_BUNDLE` env var.\r\n\r\nIt seems like the challenge is primarily in piping a `*x509.CertPool` populated with the provided non-standard CA to the `*http.Transport` instance that is used by the Lego `*http.Client` here:\r\n\r\nhttps://github.com/xenolf/lego/blob/7fedfd1388f016c7ca7ed92a7f2024d06a7e20d8/acme/http.go#L18-L30\r\n\r\nI'd be willing to submit a PR to do the work required but wanted to touch base first to see if the feature was interesting to you and whether there were recommendations on how you would like to see the `*x509.CertPool` propagated forward.\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/xenolf/lego/issues/comments/395140091","html_url":"https://github.com/xenolf/lego/issues/569#issuecomment-395140091","issue_url":"https://api.github.com/repos/xenolf/lego/issues/569","id":395140091,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NTE0MDA5MQ==","user":{"login":"cpu","id":292650,"node_id":"MDQ6VXNlcjI5MjY1MA==","avatar_url":"https://avatars1.githubusercontent.com/u/292650?v=4","gravatar_id":"","url":"https://api.github.com/users/cpu","html_url":"https://github.com/cpu","followers_url":"https://api.github.com/users/cpu/followers","following_url":"https://api.github.com/users/cpu/following{/other_user}","gists_url":"https://api.github.com/users/cpu/gists{/gist_id}","starred_url":"https://api.github.com/users/cpu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpu/subscriptions","organizations_url":"https://api.github.com/users/cpu/orgs","repos_url":"https://api.github.com/users/cpu/repos","events_url":"https://api.github.com/users/cpu/events{/privacy}","received_events_url":"https://api.github.com/users/cpu/received_events","type":"User","site_admin":false},"created_at":"2018-06-06T16:56:52Z","updated_at":"2018-06-06T16:56:52Z","author_association":"CONTRIBUTOR","body":"> I think the option with using an environment variable to override this would make sense as its only used for debugging and not for normal operation.\r\n\r\nGreat. I'll see about submitting a PR in the coming days."}}
{"actor":{"display_login":"cpu"}}