tls-sni-02: bad SAN-B calculation about pebble

[cpu]

Hi @shred, thanks for the bug report!

In va.go, the tls-sni-02 challenge's SAN-B is calculated by accessing task.Challenge.KeyAuthorization. However, that value seems to be empty there, so the calculated SAN-B is bad and the challenge fails.

Good catch - you're totally right. This field was for the client to provide a key authentication value in a challenge response to HTTP-01 challenges.

the challenge could be completed successfully. I'm not fluent with Go, so I don't know if this is an acceptable solution.

You were spot on :-) I submitted #22 to add this fix to both the SNI-02 and the DNS-01 challenge validation code.

(Background: I am the author of the Java client acme4j. I am preparing the client to be compliant with the latest ACME draft, and I'd like to use pebble for integration tests.)

That's great! I'm excited to hear that a client developer is using Pebble already. Please let us know if you have other issues/requests as you go. acme4j might be the very first draft-06 compliant client!

[shred]

I will let you know if #22 fixed the issue. But with my patch, I was already able to fetch a certificate from pebble via http-01 and tls-sni-02. I couldn't test dns-01 yet because I cannot run my DNS test server on a privileged port.