We need to be able to provide contact information to use the
buypass.com acme api.
From Bartosz Kuzma (bartosz.kuzma AT release11.com), thanks!
OK beck, deraadt

Report what's wrong when account creation fails instead of a generic
http error.
OK beck

whitespace

Swap arguments of calloc(3).
While it doesn't matter for calloc, it's easier on the eyes to always
list the number of elements first and then the size.
From Donovan Watteau ( contrib AT dwatteau.fr),

Swap arguments of calloc(3).
While it doesn't matter for calloc, it's easier on the eyes to always
list the number of elements first and then the size.
From Donovan Watteau ( contrib AT dwatteau.fr), Thanks!

show more ...

In case the order fails print the human readable reason from the
challenge objects that the server hopefully provides.
input & OK deraadt
OK beck, benno

use the correct length to allocate the right amount, broken by previous.
noticed by Matthew Martin
ok deraadt

set array length after allocation succeeds so free path doesn't deref null.
ok deraadt

When the parser detects that it needs more tokens it returns
JSMN_ERROR_NOMEM.
We then need to allocate more tokens and call the parser with its
current state again. It will continue where it left of

When the parser detects that it needs more tokens it returns
JSMN_ERROR_NOMEM.
We then need to allocate more tokens and call the parser with its
current state again. It will continue where it left of.
For this to work we also need to pass in the old tokens from the
previous run and not just more space.

Found the hard way by Renaud Allard.
OK millert

show more ...

Implement elliptic curve account keys.
OK benno
Input & OK tb

Implement RFC 8555 "Automatic Certificate Management Environment
(ACME)" to be able to talk to the v02 Let's Encrypt API.

With this acme-client(1) will no longer be able to talk to the v01
API. User

Implement RFC 8555 "Automatic Certificate Management Environment
(ACME)" to be able to talk to the v02 Let's Encrypt API.

With this acme-client(1) will no longer be able to talk to the v01
API. Users must change the api url in /etc/acme-client.conf to
https://acme-v02.api.letsencrypt.org/directory
Existing accounts (and certs of course) stay valid and after the url
change acme-client will be able to renew certs.

Tested by Renaud Allard and benno
Input & OK benno

show more ...

make struct chng.status a enum for readability.
ok florian@

Deprecate agreement url config option and get the information from the
directory call. This way we don't need to update the acme-client.conf
file every time it changes. Still parse the option, ignore

Deprecate agreement url config option and get the information from the
directory call. This way we don't need to update the acme-client.conf
file every time it changes. Still parse the option, ignore and warn about
it for a release. Sysmerge should be able to handle the removal.
"nice" deraadt@
OK benno

show more ...

Make returns consistent and remove parentheses per style(9).

Transformed with coccinelle.

Requested by and ok tb@

Complete jsing's coccinelle cleanup... by hand
ok jsing

Replace comparisons between a constant or enum and an expression, with
a comparison between the expression and the constant or enum. This
significantly improves readability.

Transformed with coccine

Replace comparisons between a constant or enum and an expression, with
a comparison between the expression and the constant or enum. This
significantly improves readability.

Transformed with coccinelle.

Requested by deraadt@

show more ...

convert some ifs to switches. ok millert tb

A small amount more KNF to make this easier on our eyes. Not going further
than this.
ok florian

Inconsistant use of case (value): idiom drives me nuts, I have no idea
what purpose it was intended to serve.

we don't have config.h

whitespace

Import Kristaps' letskencrypt and call it acme-client in tree.
OK to get it in deraadt@ (and probably beck@)

At least deraadt@, beck@ and otto@ are fine with the name and the
disagreements stopped.