Merge pull request #104 from jgnagy/fix/cert-validity-constant

fix: replace undefined CERT_VALIDITY_DURATION constant with config call

Author: jgnagy

lib/bullion/helpers/acme.rb

@@ -174,7 +174,7 @@ def validate_order_nb_and_na(not_before, not_after)
         # don't allow nonsense certs
         raise Bullion::Acme::Errors::InvalidOrder unless nb < na
         # don't allow far-future certs
-        if nb > Time.now + (7 * 86_400) || na > Time.now + CERT_VALIDITY_DURATION
+        if nb > Time.now + (7 * 86_400) || na > Time.now + Bullion.config.ca.cert_validity_duration
           raise Bullion::Acme::Errors::InvalidOrder
         end
 

spec/bullion/services/ca_negative_spec.rb

@@ -360,6 +360,48 @@ def finalize_order(kid:, order_id:, csr:)
       end
     end
 
+    it "rejects orders with notAfter beyond the maximum validity duration" do
+      register_account
+      kid = last_response.headers["Location"]
+
+      get "/nonces"
+      nonce = last_response.headers["Replay-Nonce"]
+
+      jwk = {
+        typ: "JWT",
+        alg: "RS256",
+        kid:,
+        nonce:,
+        url: "/orders"
+      }.to_json
+      encoded_jwk = acme_base64(jwk)
+
+      now = Time.now
+      payload = {
+        identifiers: [{ "type" => "dns", "value" => "good.test.domain" }],
+        notBefore: (now + 86_400).iso8601,
+        notAfter: (now + (90 * 24 * 60 * 60) + 86_400).iso8601
+      }.to_json
+      encoded_payload = acme_base64(payload)
+      signature_data = "#{encoded_jwk}.#{encoded_payload}"
+
+      body = {
+        protected: encoded_jwk,
+        payload: encoded_payload,
+        signature: acme_sign(account_key, signature_data)
+      }.to_json
+
+      post "/orders", body, { "CONTENT_TYPE" => "application/jose+json" }
+
+      expect(last_response.status).to eq(400)
+      expect(last_response.headers["Content-Type"]).to \
+        eq("application/problem+json")
+
+      parsed_body = JSON.parse(last_response.body)
+      expect(parsed_body["type"]).to \
+        eq("urn:ietf:params:acme:error:invalidOrder")
+    end
+
     it "rejects finalization with CSR for wrong domain" do
       register_account
       kid = last_response.headers["Location"]