bullion 0.12.0 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff6022efee880f75147cc1a4ce9a25dd9525075002c20f3c2be0c917a550d167
-  data.tar.gz: 114a84d226ef0e2c613be0b6e80f33fe73b379ee20016291baca59662beac094
+  metadata.gz: 9cef665959a8cadbb7227013c2680c914772f9f61a33c230fd405f0d9f0a414a
+  data.tar.gz: 106020f0549902f1f3966270a4ba9cfc135935ccc9fe1969dd6671a9dcb91738
 SHA512:
-  metadata.gz: a82cec86d1143c61349ad216337646ef80e12c0a6d1b03af48bce0b0608db08b0edabe8d012b8375c9603a6a721c09d190551994549ac269b56c13406333cadd
-  data.tar.gz: 423cc0b9ea94aa2c28076d860bd58502af1383065e6eecf3db1e19b5d00b3a7f8756f0c09b7c839c3b36128563264f58a2e4176ada4051127f73bd58f3757db7
+  metadata.gz: ec17f3d4a94faf7215513fcdb871f0f6fbc92fc2cf149f41b373bcd125a87889cd014d00fee9534fe75aa4f82aa50745fd82eebbd6a7b0f6cacabeb454ec32a3
+  data.tar.gz: d7366593b009bfe773fcdb7eb8ce20b862ee08c5633081249f3c5ad8d559a5dec3809440983eea6fd98e3ec7645eacf12d3380cc5784c5d80e81ed1263974075

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.12.1](https://github.com/jgnagy/bullion/compare/bullion/v0.12.0...bullion/v0.12.1) (2026-11-02)
+
+
+### Bug Fixes
+
+* accept the full RFC 8555 revocation set, add problem docs (ghostex-d76.1) ([e68c9a1](https://github.com/jgnagy/bullion/commit/e68c9a12f17e0655b2a8d9587fd78550df9cc7ab))
+* bound ACME nonce minting and expire stale nonces (ghostex-d76.3) ([3938285](https://github.com/jgnagy/bullion/commit/3938285d6dc9b6c91cbd6d9aff5a9729a3cf0760))
+* bump trilogy to 2.13.2 for GHSA-744p-w4gc-m3gh (ghostex-d76.7) ([4b3c657](https://github.com/jgnagy/bullion/commit/4b3c657c9eda1a4348f6f1d6aeeb4327269c80ba))
+* emit full-width EC JWK coordinates; 400 on malformed EC points (ghostex-d76.4) ([2e98fed](https://github.com/jgnagy/bullion/commit/2e98fed5a227a77548426d797a444c207f0ae58c))
+* emit full-width EC JWK coordinates; return 400 malformed on invalid EC points (ghostex-d76.4) ([b23dfd1](https://github.com/jgnagy/bullion/commit/b23dfd1a7219ed6fc7137369ed4370ad57d42223))
+* enforce account ownership across ACME by-ID resources (ghostex-d76.1) ([0dfd9b2](https://github.com/jgnagy/bullion/commit/0dfd9b2f74567a051b55c767f6681c4b441eba57))
+* enforce authorization and order expiration (ghostex-d76.6) ([c909fc9](https://github.com/jgnagy/bullion/commit/c909fc96d5f97856bd1e2117dcd7bd1b993eee9a))
+* fail closed when CA_SECRET is unset outside development/test (ghostex-d76.2) ([f203327](https://github.com/jgnagy/bullion/commit/f2033274f83f7e2de43c20accea0259694cf39f1))
+* mint 64-bit certificate serials (ghostex-d76.3) ([db594c6](https://github.com/jgnagy/bullion/commit/db594c6075b42e6521f827094a9c28ad4015c44d))
+* sanitize unhandled errors for ACME clients (ghostex-d76.3) ([c382457](https://github.com/jgnagy/bullion/commit/c3824577186dcbc7f9e4eb0572571659df288ecd))
+
 ## [0.12.0](https://github.com/jgnagy/bullion/compare/bullion/v0.11.6...bullion/v0.12.0) (2026-10-24)
 
 

data/README.md

@@ -24,7 +24,7 @@ The goal of the Bullion project is to make running a scalable, internal ACMEv2 C
 
 Before running Bullion, you need a CA key pair. Bullion requires two PEM files:
 
-- **`tls.key`** — An encrypted private key (RSA, ECDSA, or EdDSA) for signing certificates. Bullion supports encrypted PEM keys using AES-128-CBC.
+- **`tls.key`** — An encrypted private key (RSA, ECDSA, or EdDSA) for signing certificates. Bullion supports encrypted PEM keys using AES-128-CBC. The key must be encrypted with the passphrase given in `CA_SECRET` (see [CA Secret](#ca-secret)).
 - **`tls.crt`** — The corresponding public certificate. If Bullion is an intermediate CA, include the root CA's certificate in this file as well (certificate chain order: intermediate first, then root).
 
 You can generate these with OpenSSL. For example, a self-signed root CA:
@@ -155,12 +155,12 @@ Whether run locally or via Docker, the following environment variables configure
 | Environment Variable | Default Value | Description |
 | --- | --- | --- |
 | `CA_DIR` | `./tmp/` | Path to directory container the public and private key for Bullion. |
-| `CA_SECRET` | `SomeS3cret` | Secret used to read the encrypted `$CA_KEY` PEM. |
+| `CA_SECRET` | _None_ | **(Required outside development/test)** Passphrase used to decrypt the encrypted CA private key PEM. Bullion refuses to boot when it is missing. See [CA Secret](#ca-secret). |
 | `CA_KEY_PATH` | `$CA_DIR/tls.key` | Private signer key for Bullion. Keep this safe! |
 | `CA_CERT_PATH` | `$CA_DIR/tls.crt` | Public cert for Bullion. If Bullion is an intermediate CA, you'll want to include the root CA's public cert in this file as well the signed cert for Bullion. |
 | `CA_DOMAINS` | `example.com` | A comma-delimited list of domains for which Bullion will sign certificate requests. Subdomains are automatically allowed. Certificates containing other domains will be rejected. |
 | `CERT_VALIDITY_DURATION` | `7776000` | How long should issued certs be valid (in seconds)? Default is 90 days. |
-| `DATABASE_URL` | _None_ | **(Required)** A shorthand for telling Bullion how to connect to a database. Acceptable URLs will either begin with `sqlite3:` or [`trilogy://`](https://github.com/trilogy-libraries/trilogy/tree/main/contrib/ruby). ActiveRecord connection options may be passed as query parameters, e.g. `trilogy://user:pass@host:3306/bullion?max_connections=25&checkout_timeout=5`. |
+| `DATABASE_URL` | _None_ | **(Required)** A shorthand for telling Bullion how to connect to a database. Acceptable URLs will either begin with `sqlite3:` or [`trilogy://`](https://github.com/trilogy-libraries/trilogy/tree/main/contrib/ruby). ActiveRecord connection options may be passed as query parameters, e.g. `trilogy://user:pass@host:3306/bullion?max_connections=25&checkout_timeout=5`. MySQL/MariaDB connections default to the `utf8mb4` charset; the legacy `sjis`, `cp932`, `big5`, `gbk` and `gb18030` charsets are not supported by Trilogy 2.13.2 and raise `ArgumentError` if requested. |
 | `DNS01_NAMESERVERS` | _None_ | A comma-delimited list of nameservers to use for resolving [DNS-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge) challenges. Usually you'll want this to be set to your _internal_ nameservers so internal names resolve correctly. When not set, it'll use the host's DNS. |
 | `LOG_LEVEL` | `warn` | Log level for Bullion. Supported levels (starting with the noisiest) are debug, info, warn, error, and fatal. |
 | `BULLION_PORT` | `9292` | TCP port Bullion will listen on. |
@@ -171,6 +171,43 @@ Whether run locally or via Docker, the following environment variables configure
 
 Because Bullion serves requests through Itsi's [fiber scheduler](https://itsi.fyi/options/fiber_scheduler/), each in-flight request leases its own database connection. ActiveRecord's connection pool defaults to 5 connections, so raise `max_connections` on `DATABASE_URL` if you expect more concurrent requests. `checkout_timeout` (default 5 seconds) controls how long a request waits for a connection before failing.
 
+#### CA Secret
+
+`CA_SECRET` is the passphrase that decrypts the CA private key (`tls.key`). Bullion
+**refuses to boot** (raising `Bullion::ConfigError`) when `CA_SECRET` is missing or
+blank and `RACK_ENV` is anything other than `development` or `test` — there is no
+default passphrase in production.
+
+Generate a strong passphrase and keep it in your secret manager:
+
+```bash
+openssl rand -base64 48   # e.g. a 64-character random string
+```
+
+The CA private key **must be encrypted with that exact passphrase**. Bullion decrypts
+encrypted PEM keys with OpenSSL, so AES-128-CBC and AES-256-CBC both work:
+
+```bash
+# Generate a new encrypted key
+openssl genrsa -aes256 -out tls.key 4096
+
+# Or re-encrypt an existing key with a new passphrase
+openssl pkey -aes256 -in tls.key -out tls.key.new
+```
+
+Then start Bullion with that same passphrase in the environment:
+
+```bash
+export CA_SECRET='<the passphrase you encrypted the key with>'
+itsi
+```
+
+In development and test environments (`RACK_ENV=development` or `RACK_ENV=test`),
+Bullion falls back to a well-known, development-only passphrase so that the `rake`
+demo and test tasks work out of the box; it logs a warning whenever it does so.
+That fallback is never used when `RACK_ENV` is `production` — or when `RACK_ENV` is
+unset, which is treated as a production-like environment.
+
 ### Integrating
 
 Any client that speaks the [ACMEv2](https://tools.ietf.org/html/rfc8555) protocol can be pointed at `/acme/directory` and everything else can be auto-discovered.

data/config.ru

@@ -6,7 +6,11 @@ Bullion.validate_config!
 require "prometheus/middleware/collector"
 require "prometheus/middleware/exporter"
 
-use Rack::ShowExceptions
+# Rack::ShowExceptions renders exception messages and backtraces; keep it out
+# of production so a request that escapes Sinatra's handlers cannot leak them.
+use Rack::ShowExceptions if Bullion::DEV_OR_TEST_ENVIRONMENTS.include?(
+  ENV.fetch("RACK_ENV", "development")
+)
 use Rack::Deflater
 use Prometheus::Middleware::Collector
 use Prometheus::Middleware::Exporter

data/db/migrate/20261102000000_add_created_at_index_to_nonces.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+# Index nonce expiry/pruning queries by creation time.
+class AddCreatedAtIndexToNonces < ActiveRecord::Migration[8.1]
+  def change
+    add_index :nonces, :created_at
+  end
+end

data/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_07_16_000000) do
+ActiveRecord::Schema[8.1].define(version: 2026_11_02_000000) do
   create_table "accounts", force: :cascade do |t|
     t.text "contacts", null: false
     t.datetime "created_at", null: false
@@ -72,6 +72,7 @@ ActiveRecord::Schema[8.1].define(version: 2026_07_16_000000) do
     t.datetime "created_at", null: false
     t.string "token", null: false
     t.datetime "updated_at", null: false
+    t.index ["created_at"], name: "index_nonces_on_created_at"
     t.index ["token"], name: "index_nonces_on_token", unique: true
   end
 

data/lib/bullion/acme/error.rb

@@ -74,6 +74,16 @@ module Bullion
         def acme_type = "unsupportedContact"
       end
 
+      # ACME exception for requests the account is not authorized to make.
+      # Also used for not-found-style refusals: the ACME registry has no
+      # generic "notFound" problem type, and "unauthorized" is its closest
+      # entry ("a request for an identifier the account is not authorized
+      # to manage"); the identical response for missing and foreign-owned
+      # resources keeps the two cases indistinguishable.
+      class Unauthorized < Bullion::Acme::Error
+        def acme_type = "unauthorized"
+      end
+
       # Non-standard exception for unsupported challenge types
       class UnsupportedChallengeType < Bullion::Acme::Error
         def acme_error = "urn:ietf:params:bullion:error:unsupportedChallengeType"

data/lib/bullion/helpers/acme.rb

@@ -4,6 +4,9 @@ module Bullion
   # Common helper functions
   module Helpers
     # ACME-specific helper functions
+    # The ownership and revocation enforcement work grew this module past
+    # the default limit; the helpers are one cohesive ACME concern
+    # rubocop:disable-next Metrics/ModuleLength
     module Acme
       # Parses and verifies the incoming ACME JWT for authentication
       # @see https://tools.ietf.org/html/rfc8555#section-6.2
@@ -114,6 +117,130 @@ module Bullion
         true
       end
 
+      # Ownership enforcement
+      #
+      # ACME resources are private to the account that created them. Requests
+      # are authenticated via the JWS "kid" (see #parse_acme_jwt), and every
+      # by-ID lookup below is scoped to that account: a resource that is
+      # missing and a resource owned by someone else are both answered with a
+      # 404, so an attacker cannot even learn that another account's order,
+      # authorization, challenge, or certificate exists.
+
+      # Returns the Order named by params[:id] when the authenticated account
+      # owns it; nil when it is missing or belongs to a different account.
+      def owned_order
+        Models::Order.find_by(id: params[:id], account_id: @user.id)
+      end
+
+      # Returns the Authorization named by params[:id] when the authenticated
+      # account owns its order; nil when it is missing or foreign-owned.
+      def owned_authorization
+        Models::Authorization.joins(:order)
+                             .find_by(id: params[:id], orders: { account_id: @user.id })
+      end
+
+      # Returns the Challenge named by params[:id] when the authenticated
+      # account owns the challenge's order; nil when missing or foreign-owned.
+      def owned_challenge
+        Models::Challenge.joins(authorization: :order)
+                         .find_by(id: params[:id], orders: { account_id: @user.id })
+      end
+
+      # The identifiers whose authorizations this order has proven and whose
+      # proofs have not yet expired.
+      def validated_domains(order)
+        order.authorizations.select(&:valid_for_issuance?).map { it.identifier["value"] }.sort
+      end
+
+      # Marks a just-validated challenge's authorization valid, and marks the
+      # order ready once every one of its authorizations is valid: a single
+      # valid challenge proves control of only one identifier, so a
+      # multi-identifier order must not become finalizable early.
+      def advance_validation!(challenge)
+        authorization = challenge.authorization
+
+        # An elapsed proof must never be promoted or counted. The stored
+        # status may remain "valid" for client rendering, but issuance and
+        # order readiness rely on #valid_for_issuance?.
+        return if challenge.expired? || authorization.expired?
+
+        authorization.update!(status: "valid") unless authorization.valid_status?
+
+        order = authorization.order
+        return if order.ready_status?
+
+        order.update!(status: "ready") if order.authorizations.all?(&:valid_for_issuance?)
+      end
+
+      # The refusal detail for a finalize attempt that cannot proceed,
+      # distinguishing an elapsed order or authorization from one that is
+      # merely not ready. RFC 8555 has no dedicated expiry error, so all
+      # three refusals use orderNotReady.
+      def finalize_refusal_detail(order)
+        return "Order has expired" if order.expired?
+        return "An authorization has expired" if order.authorizations.any?(&:expired?)
+
+        "Order is not ready to be finalized"
+      end
+
+      # Halts with an RFC 7807 problem document for an ACME error
+      def halt_acme_error(status, error_class, detail)
+        content_type "application/problem+json"
+        halt status, { type: error_class.new.acme_error, detail: }.to_json
+      end
+
+      # Refuses a request in the ACME not-found style (RFC 8555 section
+      # 6.7): the same problem document answers for resources that do not
+      # exist and resources owned by another account, so the existence of
+      # someone else's order, authorization, challenge, or certificate is
+      # never revealed.
+      def halt_acme_not_found
+        halt_acme_error(404, Bullion::Acme::Errors::Unauthorized, "Resource not found")
+      end
+
+      # Authenticates a revocation request per RFC 8555 section 7.6: a
+      # "kid" in the protected header authenticates the signing account as
+      # usual, while a bare "jwk" takes the emergency path — the JWS is
+      # verified against the certificate's own public key, so only the
+      # holder of the certificate's private key can produce such a request.
+      # The header's jwk is a JOSE marker here, not the trusted key: a
+      # valid signature under the certificate key proves possession, which
+      # is what the spec requires.
+      def authenticate_revocation!(cert)
+        return parse_acme_jwt if extract_header_data["kid"]
+
+        begin
+          parse_acme_jwt(cert.public_key)
+        rescue JWT::DecodeError, OpenSSL::PKey::PKeyError
+          halt_acme_not_found
+        end
+      end
+
+      # Whether the account may revoke the certificate record under RFC
+      # 8555 section 7.6: either it is the account the certificate was
+      # issued to, or it holds valid, unexpired authorizations covering
+      # every identifier in the certificate. The jwk path needs no account
+      # check: its signature already proved possession of the certificate's
+      # private key.
+      def revocation_authorized?(account, record)
+        return true if record.order&.account_id == account.id
+
+        covered = Models::Authorization.joins(:order)
+                                       .where(orders: { account_id: account.id },
+                                              authorizations: { status: "valid" })
+                                       .select(&:valid_for_issuance?)
+                                       .map { it.identifier["value"] }
+
+        certificate_domains(record).all? { |domain| covered.include?(domain) }
+      end
+
+      # The identifiers a certificate covers (its subjectAltNames)
+      def certificate_domains(record)
+        domains = Array(record.alternate_names).map { it.delete_prefix("DNS:") }
+        domains = record.order.domains if domains.empty? && record.order
+        domains.sort
+      end
+
       def acme_csr_valid?(order_csr)
         csr = order_csr.csr
         order = order_csr.order
@@ -125,8 +252,13 @@ module Bullion
         # Make sure the CSR has a valid public key
         raise Bullion::Acme::Errors::BadCsr unless csr.verify(csr.public_key)
 
-        raise Bullion::Acme::Errors::BadCsr if csr_cn && !csr_domains.include?(csr_cn)
-        raise Bullion::Acme::Errors::BadCsr unless csr_domains.sort == order.domains.sort
+        # The CA may only sign identifiers the order has proven control of:
+        # the CSR's names must match the validated identifier set exactly, so
+        # no extra or substituted name can make it into a certificate.
+        validated = validated_domains(order)
+
+        raise Bullion::Acme::Errors::BadCsr if csr_cn && !validated.include?(csr_cn)
+        raise Bullion::Acme::Errors::BadCsr unless csr_domains.sort == validated
 
         true
       end
@@ -188,7 +320,11 @@ module Bullion
 
       def extract_valid_order_domains(order_domains)
         order_domains.reject do |domain|
-          Bullion.config.ca.domains.none? { domain["value"].end_with?(it) }
+          # Only allow a configured domain itself or a proper subdomain of it;
+          # the dot boundary stops "nottest.domain" from matching "test.domain"
+          Bullion.config.ca.domains.none? do |configured|
+            domain["value"] == configured || domain["value"].end_with?(".#{configured}")
+          end
         end
       end
 

data/lib/bullion/helpers/ssl.rb

@@ -7,6 +7,10 @@ module Bullion
     module Ssl
       # Converts the incoming key data to an OpenSSL public key usable to verify JWT signatures
       def openssl_compat(key_data)
+        # An OpenSSL key (e.g. a certificate's public key) is already usable;
+        # JWK hashes are converted below
+        return key_data if key_data.is_a?(OpenSSL::PKey::PKey)
+
         case key_data["kty"]
         when "RSA"
           key_data_to_rsa(key_data)
@@ -48,8 +52,7 @@ module Bullion
         raise "Unknown curve" unless curve_name
 
         key_group = OpenSSL::PKey::EC::Group.new(curve_name)
-        key_bn = OpenSSL::BN.new("\x04#{x}#{y}", 2)
-        key_point = OpenSSL::PKey::EC::Point.new(key_group, key_bn)
+        key_point = ec_point_from_jwk(key_group, x, y)
 
         pk_sequence = OpenSSL::ASN1::Sequence.new(
           [OpenSSL::ASN1::ObjectId("id-ecPublicKey"), OpenSSL::ASN1::ObjectId(curve_name)]
@@ -61,6 +64,18 @@ module Bullion
         OpenSSL::PKey::EC.new(outer_sequence.to_der)
       end
 
+      # Builds an EC point from JWK coordinate octets. RFC 7518 requires
+      # fixed-width coordinates, and OpenSSL rejects anything else — a
+      # malformed or off-curve encoding must surface as an ACME
+      # "malformed" request error (RFC 8555 section 6.4), never as an
+      # unhandled exception.
+      # @see https://tools.ietf.org/html/rfc7518#section-6.2.1
+      def ec_point_from_jwk(group, x_octets, y_octets)
+        OpenSSL::PKey::EC::Point.new(group, OpenSSL::BN.new("\x04#{x_octets}#{y_octets}", 2))
+      rescue OpenSSL::PKey::EC::Point::Error => e
+        raise Bullion::Acme::Errors::Malformed, "Invalid EC public key: #{e.message}"
+      end
+
       def key_data_to_eddsa(key_data)
         curve = key_data["crv"]
         x = base64_to_octet(key_data["x"])

data/lib/bullion/models/authorization.rb

@@ -26,6 +26,22 @@ module Bullion
         self.expires ||= Time.now + (60 * 60)
       end
 
+      # Whether this authorization's lifetime has elapsed. The stored status
+      # is deliberately left untouched: clients still see the last persisted
+      # status, while issuance and revocation coverage consult
+      # #valid_for_issuance?.
+      def expired?
+        expires <= Time.now
+      end
+
+      # Whether this authorization still proves control of its identifier.
+      # RFC 8555 carries an "expires" timestamp precisely so a proof stops
+      # being honored after its lifetime, even though its stored status has
+      # not been rewritten.
+      def valid_for_issuance?
+        valid_status? && !expired?
+      end
+
       def prep_challenges!
         %w[http-01 dns-01].each do |type|
           chall = Challenge.new

data/lib/bullion/models/certificate.rb

@@ -13,7 +13,12 @@ module Bullion
       has_one :order
 
       def init_values
-        self.serial ||= SecureRandom.hex(4).to_i(16)
+        # CABF Baseline Requirements require at least 64 bits of CSPRNG output
+        # in certificate serial numbers. Eight random bytes provide that, but
+        # the serial column is a signed BIGINT, so clear the top bit to keep
+        # the value positive and storable. Existing certificates keep their
+        # serials; this only affects new issuances.
+        self.serial ||= SecureRandom.hex(8).to_i(16) & 0x7FFF_FFFF_FFFF_FFFF
       end
 
       def fingerprint

data/lib/bullion/models/challenge.rb

@@ -29,6 +29,12 @@ module Bullion
         self.token ||= SecureRandom.alphanumeric(48)
       end
 
+      # Whether this challenge's lifetime has elapsed. An elapsed challenge
+      # must not be promoted to valid or advance its authorization.
+      def expired?
+        expires <= Time.now
+      end
+
       def thumbprint
         cipher = OpenSSL::Digest.new("SHA256")
         digest = cipher.digest(lexicographically_ordered_public_key.to_json)

data/lib/bullion/models/nonce.rb

@@ -4,6 +4,19 @@ module Bullion
   module Models
     # ACMEv2 Nonce model
     class Nonce < ActiveRecord::Base
+      # How long a minted nonce stays usable. RFC 8555 does not mandate a
+      # lifetime; fifteen minutes is comfortably longer than a client needs
+      # to use a freshly minted nonce while keeping stale rows short-lived.
+      TTL = 15 * 60
+
+      # Hard ceiling on outstanding nonce rows. A client that mints nonces
+      # without consuming them cannot grow the table past this bound.
+      MAX_OUTSTANDING = 10_000
+
+      # How often a mint performs the expiry sweep. Sweeping on every request
+      # would scan the table needlessly under normal load.
+      CLEANUP_INTERVAL = 60
+
       after_initialize :init_values, unless: :persisted?
 
       validates_uniqueness_of :token
@@ -12,11 +25,37 @@ module Bullion
         self.token ||= SecureRandom.alphanumeric
       end
 
-      # Delete old nonces
-      def self.clean_up!
-        # nonces older than this can safely be deleted
-        where("created_at < ?", Time.now - 86_400).delete_all
+      # Delete nonces that are older than {TTL}; they can no longer be used.
+      def self.clean_up!(now: Time.now)
+        where("created_at < ?", now - TTL).delete_all
+      end
+
+      # Keep at most +limit+ nonces, deleting the oldest first. This is the
+      # hard bound on table growth: once the cap is reached, each mint evicts
+      # the oldest outstanding nonce instead of accumulating indefinitely.
+      def self.prune!(limit: MAX_OUTSTANDING)
+        excess = count - limit
+        return unless excess.positive?
+
+        ids = order(:created_at).limit(excess).pluck(:id)
+        where(id: ids).delete_all
+      end
+
+      # Mint a nonce while keeping the table bounded.
+      def self.mint!
+        clean_up_if_due!
+        prune!
+        create.token
+      end
+
+      def self.clean_up_if_due!
+        now = Time.now
+        return if @last_cleanup_at && now - @last_cleanup_at < CLEANUP_INTERVAL
+
+        @last_cleanup_at = now
+        clean_up!(now:)
       end
+      private_class_method :clean_up_if_due!
     end
   end
 end

data/lib/bullion/models/order.rb

@@ -28,6 +28,19 @@ module Bullion
         self.not_after ||= Time.now + (60 * 60 * 24 * 90) # 90 days
       end
 
+      # Whether this order's lifetime has elapsed.
+      def expired?
+        expires <= Time.now
+      end
+
+      # Whether the order may be finalized: it must be ready, within its own
+      # lifetime, and every authorization must still prove control. An order
+      # already marked ready can outlive its authorizations, so readiness is
+      # re-checked here rather than trusted from the persisted status.
+      def ready_for_issuance?
+        ready_status? && !expired? && authorizations.all?(&:valid_for_issuance?)
+      end
+
       def prep_authorizations!
         identifiers.each do |identifier|
           authorization = Authorization.new

data/lib/bullion/service.rb

@@ -13,6 +13,10 @@ module Bullion
       set :logger, Bullion::LOGGER
       set :database, Bullion.config.db_url
       set :show_exceptions, false
+      # This service logs unhandled exceptions itself. Sinatra's dump_errors!
+      # renders the raw exception message and can raise on invalid bytes before
+      # our handler runs, so keep it off in every environment.
+      set :dump_errors, false
     end
 
     before do
@@ -22,16 +26,73 @@ module Bullion
         @json_body = JSON.parse(request.body.read, symbolize_names: true)
       end
     rescue StandardError => e
-      halt(400, { error: "Request must be JSON: #{e.message}}" }.to_json)
+      write_service_log(
+        "WARN",
+        "Rejected malformed request body: #{e.class}: #{safe_exception_message(e)}"
+      )
+      content_type "application/problem+json"
+      halt(400, {
+        type: "urn:ietf:params:acme:error:malformed",
+        detail: "Request body must be JSON"
+      }.to_json)
     end
 
     error do
-      content_type :json
-
       e = env["sinatra.error"]
-      resp = { result: "error", message: e.message }
-      resp[:trace] = e.full_message if settings.environment.to_s != "production"
-      resp.to_json
+      log_unhandled_exception(e)
+
+      status 500
+      content_type "application/problem+json"
+      {
+        type: "urn:ietf:params:acme:error:serverInternal",
+        detail: "Internal server error"
+      }.to_json
+    end
+
+    private
+
+    # Writes the full exception detail (message, backtrace, and causes) to the
+    # server log. The text is force-encoded and scrubbed so an exception whose
+    # message contains invalid bytes cannot make the logger raise (which would
+    # turn the sanitized 500 into an empty response and lose the detail).
+    def log_unhandled_exception(exception)
+      detail = begin
+        exception.full_message(highlight: false)
+      rescue StandardError
+        "#{exception.class}: #{safe_exception_message(exception)}\n" \
+        "#{Array(exception.backtrace).join("\n")}"
+      end
+
+      write_exception_log(
+        "Unhandled exception while handling #{request.request_method} #{request.path}:\n#{detail}"
+      )
+    end
+
+    # Returns a valid UTF-8 exception message. Interpolating a binary message
+    # with invalid bytes into a UTF-8 string can itself raise, so normalize it
+    # before it reaches any string concatenation.
+    def safe_exception_message(exception)
+      exception.message.to_s.dup.force_encoding(Encoding::UTF_8).scrub("?")
+    end
+
+    def write_exception_log(text)
+      write_service_log("ERROR", text)
+    end
+
+    # Prefer Rack's error stream: Itsi wires it to its own log pipeline, while
+    # a Logger captured at boot can point at a worker's closed/inherited stream.
+    def write_service_log(level, text)
+      message = text.dup.force_encoding(Encoding::UTF_8).scrub("?")
+      errors = env["rack.errors"]
+
+      if errors.respond_to?(:puts)
+        errors.puts("#{level} bullion: #{message}")
+      else
+        settings.logger.public_send(level.to_s.downcase.to_sym, message)
+      end
+    rescue StandardError
+      # A logging failure must never replace the sanitized client response.
+      nil
     end
   end
 end

data/lib/bullion/services/ca.rb

@@ -9,8 +9,7 @@ module Bullion
       helpers Helpers::Ssl
 
       before do
-        Models::Nonce.clean_up! if rand(5) > 2 # randomly clean up
-        @new_nonce = Models::Nonce.create.token
+        @new_nonce = Models::Nonce.mint!
       end
 
       after do
@@ -161,7 +160,7 @@ module Bullion
       post "/accounts/:id" do
         parse_acme_jwt
 
-        unless params[:id] == @user.id
+        unless params[:id].to_i == @user.id
           content_type "application/json"
           add_acme_headers @new_nonce
 
@@ -180,7 +179,7 @@ module Bullion
       post "/accounts/:id/orders" do
         parse_acme_jwt
 
-        unless params[:id] == @user.id
+        unless params[:id].to_i == @user.id
           content_type "application/json"
           add_acme_headers @new_nonce
 
@@ -192,7 +191,7 @@ module Bullion
 
         {
           orders: @user.orders.map { uri("/orders/#{it.id}") }
-        }
+        }.to_json
       end
 
       # Endpoint for creating new orders
@@ -224,11 +223,12 @@ module Bullion
       post "/orders/:id" do
         parse_acme_jwt
 
+        order = owned_order
+        halt_acme_not_found unless order
+
         content_type "application/json"
         add_acme_headers @new_nonce
 
-        order = Models::Order.find(params[:id])
-
         order_data(order).to_json
       rescue Bullion::Acme::Error => e
         content_type "application/problem+json"
@@ -240,21 +240,25 @@ module Bullion
       post "/orders/:id/finalize" do
         parse_acme_jwt
 
-        order = Models::Order.find(params[:id])
+        # Ownership is verified before the CSR is parsed or anything is
+        # signed: a foreign CSR must never be signed against another
+        # account's validated order.
+        order = owned_order
+        halt_acme_not_found unless order
 
         content_type "application/json"
         add_acme_headers @new_nonce, additional: { "Location" => uri("/orders/#{order.id}") }
 
         order_csr = Models::OrderCsr.from_acme_request(order, @payload_data["csr"])
 
-        unless order.ready_status?
+        unless order.ready_for_issuance?
           # Finalize is idempotent for orders that have already been finalized
           halt 200, order_data(order).to_json if %w[processing valid].include?(order.status)
 
           content_type "application/problem+json"
           halt 403, {
             type: Bullion::Acme::Errors::OrderNotReady.new.acme_error,
-            detail: "Order is not ready to be finalized"
+            detail: finalize_refusal_detail(order)
           }.to_json
         end
 
@@ -283,12 +287,12 @@ module Bullion
       post "/authorizations/:id" do
         parse_acme_jwt
 
+        authorization = owned_authorization
+        halt_acme_not_found unless authorization
+
         content_type "application/json"
         add_acme_headers @new_nonce
 
-        authorization = Models::Authorization.find(params[:id])
-        halt 404 unless authorization
-
         data = {
           status: authorization.status,
           expires: authorization.expires,
@@ -316,11 +320,14 @@ module Bullion
       post "/challenges/:id" do
         parse_acme_jwt
 
+        # Ownership is verified before triggering validation, so only the
+        # account that created an order can cause its challenges to run.
+        challenge = owned_challenge
+        halt_acme_not_found unless challenge
+
         content_type "application/json"
         add_acme_headers @new_nonce
 
-        challenge = Models::Challenge.find(params[:id])
-
         # Oddly enough, cert-manager uses a GET request for retrieving Challenge info
         challenge.client.attempt unless @json_body && @json_body[:payload] == ""
 
@@ -336,10 +343,7 @@ module Bullion
 
         if challenge.valid_status?
           data[:validated] = challenge.validated
-          authorization = challenge.authorization
-          authorization.update!(status: "valid") unless authorization.valid_status?
-          order = authorization.order
-          order.update!(status: "ready") unless order.ready_status?
+          advance_validation!(challenge)
         end
 
         add_link_relation("up", uri("/authorizations/#{challenge.authorization.id}"))
@@ -356,7 +360,9 @@ module Bullion
         parse_acme_jwt
         add_acme_headers @new_nonce
 
-        order = Models::Order.where(certificate_id: params[:id]).first
+        # The order is scoped to the authenticated account: a certificate
+        # from another account behaves exactly like a missing one.
+        order = Models::Order.find_by(certificate_id: params[:id], account_id: @user.id)
         if order&.valid_status?
           content_type "application/pem-certificate-chain"
 
@@ -371,14 +377,20 @@ module Bullion
       # Revokes a certificate
       # @see https://tools.ietf.org/html/rfc8555#section-7.6
       post "/revokecert" do
-        parse_acme_jwt
-        add_acme_headers @new_nonce
-
         # The certificate is base64url-encoded DER
-        cert_der = Base64.urlsafe_decode64(@payload_data["certificate"])
-        cert = OpenSSL::X509::Certificate.new(cert_der)
+        cert = OpenSSL::X509::Certificate.new(
+          Base64.urlsafe_decode64(extract_payload_data["certificate"])
+        )
 
-        # Find the certificate in the database by matching the PEM data
+        # RFC 8555 section 7.6: a revocation is accepted from the account
+        # that was issued the certificate, from an account holding valid
+        # authorizations for every identifier in the certificate, or when
+        # signed with the certificate's own private key (a "jwk" request).
+        authenticate_revocation!(cert)
+
+        add_acme_headers @new_nonce
+
+        # Find the certificate in the database by matching the serial
         record = Models::Certificate.find_by(serial: cert.serial.to_i)
 
         unless record
@@ -389,6 +401,11 @@ module Bullion
           }.to_json
         end
 
+        # kid-authenticated accounts still need a claim on the certificate;
+        # a jwk-authenticated request has already proven possession of the
+        # certificate's private key
+        halt_acme_not_found if @header_data["kid"] && !revocation_authorized?(@user, record)
+
         if record.revoked?
           content_type "application/problem+json"
           halt 400, {

data/lib/bullion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullion
-  VERSION = "0.12.0"
+  VERSION = "0.12.1"
 end

data/lib/bullion.rb

@@ -34,9 +34,22 @@ module Bullion
   LOGGER = Logger.new($stdout)
   LOGGER.level = ENV.fetch("LOG_LEVEL", :warn)
 
+  # Environments in which Bullion is allowed to fall back to a well-known,
+  # development-only passphrase for the CA private key. Every other environment
+  # (production, or an unset RACK_ENV) must supply CA_SECRET explicitly.
+  DEV_OR_TEST_ENVIRONMENTS = %w[development test].freeze
+
+  # Development/test-only fallback passphrase for the CA private key. This value is
+  # deliberately well-known: it exists so that local development and the test suite
+  # can boot without extra setup. It is never used when RACK_ENV is something other
+  # than "development" or "test".
+  DEV_ONLY_SECRET = "SomeS3cret"
+
   setting :ca, reader: true do
     setting :dir, default: "tmp", constructor: -> { File.expand_path(it) }
-    setting :secret, default: "SomeS3cret"
+    # The passphrase used to decrypt the CA private key. There is deliberately no
+    # default here; see {resolve_ca_secret} and {validate_config!}.
+    setting :secret
     setting(
       :key_path,
       default: "tls.key",
@@ -71,11 +84,23 @@ module Bullion
   MetricsRegistry = Prometheus::Client.registry
 
   def self.ca_key
-    @ca_key ||= begin
-      OpenSSL::PKey::RSA.new(File.read(config.ca.key_path), config.ca.secret)
+    @ca_key ||= load_ca_key
+  end
+
+  # Loads the CA private key, decrypting it with the configured passphrase
+  # @raise [ConfigError] if the key cannot be decrypted with the configured passphrase
+  # @return [OpenSSL::PKey::RSA, OpenSSL::PKey::EC] the decrypted CA private key
+  def self.load_ca_key
+    pem = File.read(config.ca.key_path)
+    begin
+      OpenSSL::PKey::RSA.new(pem, config.ca.secret)
     rescue OpenSSL::PKey::RSAError
-      OpenSSL::PKey::EC.new(File.read(config.ca.key_path), config.ca.secret)
+      OpenSSL::PKey::EC.new(pem, config.ca.secret)
     end
+  rescue OpenSSL::PKey::ECError => e
+    raise ConfigError,
+          "Unable to decrypt the CA private key at #{config.ca.key_path}: check that CA_SECRET " \
+          "matches the passphrase used to encrypt the key (#{e.message})"
   end
 
   def self.ca_cert_file
@@ -94,10 +119,39 @@ module Bullion
     true
   end
 
+  # Resolves the passphrase used to decrypt the CA private key.
+  #
+  # An explicitly configured passphrase always wins. When none is given, a
+  # development/test-only fallback is used so that local development and the test
+  # suite can boot without extra setup. In every other environment (production, or
+  # an unset RACK_ENV) this resolves to +nil+ so that {.validate_config!} fails
+  # closed instead of silently using a well-known passphrase.
+  #
+  # @param secret [String, nil] the configured CA_SECRET value, if any
+  # @param rack_env [String, nil] the RACK_ENV value, if any
+  # @return [String, nil] the passphrase to use, or +nil+ when one is required
+  def self.resolve_ca_secret(secret, rack_env = ENV.fetch("RACK_ENV", nil))
+    return secret unless secret.nil? || secret.to_s.strip.empty?
+
+    DEV_OR_TEST_ENVIRONMENTS.include?(rack_env) ? DEV_ONLY_SECRET : nil
+  end
+
+  # Ensures the passphrase used to decrypt the CA private key is present
+  # @raise [ConfigError] if the passphrase is missing, blank, or not a String
+  # @return [void]
+  def self.validate_ca_secret!
+    secret = config.ca.secret
+    return if secret.is_a?(String) && !secret.strip.empty?
+
+    raise ConfigError,
+          "Missing or invalid CA_SECRET: set the CA_SECRET environment variable to the " \
+          "passphrase that decrypts the CA private key at #{config.ca.key_path}"
+  end
+
   # Ensures configuration settings are valid
   # @see https://support.apple.com/en-us/HT211025
   def self.validate_config! # rubocop:disable Metrics/AbcSize
-    raise ConfigError, "Invalid Key Passphrase" unless config.ca.secret.is_a?(String)
+    validate_ca_secret!
 
     unless File.readable?(config.ca.key_path)
       raise ConfigError,
@@ -130,8 +184,18 @@ Bullion.configure do |config|
   db_url       = ENV.fetch("DATABASE_URL", nil)
   nameservers  = ENV.fetch("DNS01_NAMESERVERS", nil)
 
+  # The CA passphrase has no default outside of development and test environments;
+  # resolve it here so that an unset CA_SECRET fails closed at boot.
+  resolved_secret = Bullion.resolve_ca_secret(ca_secret)
+  if resolved_secret == Bullion::DEV_ONLY_SECRET && ca_secret.to_s.strip.empty?
+    Bullion::LOGGER.warn(
+      "CA_SECRET is not set; using the well-known development-only CA passphrase. Set " \
+      "CA_SECRET to a strong passphrase for any non-development deployment."
+    )
+  end
+
   config.ca.dir = ca_dir if ca_dir
-  config.ca.secret = ca_secret if ca_secret
+  config.ca.secret = resolved_secret
   config.ca.key_path = ca_key_path if ca_key_path
   config.ca.cert_path = ca_cert_path if ca_cert_path
   config.ca.domains = ca_domains if ca_domains
@@ -167,7 +231,7 @@ require "bullion/challenge_client"
 require "bullion/challenge_clients/dns"
 require "bullion/challenge_clients/http"
 
-if %w[development test].include?(ENV["RACK_ENV"])
+if Bullion::DEV_OR_TEST_ENVIRONMENTS.include?(ENV["RACK_ENV"])
   require "bullion/rspec/challenge_clients/dns"
   require "bullion/rspec/challenge_clients/http"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bullion
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.12.1
 platform: ruby
 authors:
 - Jonathan Gnagy
@@ -69,23 +69,29 @@ dependencies:
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.6'
+        version: 2.21.2
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.21.2
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '2.6'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: 3.2.0
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
@@ -95,7 +101,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: 3.2.0
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
@@ -103,16 +109,22 @@ dependencies:
   name: jwt-eddsa
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0.9'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0.9'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: openssl
   requirement: !ruby/object:Gem::Requirement
@@ -137,16 +149,22 @@ dependencies:
   name: prometheus-client
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: sinatra
   requirement: !ruby/object:Gem::Requirement
@@ -221,14 +239,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.9'
+        version: 2.13.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.9'
+        version: 2.13.2
 - !ruby/object:Gem::Dependency
   name: acme-client
   requirement: !ruby/object:Gem::Requirement
@@ -373,28 +391,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: simplecov-cobertura
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '4.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: solargraph
   requirement: !ruby/object:Gem::Requirement
@@ -446,6 +464,7 @@ files:
 - db/migrate/20210106060335_create_nonces.rb
 - db/migrate/20250823073342_add_public_key_hash_to_accounts.rb
 - db/migrate/20260716000000_add_revocation_to_certificates.rb
+- db/migrate/20261102000000_add_created_at_index_to_nonces.rb
 - db/schema.rb
 - lib/bullion.rb
 - lib/bullion/acme/error.rb