Remove ACME client #7414
Merged
Remove ACME client #7414
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR removes the ACME (Automatic Certificate Management Environment) client functionality from the codebase, simplifying certificate management by eliminating the ability to automatically obtain TLS certificates from external certificate authorities like Let's Encrypt.
Key changes include:
- Complete removal of ACME client implementation and related infrastructure
- Removal of ACME-related configuration options and interfaces
- Deletion of ACME challenge frontend and test files
Reviewed Changes
Copilot reviewed 35 out of 35 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/acme_endorsement.py | Deleted entire test file for ACME functionality |
| tests/infra/remote.py | Removed ACME challenge server interface configuration logic |
| tests/infra/network.py | Removed "acme" from node configuration parameters list |
| tests/infra/interfaces.py | Removed ACME authority type and acme_configuration fields from Endorsement class |
| tests/config.jinja | Removed ACME configuration template block |
| src/node/node_state.h | Removed ACME client initialization, refresh logic, and certificate installation hooks |
| src/node/ccf_acme_client.h | Deleted ACME client implementation file |
| src/node/acme_client.h | Deleted core ACME protocol client file |
| src/node/acme_challenge_frontend.h | Deleted ACME challenge server frontend |
| src/node/rpc/acme_subsystem.h | Deleted ACME subsystem implementation |
| src/node/rpc/node_interface.h | Removed ACME-related interface methods |
| src/node/rpc/gov_effects_interface.h | Removed trigger_acme_refresh method declaration |
| src/node/rpc/gov_effects.h | Removed trigger_acme_refresh method implementation |
| src/node/rpc/test/node_stub.h | Removed stub implementation of trigger_acme_refresh |
| src/service/network_tables.h | Removed ACME certificates table reference |
| src/js/extensions/ccf/node.h | Removed triggerACMERefresh from documentation |
| src/js/extensions/ccf/node.cpp | Removed js_trigger_acme_refresh function |
| src/http/http_rpc_context.h | Removed special handling for .well-known/acme-challenge paths |
| src/host/run.cpp | Removed ACME configuration copying to startup config |
| src/enclave/rpc_sessions.h | Simplified set_cert method signature and removed ACME-specific certificate handling |
| src/enclave/enclave.h | Removed ACME subsystem and frontend initialization |
| src/ds/actors.h | Removed acme_challenge actor type |
| scripts/setup-ci.sh | Removed Pebble ACME server installation |
| samples/minimal_ccf/app/actions.js | Removed trigger_acme_refresh governance action |
| samples/constitutions/default/actions.js | Removed trigger_acme_refresh governance action |
| include/ccf/service/tables/acme_certificates.h | Deleted ACME certificates table definition |
| include/ccf/service/node_info_network.h | Removed ACME authority type and configuration structures |
| include/ccf/service/acme_client_config.h | Deleted ACME client configuration structures |
| include/ccf/node/acme_subsystem_interface.h | Deleted ACME subsystem interface |
| doc/schemas/node_openapi.json | Removed ACME from Authority enum and Endorsement schema |
| doc/operations/certificates.rst | Removed ACME-endorsed certificates documentation section |
| doc/host_config_schema/cchost_config.json | Removed ACME configuration schema |
| doc/audit/builtin_maps.rst | Removed service.acme_certificates table documentation |
| CMakeLists.txt | Removed ACME endorsement test |
| CHANGELOG.md | Added entry documenting ACME client removal |
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
eddyashton
reviewed
Oct 28, 2025
Co-authored-by: Eddy Ashton <ashton.eddy@gmail.com>
eddyashton
reviewed
Oct 28, 2025
achamayou
approved these changes
Oct 28, 2025
maxtropets
commented
Oct 30, 2025
maxtropets
force-pushed
the
f/remove-acme-completely
branch
from
f8a7dcf to
0b90a24
Compare
maxtropets
force-pushed
the
f/remove-acme-completely
branch
from
95efa08 to
b15f7d2
Compare
5 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#7262 (comment)
Post mortem (kind of):
NodeInfoNetwork_v2vsNodeInfoNetwork_v1business_v2expectedly fails, but falls back to_v1_v1parsing passes because we are still filling up the old fields (shall we stop doing that?..)_v1parsing the test fails as expected, so I've resurrected enum parsing as discussed.