`step certificate inspect` should support using StartTLS
維護者通常 1 天內回覆
@darkfronza 已經在處理了。
開始於 2025年9月4日。
評估
這個 Issue 還沒有評估資料。
描述
Hello!
- Vote on this issue by adding a 👍 reaction
- If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)
Issue details
It would a nice addition to support inspecting certificates that use explicit TLS (StartTLS negotiates a potential upgrade to TLS from a cleartext connection), which could use a flag like --starttls to indicate the connection uses StartTLS instead of implicit TLS:
step certificate inspect --starttls smtp.example.com:587
Related was an issue that lead to adding a smtps:// scheme prefix implying port 465 (implicit TLS), but SMTPS was commonly associated to implicit TLS equivalent to port 25 (StartTLS), however in 2018 was reassigned via RFC 8314 as the implicit TLS equivalent to the submission port (587 with StartTLS). So I don't know how much value that's providing vs just being explicit with a port number 😅 (there's help output with the smtps:// scheme, but no indication of the associated port)
Why is this needed?
The main benefit is it would not require an alternative tool to acquire a certificate from services only reachable via StartTLS:
openssl s_client -starttls smtp -connect smtp.example.com:587
StartTLS is often found with mail servers (aka explicit TLS via ports 25 and 587 related to SMTP and 110 + 143 for POP3/IMAP), which don't always offer implicit TLS ports (465, 993, 995). It can also be found elsewhere like Postgres databases (although this now offers implicit TLS too).
From what I understand however, supporting StartTLS varies by protocol, so implementing support may not be worth the effort/maintenance burden if it cannot be offloaded via some existing library? OpenSSL documents a -starttls option with a fairly long list of supported protocols.
- 主要語言
- Go
- 星號
- 4.3k
- 分支
- 320
- 平均合併
- 2 天 3 小時
- 30 天內合併 PR
- 11
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
smallstep/cli 的其他 Issue
-
bug needs triage
難度 2/5 1-3 小時 新手友好度 74/100
維護者通常 1 天內回覆
-
enhancement needs triage
難度 4/5 3-5 天 新手友好度 32/100
維護者通常 1 天內回覆
-
enhancement needs triage
難度 3/5 1-2 天 新手友好度 57/100
smallstep/cli#1713 · 1 個 reaction ·
維護者通常 1 天內回覆
-
enhancement needs triage
難度 4/5 3-5 天 新手友好度 35/100
smallstep/cli#1710 · 1 則留言 · 1 個 reaction ·
維護者通常 1 天內回覆
-
[Bug]: `step ca provisioner add --ca-config` requires `--ca-url`/`--root` even for purely local/offline edits可能已有人在做 @vulragrag-star 於 56 天前認領。 未關閉bug needs triage
難度 4/5 3-5 天 新手友好度 20/100
smallstep/cli#1705 · 1 個 reaction ·
維護者通常 1 天內回覆
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 68/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 75/100
維護者通常 1 天內回覆
-
GitHub webhook is not subscribed to release events, so `event: release` never triggers可能已有人在做 @qsun 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 78/100
woodpecker-ci/woodpecker#7542 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 74/100
zilliztech/milvus-backup#1386 ·
維護者通常 1 天內回覆
-
Pipelined flush no longer observes kill signals after #2042: flush backoffer is built with nil vars未關閉
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆