From: Jérôme Billiras <bilhackmac@gmail.com>
Date: Sat, 26 Sep 2026 19:25:39 +0000 (+0200)
Subject: BUG/MINOR: acme: exact domain match in acme_challenge_ready()
X-Git-Tag: v3.5-dev8~112
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=9e7c5d245f60e6cd8828dc20e973762184f02a63;p=haproxy.git

BUG/MINOR: acme: exact domain match in acme_challenge_ready()

acme_challenge_ready() compares the domain passed on the CLI (or via the
Lua ACME.challenge_ready() function) with strncmp() limited to the
length of the authorization's domain. This is a prefix match: with a
certificate covering "example.com" and "example.com.au", signaling
"example.com.au" also marks the "example.com" challenge as ready.

Use isteq() so that only the exact domain matches.

This should be backported to 3.3. The code was moved into
acme_challenge_ready() in 3.5, so the fix has to be applied to
cli_acme_chall_ready_parse() in older versions.
---

diff --git a/src/acme.c b/src/acme.c
index dbf1d1f3a..63f6959ae 100644
--- a/src/acme.c
+++ b/src/acme.c
@@ -3604,7 +3604,7 @@ int acme_challenge_ready(const char *crt, const char *dns)
 	if (ctx->cfg->cond_ready & ACME_RDY_CLI)
 		auth = ctx->auths;
 	while (auth) {
-		if (strncmp(dns, auth->dns.ptr, auth->dns.len) == 0) {
+		if (isteq(ist(dns), auth->dns)) {
 			if ((auth->ready & ACME_RDY_CLI) == 0) {
 				auth->ready |= ACME_RDY_CLI;
 				found++;