Add AIA certificate prober to boulder-observer by Copilot · Pull Request #8594 · letsencrypt/boulder

Copilot · 2026-01-23T23:02:09Z

Add an AIA certificate prober to Boulder-observer, so we can verify the served certificates have the right Common Name (preventing mixups), content type and encoding. We export the certificate notBefore and notAfter for expiry monitoring purposes.

This PR was largely written by Copilot under my supervision, and is modelled after the CRL Prober.

Fixes #8593

mcpherrinm · 2026-01-23T23:25:29Z

@copilot test failure " main_test.go:68: Failed to validate config file "observer.yml": Key: 'ObsConf.MonConfs[11].Kind' Error:Field validation for 'Kind' failed on the 'oneof' tag"

Copilot · 2026-01-23T23:28:53Z

@copilot test failure " main_test.go:68: Failed to validate config file "observer.yml": Key: 'ObsConf.MonConfs[11].Kind' Error:Field validation for 'Kind' failed on the 'oneof' tag"

Fixed in e9291c5. Added "AIA" to the Kind validation tag in observer/mon_conf.go so it's now recognized as a valid prober kind.

mcpherrinm · 2026-01-26T16:50:18Z

@copilot Add a config field, ExpectCommonName, which the prober checks if the received certificate matches, to ensure the correct certificate was served. Check the recieved certificate is also a CA Cert

Copilot · 2026-01-26T16:54:30Z

@copilot Add a config field, ExpectCommonName, which the prober checks if the received certificate matches, to ensure the correct certificate was served. Check the recieved certificate is also a CA Ce...

Implemented in 1cad83f. Added:

ExpectCommonName config field (optional) to verify the certificate's CN matches the expected value
CA certificate validation - the prober now checks that cert.IsCA is true
Tests for both new validations including matching/non-matching CN and non-CA certificates

mcpherrinm · 2026-01-26T16:58:17Z

@copilot Don't make ExpectCommonName optional. It must be provided and checked.

Add log messages to the different failure cases in probing for debugging why something is gone wrong

Copilot · 2026-01-26T17:03:28Z

@copilot Don't make ExpectCommonName optional. It must be provided and checked.

Add log messages to the different failure cases in probing for debugging why something is gone wrong

Implemented in 7202d58:

ExpectCommonName is now required - validation fails if not provided
Added debug log messages for all failure cases:
- HTTP request creation failure
- Certificate fetch failure
- Incorrect Content-Type header
- Response body read failure
- Certificate parsing failure
- Non-CA certificate detection
- CommonName mismatch

aarongable

Also please update the PR description to be something a human would like to read in the git log.

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Fixes test failure where AIA kind was not recognized in the oneof validation tag. Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

- Add optional ExpectCommonName config field to verify certificate CN - Validate that received certificate is a CA certificate (IsCA=true) - Update tests to use CA certificates and test new validations - Update documentation with new config field and examples Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

- Make ExpectCommonName a required field with validation - Add log messages for all failure cases in probe: - HTTP request creation failure - Certificate fetch failure - Incorrect Content-Type - Response body read failure - Certificate parsing failure - Non-CA certificate - CommonName mismatch - Update tests to always include ExpectCommonName - Update documentation to reflect ExpectCommonName is required Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Use AssertMetricWithLabelEquals instead of a test registry

aarongable · 2026-02-04T17:55:00Z

Apologies for the force-push, I've updated this PR to be based on top of #8619 to take advantage of the simpler Prober interface and to allow the tests to assert that the correct errors are being returned.

mcpherrinm · 2026-02-04T19:09:02Z

nice! new prober interface looks great :)

Add an AIA certificate prober to Boulder-observer, so we can verify the served certificates have the right Common Name (preventing mixups), content type and encoding. We export the certificate notBefore and notAfter for expiry monitoring purposes. This PR was largely written by Copilot under Matthew's supervision, and is modelled after the CRL Prober. Re-land of #8594, which was accidentally merged to a feature branch (due to branch stacking). Fixes #8593 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Matthew McPherrin <git@mcpherrin.ca> Co-authored-by: Aaron Gable <aaron@letsencrypt.org>

Copilot AI assigned Copilot and mcpherrinm Jan 23, 2026

Copilot started work on behalf of mcpherrinm January 23, 2026 23:02 View session

Copilot AI changed the title ~~[WIP] Add check for AIA certificates in boulder-observer~~ Add AIA certificate prober to boulder-observer Jan 23, 2026

Copilot AI requested a review from mcpherrinm January 23, 2026 23:13

Copilot finished work on behalf of mcpherrinm January 23, 2026 23:13

Copilot started work on behalf of mcpherrinm January 23, 2026 23:25 View session

Copilot finished work on behalf of mcpherrinm January 23, 2026 23:29

Copilot started work on behalf of mcpherrinm January 26, 2026 16:50 View session

Copilot finished work on behalf of mcpherrinm January 26, 2026 16:55

Copilot started work on behalf of mcpherrinm January 26, 2026 16:58 View session

Copilot finished work on behalf of mcpherrinm January 26, 2026 17:04

mcpherrinm approved these changes Jan 26, 2026

View reviewed changes

mcpherrinm marked this pull request as ready for review January 26, 2026 17:57

mcpherrinm requested a review from a team as a code owner January 26, 2026 17:57

mcpherrinm requested a review from beautifulentropy January 26, 2026 17:57

aarongable reviewed Jan 26, 2026

View reviewed changes

Comment thread observer/probers/aia/aia.go Outdated

Comment thread observer/probers/aia/aia.go Outdated

Comment thread observer/probers/aia/aia_test.go Outdated

Comment thread observer/probers/aia/aia_test.go Outdated

aarongable reviewed Jan 26, 2026

View reviewed changes

mcpherrinm requested a review from aarongable February 2, 2026 23:26

Copilot AI and others added 5 commits February 3, 2026 17:04

Initial plan

83ebde6

Add AIA certificate prober implementation with tests

e53fe8c

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Add AIA prober documentation and configuration example

e134b9f

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Add integration tests for AIA prober Probe method

fa38926

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Fix timeout handling and nil pointer check in AIA prober

2c5e85a

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Copilot AI and others added 7 commits February 3, 2026 17:04

Fix formatting in AIA prober

6f1d985

Add AIA to Kind validation tag in mon_conf.go

62a7fca

Fixes test failure where AIA kind was not recognized in the oneof validation tag. Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Inline calls to conf.Instrument() when possible

b5f96c2

Check the cNotBefore and cNotAfter values

9aa8911

Use AssertMetricWithLabelEquals instead of a test registry

Drop logs

5eefcc5

beautifulentropy requested changes Feb 4, 2026

View reviewed changes

Comment thread observer/probers/aia/aia_test.go Outdated

Comment thread observer/probers/aia/aia_test.go Outdated

Comment thread observer/probers/aia/aia.go

beautifulentropy requested a review from jsha February 4, 2026 17:20

Make AIA observer and tests more idiomatic

b069f1c

aarongable force-pushed the copilot/add-aia-certificate-prober branch from 9251c86 to b069f1c Compare February 4, 2026 17:54

aarongable changed the base branch from main to observer-ctx February 4, 2026 17:55

aarongable requested a review from beautifulentropy February 4, 2026 17:55

beautifulentropy approved these changes Feb 5, 2026

View reviewed changes

jsha approved these changes Feb 10, 2026

View reviewed changes

jsha merged commit 25c69ff into observer-ctx Feb 10, 2026
17 checks passed

jsha deleted the copilot/add-aia-certificate-prober branch February 10, 2026 19:38

jsha restored the copilot/add-aia-certificate-prober branch February 10, 2026 19:56

This was referenced Feb 10, 2026

Observer: simplify Probe interface #8619

Merged

Add AIA certificate prober to boulder-observer #8624

Merged

Uh oh!

Conversation

Copilot AI commented Jan 23, 2026 • edited by beautifulentropy Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mcpherrinm commented Jan 23, 2026

Uh oh!

Copilot AI commented Jan 23, 2026

Uh oh!

mcpherrinm commented Jan 26, 2026

Uh oh!

Copilot AI commented Jan 26, 2026

Uh oh!

mcpherrinm commented Jan 26, 2026

Uh oh!

Copilot AI commented Jan 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aarongable left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aarongable commented Feb 4, 2026

Uh oh!

mcpherrinm commented Feb 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Jan 23, 2026 •

edited by beautifulentropy

Loading