Struct Auth

Source

pub struct Auth<P: Persist> { /* private fields */ }

Expand description

An authorization (ownership proof) for a domain name.

Each authorization for an order much be progressed to a valid state before the ACME API will issue a certificate.

Authorizations may or may not be required depending on previous orders against the same ACME account. The ACME API decides if the authorization is needed.

Currently there are two ways of providing the authorization.

In a text file served using HTTP from a web server of the domain being authorized.
A TXT DNS record under the domain being authorized.

Implementations§

Source §

impl<P: Persist> Auth

Source

pub fn domain_name(&self) -> &str

Domain name for this authorization.

Source

pub fn need_challenge(&self) -> bool

Whether we actually need to do the authorization. This might not be needed if we have proven ownership of the domain recently in a previous order.

Source

pub fn http_challenge(&self) -> Challenge<P, Http>

Get the http challenge.

The http challenge must be placed so it is accessible under:

http://<domain-to-be-proven>/.well-known/acme-challenge/<token>

The challenge will be accessed over HTTP (not HTTPS), for obvious reasons.

use acme_lib::persist::Persist;
use acme_lib::order::Auth;
use acme_lib::Error;
use std::fs::File;
use std::io::Write;

fn web_authorize<P: Persist>(auth: &Auth<P>) -> Result<(), Error> {
  let challenge = auth.http_challenge();
  // Assuming our web server's root is under /var/www
  let path = {
    let token = challenge.http_token();
    format!("/var/www/.well-known/acme-challenge/{}", token)
  };
  let mut file = File::create(&path)?;
  file.write_all(challenge.http_proof().as_bytes())?;
  challenge.validate(5000)?;
  Ok(())
}

Source

pub fn dns_challenge(&self) -> Challenge<P, Dns>

Get the dns challenge.

The dns challenge is a TXT record that must put created under:

_acme-challenge.<domain-to-be-proven>.  TXT  <proof>

The contains the signed token proving this account update it.

use acme_lib::persist::Persist;
use acme_lib::order::Auth;
use acme_lib::Error;

fn dns_authorize<P: Persist>(auth: &Auth<P>) -> Result<(), Error> {
  let challenge = auth.dns_challenge();
  let record = format!("_acme-challenge.{}.", auth.domain_name());
  // route_53_set_record(&record, "TXT", challenge.dns_proof());
  challenge.validate(5000)?;
  Ok(())
}

The dns proof is not the same as the http proof.

Source

pub fn tls_alpn_challenge(&self) -> Challenge<P, TlsAlpn>

Get the TLS ALPN challenge.

The TLS ALPN challenge is a certificate that must be served when a request is made for the ALPN protocol “tls-alpn-01”. The certificate must contain a single dNSName SAN containing the domain being validated, as well as an ACME extension containing the SHA256 of the key authorization.

Source

pub fn api_auth(&self) -> &ApiAuth

Access the underlying JSON object for debugging. We don’t refresh the authorization when the corresponding challenge is validated, so there will be no changes to see here.