Module rules 

What a request may ask for, as checks over the values themselves.

No database, no HTTP: an identifier’s shape, a contact’s, a CSR’s agreement with its order, a datetime’s format. The acme::* services call these before anything is written, and the job handlers call the same functions on the same values, so one rule has one implementation.

The CSR checks are the security boundary for custom and relay. Neither backend can check a CSR against the order — one hands it to an operator’s script, the other to an upstream CA that never saw the authorizations — so whatever passes here is what those backends sign. Read [check_csr_matches_order] before changing any of it, and keep it reading the DER rather than a re-serialisation of it.

Structs

ContactRejection

A contact RFC 8555 §7.3 refuses, and which of its two refusals applies.

Functions

contact_shape_error

The shape check behind [validate_contacts], returning the reason rather than a Problem.

is_wildcard

Whether an identifier names every host under a domain (RFC 8555 §7.1.3).

names_an_ip_address

Whether a dns identifier is really an IP address in disguise.

normalize_dns_name

Canonicalizes a DNS name for comparison: lowercased, with one trailing dot removed.

well_formed_name

Whether a dns identifier is a shape this server can act on.