Crate certon 

Certon

Automatic HTTPS/TLS certificate management using the ACME protocol.

Certon provides production-grade automatic certificate management.

Quick Start

use certon::CertManager;

#[tokio::main]
async fn main() -> certon::Result<()> {
    let domains = vec!["example.com".into()];
    let tls_config = certon::manage(&domains).await?;
    // Use tls_config with your server...
    Ok(())
}

Architecture

• CertManager runs the certificate lifecycle: obtain, renew, revoke, cache, serve.
• Policy holds certificate management settings.
• AcmeIssuer and ZeroSslIssuer (with zerossl) implement CertIssuer.
• CertCache provides an in-memory certificate store indexed by domain name for fast TLS handshake lookups.
• CertResolver implements rustls::server::ResolvesServerCert and plugs directly into a rustls::ServerConfig.
• CertStore holds certificates; KeyValueCertStore adapts a Storage.
• Storage provides key-value persistence and cluster locks.
• http owns the shared outbound HTTP client.
• start_maintenance runs background loops that renew certificates and refresh OCSP staples.
• Manager is an external certificate provider trait for custom sources.
• PreChecker validates domains before ACME issuance is attempted.
• HttpsRedirectHandler redirects HTTP traffic to HTTPS.

Re-exports

pub use account::prompt_user_agreement;

pub use account::prompt_user_for_email;

pub use acme_client::LETS_ENCRYPT_PRODUCTION;

pub use acme_client::LETS_ENCRYPT_STAGING;

pub use acme_client::RenewalInfo;

pub use acme_client::RenewalWindow;

pub use acme_client::ZEROSSL_PRODUCTION;

pub use acme_client::ari_cert_id;

pub use acme_issuer::AcmeIssuer;

pub use acme_issuer::AcmeIssuerBuilder;

pub use acme_issuer::CertIssuer;

pub use acme_issuer::IssuedCertificate;

pub use acme_issuer::Manager;

pub use acme_issuer::PreChecker;

pub use acme_issuer::Revoker;

pub use cache::CacheOptions;

pub use cache::CertCache;

pub use cert_store::CertStore;

pub use cert_store::KeyValueCertStore;

pub use certificates::Certificate;

pub use crypto::KeyType;

pub use crypto::PrivateKey;

pub use error::Error;

pub use error::Result;

pub use file_storage::FileStorage;

pub use handshake::CertResolver;

pub use handshake::OnDemandConfig;

pub use http::set_user_agent;

pub use maintain::MaintenanceConfig;

pub use manager::CertManager;

pub use manager::CertManagerBuilder;

pub use ocsp::OcspConfig;

pub use policy::CertificateSelector;

pub use policy::IssuerPolicy;

pub use policy::Policy;

pub use redirect::HttpsRedirectHandler;

pub use redirect::RedirectLimits;

pub use redirect::start_https_redirect;

pub use redirect::start_https_redirect_to_host;

pub use solvers::DistributedSolver;

pub use solvers::Http01Solver;

pub use solvers::Solver;

pub use solvers::TlsAlpn01Solver;

pub use solvers::Dns01Solver;

pub use solvers::DnsProvider;

pub use storage::CertificateResource;

pub use storage::KeyInfo;

pub use storage::LockGuard;

pub use storage::Storage;

pub use storage::StorageKeys;

pub use storage::acquire;

pub use storage::try_acquire;

pub use zerossl_issuer::ZeroSslApiIssuer;

pub use zerossl_issuer::ZeroSslIssuer;

Modules

account

ACME account management.

acme_client

Low-level ACME protocol client (RFC 8555).

acme_issuer

ACME certificate issuer — the main certificate acquisition orchestrator.

async_jobs

Async job queue with retry logic for ACME operations.

cache

In-memory certificate cache with domain name indexing.

cert_store

Where certificates live, in certon’s own vocabulary.

certificates

Certificate wrapping, renewal logic, and subject validation.

crypto

Cryptographic utilities for ACME certificate management.

dns_util

DNS utilities for ACME DNS-01 challenge solving.

error

Error types for the certon ACME certificate management library.

file_storage

File-system-based storage backend for certon.

handshake

TLS handshake certificate resolution.

http

HTTP defaults, shared transports and bounded response reading.

http_handler

HTTP handlers for ACME HTTP-01 challenge responses.

maintain

Background certificate maintenance loops.

manager

The certificate lifecycle: obtaining, renewing, revoking and serving.

ocsp

OCSP (Online Certificate Status Protocol) stapling support.

policy

What certificate management should do — as data, and nothing else.

rate_limiter

Rate limiting for ACME operations.

redirect

HTTP to HTTPS redirect handler.

solvers

ACME challenge solvers.

storage

Storage abstraction for certificate assets.

zerossl_issuer

ZeroSSL certificate issuers.

Structs

BoundTlsListener

A bound TCP listener and its TLS acceptor, with owned handshake workers.

TlsListenerLimits

Admission and total handshake deadline for BoundTlsListener::accept.

Functions

install_default_crypto_provider

Install a default rustls provider while preserving an embedder’s choice.

listen

Obtain/load certificates for domains and bind a TLS listener on addr.

listen_with_agreement

Like listen, with explicit CA terms consent for a new account.

manage

Manage certificates for the given domains using a default configuration.

manage_with_agreement

Like manage, with explicit consent to the CA’s terms for a new account. Set agreed only after reviewing the CA’s terms of service.

obtain

Obtain or load certificates for domains, and wait for it.

obtain_in_background

Obtain or load certificates for domains without waiting.

obtain_with_agreement

Like obtain, with explicit agreement to the CA’s terms for a new account.

start_maintenance

Start background certificate maintenance for a CertManager.