certmagic 0.2.0

Automatic TLS certificate acquisition, renewal, and maintenance for Rust servers
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

//! Minimal HTTPS server: obtain a certificate for $DOMAIN and serve TLS.
//!
//! Run against Let's Encrypt staging with a real public domain:
//! `LETSENCRYPT_STAGING=1 DOMAIN=example.com cargo run --example basic_https`
use std::sync::Arc;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let domain = std::env::var("DOMAIN").expect("set DOMAIN to a public domain you control");
    let cache = certmagic::Cache::new(Default::default())?;
    let mut options = certmagic::ConfigOptions::default();
    if std::env::var("LETSENCRYPT_STAGING").is_ok() {
        options.issuers.push(Arc::new(certmagic::AcmeIssuer {
            ca: certmagic::acme::LETS_ENCRYPT_STAGING_CA.into(),
            tos_agreed: true,
            email: std::env::var("EMAIL").ok(),
            ..Default::default()
        }));
    } else {
        options
            .issuers
            .push(Arc::new(certmagic::AcmeIssuer::lets_encrypt()));
    }
    let config = certmagic::Config::new(cache, options)?;

    let ct = tokio_util::sync::CancellationToken::new();
    config
        .manage_sync(&ct, std::slice::from_ref(&domain))
        .await?;

    // Serve HTTPS on :443 with automatic certificate resolution.
    let acceptor = Arc::new(config.certmagic_acceptor()?);
    let listener = tokio::net::TcpListener::bind("0.0.0.0:443").await?;
    println!("serving https://{domain}/");
    loop {
        let (tcp, _) = listener.accept().await?;
        let acceptor = Arc::clone(&acceptor);
        tokio::spawn(async move {
            // `accept` resolves the cert, then yields the handshake future.
            if let Ok(tls) = acceptor.accept(tcp).await
                && let Ok(mut tls) = tls.await
            {
                use tokio::io::{AsyncReadExt, AsyncWriteExt};
                let mut buf = [0u8; 1024];
                let _ = tls.read(&mut buf).await;
                let _ = tls
                    .write_all(
                        b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok",
                    )
                    .await;
                let _ = tls.shutdown().await;
            }
        });
    }
}