1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
//
use std::sync::Arc;
use crate::{
acc::AcmeKey,
api::{ApiAccount, ApiDirectory},
error,
req::{req_expect_header, req_get},
trans::{NoncePool, Transport},
util::read_json,
Account,
};
const LETSENCRYPT: &str = "https://acme-v02.api.letsencrypt.org/directory";
const LETSENCRYPT_STAGING: &str = "https://acme-staging-v02.api.letsencrypt.org/directory";
/// Enumeration of known ACME API directories.
#[derive(Debug, Clone)]
pub enum DirectoryUrl<'a> {
/// The main Let's Encrypt directory. Not appropriate for testing and dev.
LetsEncrypt,
/// The staging Let's Encrypt directory. Use for testing and dev. Doesn't issue
/// "valid" certificates. The root signing certificate is not supposed
/// to be in any trust chains.
LetsEncryptStaging,
/// Provide an arbitrary director URL to connect to.
Other(&'a str),
}
impl<'a> DirectoryUrl<'a> {
fn to_url(&self) -> &str {
match self {
DirectoryUrl::LetsEncrypt => LETSENCRYPT,
DirectoryUrl::LetsEncryptStaging => LETSENCRYPT_STAGING,
DirectoryUrl::Other(s) => s,
}
}
}
/// Entry point for accessing an ACME API.
#[derive(Clone)]
pub struct Directory {
nonce_pool: Arc<NoncePool>,
api_directory: ApiDirectory,
}
impl Directory {
/// Create a directory over a persistence implementation and directory url.
pub async fn from_url(url: DirectoryUrl<'_>) -> Result<Directory, error::Error> {
let dir_url = url.to_url();
let res = req_get(&dir_url).await?;
let api_directory: ApiDirectory = serde_json::from_str(&res.body)?;
let nonce_pool = Arc::new(NoncePool::new(&api_directory.newNonce).await);
Ok(Directory {
nonce_pool,
api_directory,
})
}
pub async fn register_account(&self, contact: Vec<String>) -> Result<Account, error::Error> {
let acme_key = AcmeKey::new()?;
self.upsert_account(acme_key, contact).await
}
pub async fn load_account(
&self,
pem: &str,
contact: Vec<String>,
) -> Result<Account, error::Error> {
let acme_key = AcmeKey::from_pem(pem.as_bytes())?;
self.upsert_account(acme_key, contact).await
}
async fn upsert_account(
&self,
acme_key: AcmeKey,
contact: Vec<String>,
) -> Result<Account, error::Error> {
// Prepare making a call to newAccount. This is fine to do both for
// new keys and existing. For existing the spec says to return a 200
// with the Location header set to the key id (kid).
let acc = ApiAccount {
contact,
termsOfServiceAgreed: Some(true),
..Default::default()
};
let mut transport = Transport::new(&self.nonce_pool, acme_key).await;
let res = transport
.call_jwk(&self.api_directory.newAccount, &acc)
.await?;
let kid = req_expect_header(&res, "location")?;
debug!("Key id is: {}", kid);
let api_account: ApiAccount = read_json(res).await?;
// fill in the server returned key id
transport.set_key_id(kid).await;
// The finished account
Ok(Account::new(
transport,
api_account,
self.api_directory.clone(),
))
}
/// Access the underlying JSON object for debugging.
pub fn api_directory(&self) -> &ApiDirectory {
&self.api_directory
}
}
#[cfg(test)]
mod test {
use super::*;
#[tokio::test]
async fn test_create_directory() -> Result<(), error::Error> {
let server = crate::test::with_directory_server();
let url = DirectoryUrl::Other(&server.dir_url);
let _ = Directory::from_url(url).await?;
Ok(())
}
#[tokio::test]
async fn test_create_acount() -> Result<(), error::Error> {
let server = crate::test::with_directory_server();
let url = DirectoryUrl::Other(&server.dir_url);
let dir = Directory::from_url(url).await?;
let _ = dir
.register_account(vec!["mailto:foo@bar.com".to_string()])
.await?;
Ok(())
}
// #[test]
// fn test_the_whole_hog() -> Result<()> {
// std::env::set_var("RUST_LOG", "acme_micro=trace");
// let _ = env_logger::try_init();
// use crate::cert::create_p384_key;
// let url = DirectoryUrl::LetsEncryptStaging;
// let persist = FilePersist::new(".");
// let dir = Directory::from_url(persist, url)?;
// let acc = dir.account("foo@bar.com")?;
// let mut ord = acc.new_order("myspecialsite.com", &[])?;
// let ord = loop {
// if let Some(ord) = ord.confirm_validations() {
// break ord;
// }
// let auths = ord.authorizations()?;
// let chall = auths[0].dns_challenge();
// info!("Proof: {}", chall.dns_proof());
// use std::thread;
// use std::time::Duration;
// thread::sleep(Duration::from_millis(60_000));
// chall.validate(5000)?;
// ord.refresh()?;
// };
// let (pkey_pri, pkey_pub) = create_p384_key();
// let ord = ord.finalize_pkey(pkey_pri, pkey_pub, 5000)?;
// let cert = ord.download_and_save_cert()?;
// println!(
// "{}{}{}",
// cert.private_key(),
// cert.certificate(),
// cert.valid_days_left()
// );
// Ok(())
// }
}