Module acme 

Automatic TLS certificate issuance and renewal via ACME (RFC 8555). ACME (RFC 8555) certificate lifecycle for flexd.

Covers contract invariants 67–77 and §7 criteria C50–C58: automatic issuance on startup, HTTP-01 / TLS-ALPN-01 / DNS-01 challenge response, EAB, renewal, Retry-After-aware backoff, and fail-closed behaviour (no silent self-signed fallback). The actual ACME protocol is driven by instant-acme; this module adds the flexd-specific glue: a challenge store shared with the request handler and TLS resolver, a custom HTTP client that trusts an optional test root and surfaces Retry-After, and the ensure_cert orchestration.

Structs

AcmeManager

Orchestrates issuance for one TLS server block.

AcmeResolver

rustls certificate resolver. Serves the staged TLS-ALPN-01 challenge cert when (and only when) the client negotiates the acme-tls/1 ALPN protocol (RFC 8737); all ordinary traffic gets the issued/static default cert.

ChallengeStore

Token paths and challenge certs awaiting validation, shared by reference (cheap Arc clone) into the request handler (HTTP-01) and the TLS ResolvesServerCert hook (TLS-ALPN-01). Reads happen on synchronous paths (rustls’ resolver is sync), so the maps use std::sync::RwLock, never held across an .await.

Functions

load_certified_key

Load a cert chain + key from disk into a CertifiedKey for the resolver’s default (the issued or static cert).