Module acme

Available on crate feature acme only.

Modules§

dns_api: DNS-01 records through DNS provider APIs: Cloudflare (an API token with DNS edit permission; Zone read too unless dns_zone_id is set) and Amazon Route 53 (requests signed with AWS Signature Version 4, credentials from the standard AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN). The zone is configured (dns_zone_id) or found by asking the API for each parent of the record name in turn. The API base URL can be replaced (dns_api_url) — CI points both at a mock that writes into BIND.
on_demand: On-demand TLS ([acme] on_demand = true): a certificate is ordered at the first TLS handshake for a name nobody configured — a customer’s own domain pointed at a SaaS — once the on_demand_ask endpoint allows it (GET <ask>?domain=<name> answering 2xx).
tls_alpn: TLS-ALPN-01 (RFC 8737): the CA opens a TLS connection to the domain’s port 443 offering only the ALPN protocol acme-tls/1, and rws answers with a self-signed certificate for the domain carrying the critical id-pe-acmeIdentifier extension: SHA-256 of the key authorization. No port 80, no DNS access.

AcmeConfig: ACME provisioning configuration.
AcmeManager: Manages the ACME lifecycle: initial provisioning and automatic renewal.
DnsConfig: DNS-01 settings.
Tsig: A TSIG key: its name, algorithm and secret.

STATE_DIR: Where ACME keeps its files when no path is configured (relative to the working directory, but a dot-directory: never served).

renewal_status: Whether the renewal loop runs, and its last outcome (time, outcome).
request_renewal: Ask the running renewal loop to order a new certificate now; false when no loop runs (ACME isn’t configured).