Crate salvo_acme 

Automatic HTTPS/TLS certificate management for Salvo via the ACME protocol.

This crate integrates certon, a production-grade ACME client, with Salvo’s listener/acceptor system.

Features

• Multiple issuers: Let’s Encrypt, ZeroSSL, or any ACME-compatible CA.
• Multiple challenge types: HTTP-01, TLS-ALPN-01, DNS-01.
• On-demand TLS: obtain certificates at handshake time.
• OCSP stapling: automatic OCSP response fetching and stapling.
• Multiple key types: ECDSA P-256/P-384/P-521, RSA, Ed25519.
• Persistent storage: pluggable storage backend via Storage.
• Background renewal: automatic certificate renewal and OCSP refresh.

Certificate key type

Salvo ACME defaults to KeyType::EcdsaP256 for newly generated certificate private keys. RSA key types remain available for compatibility, but they are explicit opt-in via AcmeConfigBuilder::key_type or AcmeListenerBuilder::key_type.

Quick Start - HTTP-01

use salvo_acme::AcmeListener;
use salvo_core::prelude::*;

#[handler]
async fn hello() -> &'static str {
    "Hello World"
}

#[tokio::main]
async fn main() {
    let mut router = Router::new().get(hello);
    let listener = TcpListener::new("0.0.0.0:443")
        .acme()
        .cache_path("acme/letsencrypt")
        .add_domain("example.com")
        .http01_challenge(&mut router);
    let acceptor = listener.join(TcpListener::new("0.0.0.0:80")).bind().await;
    Server::new(acceptor).serve(router).await;
}

Quick Start - TLS-ALPN-01

use salvo_acme::AcmeListener;
use salvo_core::prelude::*;

#[handler]
async fn hello() -> &'static str {
    "Hello World"
}

#[tokio::main]
async fn main() {
    let router = Router::new().get(hello);
    let acceptor = TcpListener::new("0.0.0.0:443")
        .acme()
        .cache_path("acme/letsencrypt")
        .add_domain("example.com")
        .bind().await;
    Server::new(acceptor).serve(router).await;
}

Re-exports

pub use certon;

Structs

AcmeAcceptor

Acceptor for ACME.

AcmeConfig

ACME configuration.

AcmeConfigBuilder

ACME configuration builder.

AcmeIssuer

An ACME-based certificate issuer.

AcmeIssuerBuilder

Builder for constructing an AcmeIssuer with sensible defaults.

AcmeListenerBuilder

A wrapper around an underlying listener which implements ACME.

AcmeQuinnListenerquinn

A wrapper around an underlying listener which implements ACME and Quinn.

CertCache

An in-memory certificate cache that indexes certificates by subject name for efficient TLS handshake lookups.

CertResolver

A TLS certificate resolver that integrates with CertCache and optionally supports on-demand certificate issuance.

Certificate

A TLS certificate chain together with its private key and parsed metadata.

CertonConfig

Central configuration for automatic TLS certificate management.

CertonConfigBuilder

Builder for constructing a Config with sensible defaults.

DistributedSolver

Wraps any Solver for clustered / distributed deployments.

Dns01Solver

Solves ACME DNS-01 challenges by creating a TXT record via a DnsProvider implementation and optionally waiting for propagation.

FileStorage

Http01Handler

Handler for HTTP-01 ACME challenges.

Http01Solver

Solves ACME HTTP-01 challenges by serving the key authorization string at GET /.well-known/acme-challenge/{token} on a simple HTTP server.

IssuedCertificate

The result of a successful certificate issuance.

MaintenanceConfig

Configuration for the background maintenance task.

OcspConfig

Configuration for OCSP stapling behavior.

OnDemandConfig

Configuration for on-demand TLS certificate issuance.

TlsAlpn01Solver

Solves ACME TLS-ALPN-01 challenges by presenting a self-signed certificate with the acmeIdentifier extension during the TLS handshake, negotiated via the acme-tls/1 ALPN protocol (RFC 8737).

ZeroSslIssuer

A certificate issuer that obtains certificates from ZeroSSL via ACME.

Enums

ChallengeType

Challenge type for ACME.

IssuerPolicy

Controls how issuers are selected when obtaining or renewing certificates.

KeyType

Enumerates the supported asymmetric key algorithms.

Constants

LETS_ENCRYPT_PRODUCTION

Let’s Encrypt production ACME directory.

LETS_ENCRYPT_STAGING

Let’s Encrypt staging ACME directory (for testing).

ZEROSSL_PRODUCTION

ZeroSSL production ACME directory.

Traits

AcmeListener

Extension trait for Listener to support ACME.

CertIssuer

Abstract interface for certificate issuers.

DnsProvider

Abstraction over a DNS provider that can create and delete TXT records.

Manager

An external certificate manager that can provide certificates for TLS handshakes.

PreChecker

Optional pre-check interface for certificate issuers.

Revoker

Abstract interface for certificate revokers.

Solver

An ACME challenge solver.

Storage

Persistent key-value storage with filesystem-like path semantics.