Struct AcmeProvider 

pub struct AcmeProvider<S: Storage> { /* private fields */ }

ACME certificate provider for automatic TLS provisioning.

Manages the full ACME lifecycle: account creation, order placement, HTTP-01 challenge fulfillment, certificate download, and storage.

Type Parameter

• S: The platform storage backend (e.g., InMemoryStorage, SqliteStorage).

DNS-01 Alternative

For environments where port 80 is unavailable (NAT, shared hosting), DNS-01 challenges can be used instead. The operator configures DNS TXT records manually or via DNS API. This is not implemented in this module but is documented here per spec section 18.6.3.

Implementations

impl<S: Storage + 'static> AcmeProvider<S>

pub fn new(domain: &str, storage: Arc<ProtocolStore<S>>) -> Self

Create a new ACME provider for the given domain.

Uses the Let’s Encrypt production directory by default. Call with_directory_url to change.

pub fn with_email(self, email: &str) -> Self

Set the contact email for the ACME account.

pub fn with_directory_url(self, url: &str) -> Self

Set a custom ACME directory URL (e.g., staging environment).

pub fn with_cert_resolver(self, resolver: Arc<CertResolver>) -> Self

Set a cert resolver for hot-reloading on renewal.

pub fn challenges(&self) -> Arc<RwLock<HashMap<String, String>>>

Returns a handle to the shared ACME challenge map.

Pass this to acme_challenge_router so the HTTP server can serve GET /.well-known/acme-challenge/{token} responses during ACME provisioning.

pub async fn provision(&self) -> Result<CertificateData, TlsError>

Provision a new certificate via ACME HTTP-01.

This performs the full ACME flow:

1. Create an ACME account.
2. Place a new order for the domain.
3. Retrieve the HTTP-01 challenge.
4. Respond to the challenge (caller must serve the challenge token).
5. Wait for the order to become ready.
6. Finalize the order with a CSR.
7. Download the certificate.
8. Store in platform storage.

Errors

Returns TlsError::Acme if any ACME protocol step fails. Returns TlsError::Storage if certificate storage fails.

pub async fn load_or_provision(&self) -> Result<CertificateData, TlsError>

Load a certificate from storage, or provision a new one if none exists or the existing one needs renewal.

Errors

Returns TlsError if loading, provisioning, or storage fails.

pub fn start_renewal_loop(self: Arc<Self>) -> JoinHandle<()>

where S: Send + Sync + 'static,

Start a background renewal loop that checks certificate expiry every 12 hours and renews when within 30 days of expiry.

The task runs until the returned tokio::task::JoinHandle is aborted or the process exits.

Trait Implementations

impl<S: Storage> Debug for AcmeProvider<S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S: Storage + 'static> TlsProvider for AcmeProvider<S>

Blanket TlsProvider for AcmeProvider.

fn provision( &self, ) -> Pin<Box<dyn Future<Output = Result<CertificateData, TlsError>> + Send + '_>>

Attempt to provision or load a TLS certificate for the domain.

fn challenges(&self) -> Arc<RwLock<HashMap<String, String>>>

Returns the shared ACME challenge map (token → key authorization).

fn needs_challenge_listener(&self) -> bool

Whether this provider requires an HTTP-01 challenge listener.