Skip to content
FutureBlitz

    Install

    Import std.net.acme_client

    std.net.acme_client

    An ACME client (RFC 8555), as Let's Encrypt's are: AcmeClient makes an account with a CA, from its directory's URL, and orders a certificate for names it proves it holds by HTTP-01, publishing each challenge's key authorization through AcmeTokens, which a server answers on port 80 at /.well-known/acme-challenge/. Each request is a JWS of the account's key, ES256, with a nonce from the CA, which a refused nonce is tried again with, once. Its requests are Async, as the server that answers the challenges runs Async code. A CA's refusal is a NetError of HTTP_STATUS that says what it said; a name it couldn't check, or an order it gave up on, is a NetError of OTHER.

    std/net/acme_client.fb

    Types

    AcmeTokens class 

    Public Shared Class AcmeTokens

    The key authorizations of an ACME client's HTTP-01 challenges, by token, which a server gives for /.well-known/acme-challenge/, through Answer, from any thread.

    std/net/acme_client.fb, line 32

    • Public New() constructor #

      A new AcmeTokens, with none published.

    • Public Method Publish(token: String, keyAuthorization: String) method #

      Gives token's challenge its keyAuthorization, which Answer gives until it's withdrawn.

    • Public Method Withdraw(token: String) method #

      Takes token's key authorization out, once its challenge is done.

    • Public Method Answer(path: String): String? method #

      What a request for path is answered with: the key authorization for /.well-known/acme-challenge/, or Null for another path, or a token it hasn't.

    AcmeClient class 

    Public Class AcmeClient

    A client of one ACME CA, with an account key, an ECDSA P-256 private key, which signs each request, and Http, which it sends them with, which can trust a test CA's roots.

    std/net/acme_client.fb, line 61

    • @PanicsAtCaller Public New(directory: String, accountKey: Key) constructor #

      A client of the CA whose directory is at directory. Panics unless accountKey is an ECDSA P-256 private key, of 32 bytes that are one.

    • @PanicsAtCaller Public Static Method InFolder(directory: String, folder: Path): AcmeClient Throws IOError, ParseError static method #

      A client of the CA whose directory is at directory, with the account key folder keeps as account.pem, or a new ECDSA P-256 key, which it writes there atomically, making the folder, for the runs after; automatic HTTPS's ListenAutoAsync keeps its certificate in the same folder. Throws an IOError when the folder can't be read or written, or a ParseError when its account.pem isn't a key's PEM. Panics as New does for a key it keeps that isn't an ECDSA P-256 private key.

    • Public Property Http: HttpClient property #

      What its requests go through.

    • Public Property Account: String? property #

      The account's URL, once Register or Obtain has made it or found it.

    • Public Async Method RegisterAsync(contact: String[] = []): String Throws NetError, TimeoutError method #

      Makes the account, agreeing to the CA's terms of service, with contact, mailto: URLs, or finds the one the key has, and gives its URL.

    • @PanicsAtCaller Public Async Method ObtainAsync(names: String[], certificateKey: Key, tokens: AcmeTokens): String Throws NetError, TimeoutError method #

      A certificate for names, DNS names, of certificateKey, an ECDSA P-256 private key, as PEM, its chain after it: it orders one, publishes each name's HTTP-01 key authorization through tokens while the CA checks it, finalizes the order with a CSR, and gives what the CA issued. It registers first, with no contact, when Register hasn't. Panics as Acme.CertificateRequest does for the key and names.

    Report an issue with this page or with FutureBlitz on GitHub.