certmagic

Mar 6, 2025

Changes in this version

+ func FindZoneByFQDN(ctx context.Context, logger *zap.Logger, fqdn string, nameservers []string) (string, error)

+ func RecursiveNameservers(custom []string) []string

Jan 15, 2025

Changes in this version

type ACMEIssuer

+ Profile string

Dec 20, 2024

Changes in this version

type Certificate

+ func (cert Certificate) Lifetime() time.Duration

type ZeroSSLIssuer

+ PollInterval time.Duration

Oct 2, 2024

Changes in this version

type Config

+ DisableARI bool

Jun 1, 2024

Changes in this version

type ACMEIssuer

+ func (iss *ACMEIssuer) GetRenewalInfo(ctx context.Context, cert Certificate) (acme.RenewalInfo, error)

+ type RenewalInfoGetter interface

+ GetRenewalInfo func(context.Context, Certificate) (acme.RenewalInfo, error)

May 7, 2024

Changes in this version

+ const GoogleTrustProductionCA

+ const GoogleTrustStagingCA

+ func LooksLikeZeroSSLHTTPValidation(r *http.Request) bool

type ACMEIssuer

+ NotAfter time.Duration

+ NotBefore time.Duration

type Config

+ SubjectTransformer func(ctx context.Context, domain string) string

+ type DNSManager struct

+ DNSProvider DNSProvider

+ Logger *zap.Logger

+ OverrideDomain string

+ PropagationDelay time.Duration

+ PropagationTimeout time.Duration

+ Resolvers []string

+ TTL time.Duration

+ type DNSProvider interface

type OCSPConfig

+ HTTPProxy func(*http.Request) (*url.URL, error)

+ type SubjectIssuer struct

+ IssuerKey string

+ Subject string

+ type ZeroSSLIssuer struct

+ APIKey string

+ AltHTTPPort int

+ CNAMEValidation *DNSManager

+ ListenHost string

+ Logger *zap.Logger

+ Storage Storage

+ ValidityDays int

+ func (iss *ZeroSSLIssuer) HTTPValidationHandler(h http.Handler) http.Handler

+ func (iss *ZeroSSLIssuer) HandleZeroSSLHTTPValidation(w http.ResponseWriter, r *http.Request) bool

+ func (iss *ZeroSSLIssuer) Issue(ctx context.Context, csr *x509.CertificateRequest) (*IssuedCertificate, error)

+ func (iss *ZeroSSLIssuer) IssuerKey() string

+ func (iss *ZeroSSLIssuer) Revoke(ctx context.Context, cert CertificateResource, reason int) error

Dec 6, 2023

Changes in this version

+ const ClientHelloInfoCtxKey

type CleanStorageOptions

+ InstanceID string

+ Interval time.Duration

+ Logger *zap.Logger

Jul 19, 2023

Changes in this version

+ var ErrNoOCSPServerSpecified = errors.New("no OCSP server specified in certificate")

Jul 10, 2023

Changes in this version

type Cache

+ func (certCache *Cache) Remove(hashes []string)

+ func (certCache *Cache) RemoveManaged(subjects []string)

+ func (certCache *Cache) SetOptions(opts CacheOptions)

type Certificate

+ func (cert Certificate) Hash() string

Jun 20, 2023

Changes in this version

+ const UseFirstIssuer

+ const UseFirstRandomIssuer

type Config

+ IssuerPolicy IssuerPolicy

+ ReusePrivateKeys bool

+ type IssuerPolicy string

Jun 5, 2023

Changes in this version

type ACMEIssuer

+ HTTPProxy func(*http.Request) (*url.URL, error)

type Config

+ DisableStorageCheck bool

+ FallbackServerName string

+ func (cfg *Config) GetCertificateWithContext(ctx context.Context, clientHello *tls.ClientHelloInfo) (*tls.Certificate, error)

type OnDemandConfig

+ Managers []Manager

Apr 22, 2022

Changes in this version

type DNS01Solver

+ PropagationDelay time.Duration

Mar 25, 2022

Changes in this version

+ type ACMEIssuer struct

+ AccountKeyPEM string

+ Agreed bool

+ AltHTTPPort int

+ AltTLSALPNPort int

+ CA string

+ CertObtainTimeout time.Duration

+ DNS01Solver acmez.Solver

+ DisableHTTPChallenge bool

+ DisableTLSALPNChallenge bool

+ Email string

+ ExternalAccount *acme.EAB

+ ListenHost string

+ Logger *zap.Logger

+ NewAccountFunc func(context.Context, *ACMEIssuer, acme.Account) (acme.Account, error)

+ PreferredChains ChainPreference

+ Resolver string

+ TestCA string

+ TrustedRoots *x509.CertPool

+ func NewACMEIssuer(cfg *Config, template ACMEIssuer) *ACMEIssuer

+ func (am *ACMEIssuer) GetAccount(ctx context.Context, privateKeyPEM []byte) (acme.Account, error)

+ func (am *ACMEIssuer) HTTPChallengeHandler(h http.Handler) http.Handler

+ func (am *ACMEIssuer) HandleHTTPChallenge(w http.ResponseWriter, r *http.Request) bool

+ func (am *ACMEIssuer) Issue(ctx context.Context, csr *x509.CertificateRequest) (*IssuedCertificate, error)

+ func (am *ACMEIssuer) IssuerKey() string

+ func (am *ACMEIssuer) PreCheck(ctx context.Context, names []string, interactive bool) error

+ func (am *ACMEIssuer) Revoke(ctx context.Context, cert CertificateResource, reason int) error

+ type CertificateEventData struct

+ IssuerKey string

+ Name string

+ StorageKey string

+ type Manager interface

+ GetCertificate func(context.Context, *tls.ClientHelloInfo) (*tls.Certificate, error)

Mar 7, 2022

Changes in this version

+ func PEMDecodePrivateKey(keyPEMBytes []byte) (crypto.Signer, error)

+ func PEMEncodePrivateKey(key crypto.PrivateKey) ([]byte, error)

type Certificate

+ func (cert Certificate) Empty() bool

+ type CertificateManager interface

+ GetCertificate func(context.Context, *tls.ClientHelloInfo) (*tls.Certificate, error)

type Config

+ Managers []CertificateManager

type DNS01Solver

+ OverrideDomain string

Jun 12, 2021

Changes in this version

type Config

+ func (cfg *Config) ObtainCertAsync(ctx context.Context, name string) error

+ func (cfg *Config) ObtainCertSync(ctx context.Context, name string) error

+ func (cfg *Config) RenewCertAsync(ctx context.Context, name string, force bool) error

+ func (cfg *Config) RenewCertSync(ctx context.Context, name string, force bool) error

Apr 1, 2021

Changes in this version

+ const ZeroSSLProductionCA

+ func SolveHTTPChallenge(logger *zap.Logger, w http.ResponseWriter, r *http.Request, ...) bool

+ func SubjectIsIP(subj string) bool

+ func SubjectIsInternal(subj string) bool

type ACMEManager

+ AccountKeyPEM string

+ PreferredChains ChainPreference

+ func (am *ACMEManager) GetAccount(ctx context.Context, privateKeyPEM []byte) (acme.Account, error)

+ type ChainPreference struct

+ AnyCommonName []string

+ RootCommonName []string

+ Smallest *bool

+ type Challenge struct

+ func GetACMEChallenge(identifier string) (Challenge, bool)

type Config

+ Issuers []Issuer

+ OCSP OCSPConfig

+ func (cfg *Config) ClientCredentials(ctx context.Context, identifiers []string) ([]tls.Certificate, error)

+ func (cfg *Config) Unmanage(domainNames []string)

+ type OCSPConfig struct

+ DisableStapling bool

+ ResponderOverrides map[string]string

Sep 17, 2020

Changes in this version

+ type ACMEDNSProvider interface

type ACMEManager

+ DNS01Solver acmez.Solver

+ Logger *zap.Logger

+ NewAccountFunc func(context.Context, *ACMEManager, acme.Account) error

+ Resolver string

type CacheOptions

+ Logger *zap.Logger

type Certificate

+ func (cert Certificate) Expired() bool

type Config

+ Logger *zap.Logger

+ type DNS01Solver struct

+ DNSProvider ACMEDNSProvider

+ PropagationTimeout time.Duration

+ Resolvers []string

+ TTL time.Duration

+ func (s *DNS01Solver) CleanUp(ctx context.Context, challenge acme.Challenge) error

+ func (s *DNS01Solver) Present(ctx context.Context, challenge acme.Challenge) error

+ func (s *DNS01Solver) Wait(ctx context.Context, challenge acme.Challenge) error

Jun 2, 2020

Changes in this version

type CacheOptions

+ Capacity int

Apr 2, 2020

Changes in this version

type Certificate

+ Tags []string

+ func DefaultCertificateSelector(hello *tls.ClientHelloInfo, choices []Certificate) (Certificate, error)

+ func (cert Certificate) HasTag(tag string) bool

Apr 1, 2020

Changes in this version

type ACMEManager

+ ExternalAccount *ExternalAccountBinding

+ type ExternalAccountBinding struct

+ HMAC []byte

+ KeyID string

Mar 26, 2020

Changes in this version

+ func MatchWildcard(subject, wildcard string) bool

Mar 14, 2020

Changes in this version

+ func SubjectQualifiesForCert(subj string) bool

Mar 12, 2020

Changes in this version

+ func SubjectQualifiesForPublicCert(host string) bool

Mar 7, 2020

Changes in this version

+ const DefaultOCSPCheckInterval

+ const DefaultRenewCheckInterval

+ const DefaultRenewalWindowRatio

+ const ED25519

+ const HTTPChallengePort

+ const LetsEncryptProductionCA

+ const LetsEncryptStagingCA

+ const P256

+ const P384

+ const RSA2048

+ const RSA4096

+ const RSA8192

+ const TLSALPNChallengePort

+ var AttemptsCtxKey retryStateCtxKey

+ var Default = Config

+ var DefaultACME = ACMEManager

+ var DefaultKeyGenerator = StandardKeyGenerator

+ var HTTPPort = 80

+ var HTTPSPort = 443

+ var HTTPTimeout = 30 * time.Second

+ var RateLimitEvents = 10

+ var RateLimitEventsWindow = 1 * time.Minute

+ var UserAgent string

+ func CleanStorage(storage Storage, opts CleanStorageOptions)

+ func CleanUpOwnLocks()

+ func HTTPS(domainNames []string, mux http.Handler) error

+ func HostQualifies(hostname string) bool

+ func Listen(domainNames []string) (net.Listener, error)

+ func LooksLikeHTTPChallenge(r *http.Request) bool

+ func ManageAsync(ctx context.Context, domainNames []string) error

+ func ManageSync(domainNames []string) error

+ func NormalizedName(serverName string) string

+ func TLS(domainNames []string) (*tls.Config, error)

+ type ACMEManager struct

+ Agreed bool

+ AltHTTPPort int

+ AltTLSALPNPort int

+ CA string

+ CertObtainTimeout time.Duration

+ DNSChallengeOption dns01.ChallengeOption

+ DNSProvider challenge.Provider

+ DisableHTTPChallenge bool

+ DisableTLSALPNChallenge bool

+ Email string

+ ListenHost string

+ TestCA string

+ TrustedRoots *x509.CertPool

+ func NewACMEManager(cfg *Config, template ACMEManager) *ACMEManager

+ func (am *ACMEManager) HTTPChallengeHandler(h http.Handler) http.Handler

+ func (am *ACMEManager) HandleHTTPChallenge(w http.ResponseWriter, r *http.Request) bool

+ func (am *ACMEManager) Issue(ctx context.Context, csr *x509.CertificateRequest) (*IssuedCertificate, error)

+ func (am *ACMEManager) IssuerKey() string

+ func (am *ACMEManager) PreCheck(names []string, interactive bool) (skip bool, err error)

+ func (am *ACMEManager) Revoke(ctx context.Context, cert CertificateResource) error

+ type Cache struct

+ func NewCache(opts CacheOptions) *Cache

+ func (certCache *Cache) AllMatchingCertificates(name string) []Certificate

+ func (certCache *Cache) RenewManagedCertificates(ctx context.Context) error

+ func (certCache *Cache) Stop()

+ type CacheOptions struct

+ GetConfigForCert ConfigGetter

+ OCSPCheckInterval time.Duration

+ RenewCheckInterval time.Duration

+ type CertMetadata struct

+ PublicKeyAlgorithm x509.PublicKeyAlgorithm

+ SerialNumber *big.Int

+ Subject pkix.Name

+ Tags []string

+ func (cm CertMetadata) HasTag(tag string) bool

+ type Certificate struct

+ Names []string

+ NotAfter time.Time

+ NotBefore time.Time

+ func (cert Certificate) NeedsRenewal(cfg *Config) bool

+ type CertificateResource struct

+ CertificatePEM []byte

+ IssuerData interface{}

+ PrivateKeyPEM []byte

+ SANs []string

+ func (cr *CertificateResource) NamesKey() string

+ type CertificateSelector interface

+ SelectCertificate func(*tls.ClientHelloInfo, []Certificate) (Certificate, error)

+ type CleanStorageOptions struct

+ ExpiredCertGracePeriod time.Duration

+ ExpiredCerts bool

+ OCSPStaples bool

+ type Config struct

+ CertSelection CertificateSelector

+ DefaultServerName string

+ Issuer Issuer

+ KeySource KeyGenerator

+ MustStaple bool

+ OnDemand *OnDemandConfig

+ OnEvent func(event string, data interface{})

+ RenewalWindowRatio float64

+ Revoker Revoker

+ Storage Storage

+ func New(certCache *Cache, cfg Config) *Config

+ func NewDefault() *Config

+ func (cfg *Config) CacheManagedCertificate(domain string) (Certificate, error)

+ func (cfg *Config) CacheUnmanagedCertificatePEMBytes(certBytes, keyBytes []byte, tags []string) error

+ func (cfg *Config) CacheUnmanagedCertificatePEMFile(certFile, keyFile string, tags []string) error

+ func (cfg *Config) CacheUnmanagedTLSCertificate(tlsCert tls.Certificate, tags []string) error

+ func (cfg *Config) GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error)

+ func (cfg *Config) ManageAsync(ctx context.Context, domainNames []string) error

+ func (cfg *Config) ManageSync(domainNames []string) error

+ func (cfg *Config) ObtainCert(ctx context.Context, name string, interactive bool) error

+ func (cfg *Config) RenewCert(ctx context.Context, name string, interactive bool) error

+ func (cfg *Config) RevokeCert(ctx context.Context, domain string, interactive bool) error

+ func (cfg *Config) TLSConfig() *tls.Config

+ type ConfigGetter func(Certificate) (*Config, error)

+ type ErrNoRetry struct

+ Err error

+ func (e ErrNoRetry) Error() string

+ func (e ErrNoRetry) Unwrap() error

+ type ErrNotExist interface

+ type FileStorage struct

+ Path string

+ func (fs *FileStorage) Delete(key string) error

+ func (fs *FileStorage) Exists(key string) bool

+ func (fs *FileStorage) Filename(key string) string

+ func (fs *FileStorage) List(prefix string, recursive bool) ([]string, error)

+ func (fs *FileStorage) Load(key string) ([]byte, error)

+ func (fs *FileStorage) Lock(key string) error

+ func (fs *FileStorage) Stat(key string) (KeyInfo, error)

+ func (fs *FileStorage) Store(key string, value []byte) error

+ func (fs *FileStorage) String() string

+ func (fs *FileStorage) Unlock(key string) error

+ type IssuedCertificate struct

+ Certificate []byte

+ Metadata interface{}

+ type Issuer interface

+ Issue func(ctx context.Context, request *x509.CertificateRequest) (*IssuedCertificate, error)

+ IssuerKey func() string

+ type KeyBuilder struct

+ var StorageKeys KeyBuilder

+ func (keys KeyBuilder) CertsPrefix(issuerKey string) string

+ func (keys KeyBuilder) CertsSitePrefix(issuerKey, domain string) string

+ func (keys KeyBuilder) OCSPStaple(cert *Certificate, pemBundle []byte) string

+ func (keys KeyBuilder) Safe(str string) string

+ func (keys KeyBuilder) SiteCert(issuerKey, domain string) string

+ func (keys KeyBuilder) SiteMeta(issuerKey, domain string) string

+ func (keys KeyBuilder) SitePrivateKey(issuerKey, domain string) string

+ type KeyGenerator interface

+ GenerateKey func() (crypto.PrivateKey, error)

+ type KeyInfo struct

+ IsTerminal bool

+ Key string

+ Modified time.Time

+ Size int64

+ type KeyType string

+ type Locker interface

+ Lock func(key string) error

+ Unlock func(key string) error

+ type OnDemandConfig struct

+ DecisionFunc func(name string) error

+ type PreChecker interface

+ PreCheck func(names []string, interactive bool) (skip bool, err error)

+ type Revoker interface

+ Revoke func(ctx context.Context, cert CertificateResource) error

+ type RingBufferRateLimiter struct

+ func NewRateLimiter(maxEvents int, window time.Duration) *RingBufferRateLimiter

+ func (r *RingBufferRateLimiter) Allow() bool

+ func (r *RingBufferRateLimiter) MaxEvents() int

+ func (r *RingBufferRateLimiter) SetMaxEvents(maxEvents int)

+ func (r *RingBufferRateLimiter) SetWindow(window time.Duration)

+ func (r *RingBufferRateLimiter) Stop()

+ func (r *RingBufferRateLimiter) Wait(ctx context.Context) error

+ func (r *RingBufferRateLimiter) Window() time.Duration

+ type StandardKeyGenerator struct

+ KeyType KeyType

+ func (kg StandardKeyGenerator) GenerateKey() (crypto.PrivateKey, error)

+ type Storage interface

+ Delete func(key string) error

+ Exists func(key string) bool

+ List func(prefix string, recursive bool) ([]string, error)

+ Load func(key string) ([]byte, error)

+ Stat func(key string) (KeyInfo, error)

+ Store func(key string, value []byte) error