Module challenge 

TLS-ALPN-01 (RFC 8737) challenge solving.

The CA opens a TLS connection to the domain on 443 with ALPN acme-tls/1 and expects a self-signed certificate whose SAN is the domain and which carries a critical acmeIdentifier extension holding the SHA-256 of the key authorization. server::tls’ resolver asks a ChallengeSolver for that certificate; TlsAlpnSolver builds it from the key authorization the order state machine registered.

The resolver call is synchronous, so the solver keeps an in-process cache. Registrations also go to CertStorage so a peer instance (behind a TCP load balancer) can adopt them via TlsAlpnSolver::refresh_from_storage.

Structs

Cached 🔒

TlsAlpnSolver

Constants

ACME_TLS_ALPN

CHALLENGE_TTL

A pending challenge that outlives this is stale; storage and cache both drop it.

Traits

ChallengeSolver

Functions

build_challenge_cert

Self-signed challenge certificate: SAN = domain, critical acmeIdentifier = SHA-256(key_auth), fresh key, valid for the challenge TTL.

certified_key_from_pem 🔒

Like super::load_certified_key but skips CertifiedKey::keys_match() (see the comment in build_challenge_cert for why that check can’t run on a challenge certificate).

key_authorization_digest