Module acme 

Automatic certificates via ACME (RFC 8555) with the TLS-ALPN-01 challenge (RFC 8737).

This module produces certificates; server::tls only consumes them. The contract between the two is ManagedCerts — an atomically swappable map from CertId to the current ManagedCert — plus the challenge::ChallengeSolver the TLS resolver asks when a ClientHello carries ALPN acme-tls/1. Renewals swap a map entry; they never rebuild the rustls ServerConfig.

Modules

challenge

TLS-ALPN-01 (RFC 8737) challenge solving.

client

The ACME protocol boundary.

manager

The renewal scheduler: one task per managed certificate that decides when to (re)issue, takes the storage lease so only one instance orders, runs order::issue, persists, publishes into ManagedCerts, and backs off on failure. Instances that lose the lease poll storage and adopt whatever the leaseholder wrote, refreshing challenge certs meanwhile so the CA may validate through any of them.

metrics

Prometheus series for managed certificates — enough for the standard “expires in < 7 d” and “renewal failing” alerts.

order

One certificate issuance, start to finish: fresh key → newOrder → register every TLS-ALPN-01 key authorization with the solver → tell the CA “ready” → wait → CSR → finalize → download → verify → hand back a StoredCert. Challenges are cleared on every exit path so a stuck order never leaves a validatable challenge cert behind. Verification runs before anything is persisted: a CA returning garbage never evicts a working certificate.

storage

ACME state storage: account credentials, per-certificate key+chain, pending TLS-ALPN-01 key authorizations, and the renewal lease that keeps N gateway instances from ordering the same certificate at once.

Structs

AcmeRuntime

Everything the rest of the process needs from ACME once started.

CertId

Stable identity of one managed certificate: its normalized domain set.

CertMeta

Operator-facing facts about a managed certificate (never the key).

ManagedCert

The current certificate for one CertId, as served by the TLS resolver.

StoredCert

What storage persists per certificate.

Enums

AcmeError

CertState

Functions

build_storage

Builds the configured CertStorage. The redis backend keeps only the store’s name and resolves its client from resources on every call, so an Admin API store edit is picked up by the next operation; the name is validated here (resolved once and discarded) so a typo fails startup rather than every later renewal.

leaf_dns_sans

DNS SANs of the leaf, lowercased.

load_certified_key

Parses a PEM chain + PEM key into a rustls [CertifiedKey], verifying the key matches the leaf. Returns the leaf DER alongside for metadata parsing.

new_managed_certs

now_unix

parse_cert_meta

parse_leaf 🔒

placeholder_cert

A self-signed, 1-hour placeholder (SAN = all domains, CN = the first) served while no real certificate exists yet. Never persisted.

provider 🔒

publish

Replaces (or inserts) the entry for id. New TLS connections see it on their next resolve; in-flight ones are unaffected.

start

Builds storage, seeds ManagedCerts from storage (or placeholders), and spawns the renewal manager. The CA is not contacted here — the manager connects lazily — so a CA outage never blocks the listener from starting.

update

Mutates the entry for id in place (no-op when absent).

Type Aliases

ManagedCerts

Keyed by CertId::as_str().