Module order 

One certificate issuance, start to finish: fresh key → newOrder → register every TLS-ALPN-01 key authorization with the solver → tell the CA “ready” → wait → CSR → finalize → download → verify → hand back a StoredCert. Challenges are cleared on every exit path so a stuck order never leaves a validatable challenge cert behind. Verification runs before anything is persisted: a CA returning garbage never evicts a working certificate.

Enums

KeyType

Constants

NOT_BEFORE_SKEW_SECS 🔒

Clock-skew tolerance for a just-issued not_before.

Functions

build_csr

DER CSR with SAN = domains, CN = the first domain.

generate_key

A fresh private key for one issuance (never reused across renewals).

issue

Runs one order. On success the certificate is verified but not stored — the caller persists and publishes it.

run 🔒

verify_chain

The chain parses, the leaf’s public key is key, it is valid at now (±skew), and its DNS SANs cover every domain.