package dns-certify

You can search for identifiers within the package.

in-package search v0.2.0

On This Page

Parameters
Signature

MirageOS let's encrypt certificate retrieval

Install

dune-project

Dependency

github.com Readme Changelog BSD-2-Clause License Edit opam file Versions (9)

Authors

H

Hannes Mehnert <hannes@mehnert.org>

Maintainers

T

team AT robur dot coop

Sources

dns-10.2.5.tbz

sha256=23af091a6e4c13322b7f9094577e6d72dfcd5e23c4ec00fa3520edb4ff9f5fef

sha512=36b2e4eef2fd9f27bdafba10a86b078cb37e4cd461b363a57b71ca9bd7493ec2388cd9e44c374f1c2a65b73e0dd16c959aed7bd0f91151b3027737b44d4c9332

doc/dns-certify.mirage/Dns_certify_mirage/Make/index.html

Module `Dns_certify_mirage.Make`Source

Parameters

module S : Tcpip.Stack.V4V6

Signature

Source

val retrieve_certificate : 
  S.t ->
  ([ `raw ] Domain_name.t * Dns.Dnskey.t) ->
  hostname:[ `host ] Domain_name.t ->
  ?additional_hostnames:[ `raw ] Domain_name.t list ->
  ?key_type:X509.Key_type.t ->
  ?key_data:string ->
  ?key_seed:string ->
  ?bits:int ->
  S.TCP.ipaddr ->
  int ->
  (X509.Certificate.t list * X509.Private_key.t, [ `Msg of string ]) result
    Lwt.t

retrieve_certificate stack dns_key ~hostname ~key_type ~key_data ~key_seed ~bits server_ip port generates a private key (using key_type, key_data, key_seed, and bits), a certificate signing request for the given hostname and additional_hostnames, and sends server_ip an nsupdate (DNS-TSIG with dns_key) with the csr as TLSA record, awaiting for a matching certificate as TLSA record. Requires a service that interacts with let's encrypt to transform the CSR into a signed certificate. If something fails, an exception (via Lwt.fail) is raised. This is meant for unikernels that require a valid TLS certificate before they can start their service (i.e. most web servers, mail servers).