package letsencrypt-mirage

  1. Overview
  2. Docs
ACME implementation in OCaml for MirageOS

Install 

dune-project
 Dependency

github.com Readme Changelog BSD-2-clause License Edit opam file Versions (3)

Authors

  1. M
    Michele Mu <maker@tumbolandia.net>, Hannes Mehnert <hannes@mehnert.org>

Maintainers

  1. M
    Michele Mu <maker@tumbolandia.net>

Sources

letsencrypt-0.5.1.tbz
sha256=b90387a5dc8f839926b3e9de831a503317e1a30e9ab99d22a6de64b285d8a35c
sha512=cc2fb7aeba6469d8a3ae20d5bb6857c4035300059149d53ddaee802f125e99dd3078ef699e34a052105533622797194ff80ee9f6b84a7aae5fef0e5866cfada7

doc/letsencrypt-mirage.http-server/LE_http_server/Make/index.html

Module LE_http_server.MakeSource

Parameters

module Time : Mirage_time.S
module Stack : Tcpip.Stack.V4V6
module Random : Mirage_random.S
module Mclock : Mirage_clock.MCLOCK
module Pclock : Mirage_clock.PCLOCK

Signature

Sourceval get_certificates : yes_my_port_80_is_reachable_and_unused:Stack.t -> production:bool -> LE.configuration -> Http_mirage_client.t -> (Tls.Config.own_cert, [> `Msg of string ]) result Lwt.t

get_certificates ~yes_my_port_80_is_reachable_and_unused ~production cfg client tries to resolve the Let's encrypt challenge by initiating an HTTP server on port 80 and handling requests from it with ocaml-letsencrypt.

This resolution requires that your domain name (requested in the given cfg.hostname) redirects Let's encrypt to this HTTP server. You probably need to check your DNS configuration.

The client value can be made by Http_mirage_client.Make.connect to be able to launch HTTP requests to Let's encrypt.

Sourcemodule Paf : sig ... end
Sourceval with_lets_encrypt_certificates : ?port:int -> ?alpn_protocols:string list -> Stack.t -> production:bool -> LE.configuration -> Http_mirage_client.t -> (Paf.TLS.flow, Ipaddr.t * int) Alpn.server_handler -> (unit, [> `Msg of string ]) result Lwt.t

with_lets_encrypt_certificates ?port ?alpn_protocols stackv4v6 ~production cfg client handler launches 2 servers:

  • An HTTP/1.1 server which handles let's encrypt challenges and redirections
  • An ALPN server (which handles HTTP/1.1 and H2 by default, otherwise you can specify protocols via the alpn_protocol argument) which run the user's request handler

The client value can be made by Http_mirage_client.Make.connect to be able to launch HTTP requests to Let's encrypt.

Every 80 days, the fiber re-askes a new certificate from let's encrypt and re-update the ALPN server with this new certificate. The HTTP/1.1 server does the redirection to the hostname defined into the given cfg.

NOTE: For the alpn_protocols argument, only "h2", "http/1.1" and "http/1.0" are handled. Any others protocols will be ignored! The order of protocols matters. If "h2" is the first one and the client handles the "h2" protocol, server and client agree to use this protocol (even if both handle "http/1.1").

The default value of alpn_protocols prioritises "http/1.1" as the protocol which should be picked by the client.