Method do_request_new

gateway/src/distributed_certbot.rs:182–229

(&self, domain: &str, config: &ZtDomainConfig)

    }

    async fn do_request_new(&self, domain: &str, config: &ZtDomainConfig) -> Result<()> {
        let acme_client = self.get_or_create_acme_client(domain, config).await?;

        // Generate new key pair (always use new key for security)
        let key = KeyPair::generate().context("failed to generate key")?;
        let key_pem = key.serialize_pem();
        let public_key_der = key.public_key_der();

        // Request wildcard certificate (domain in config is base domain, cert is *.domain)
        let wildcard_domain = format!("*.{}", domain);
        info!(
            "requesting new certificate from ACME for {}...",
            wildcard_domain
        );
        let cert_pem = tokio::time::timeout(
            self.config().renew_timeout,
            acme_client.request_new_certificate(&key_pem, &[wildcard_domain]),
        )
        .await
        .context("certificate request timed out")?
        .context("failed to request new certificate")?;

        let not_after = get_cert_expiry(&cert_pem).context("failed to parse certificate expiry")?;

        // Save certificate to KvStore
        self.save_cert_to_kvstore(domain, &cert_pem, &key_pem, not_after)?;
        info!("new certificate obtained from ACME, saved to KvStore");

        // Generate and save attestation
        self.generate_and_save_attestation(domain, &public_key_der)
            .await?;

        // Load into memory cert store
        let cert_data = CertData {
            cert_pem,
            key_pem,
            not_after,
            issued_by: self.kv_store.my_node_id(),
            issued_at: now_secs(),
        };
        self.cert_resolver.update_cert(domain, &cert_data)?;

        info!(
            "new certificate loaded (expires in {} days)",
            (not_after - now_secs()) / 86400
        );
        Ok(())
    }

    async fn do_renew(&self, domain: &str, config: &ZtDomainConfig) -> Result<bool> {
        let acme_client = self.get_or_create_acme_client(domain, config).await?;