| 12 | const CONTACT_EMAIL: &str = "contact@example.org"; |
| 13 | |
| 14 | pub async fn gen_tls_cert(user_domain: &str, contact_email: &str) -> eyre::Result<Certificate> { |
| 15 | // Create acme-challenge dir. |
| 16 | fs::create_dir(CHALLENGE_DIR).await?; |
| 17 | |
| 18 | let domain = user_domain.to_owned(); |
| 19 | |
| 20 | // Create temporary Actix Web server for ACME challenge. |
| 21 | let srv = HttpServer::new(|| { |
| 22 | App::new().service( |
| 23 | Files::new("/.well-known/acme-challenge", "acme-challenge").show_files_listing(), |
| 24 | ) |
| 25 | }) |
| 26 | .bind((domain, 80))? |
| 27 | .shutdown_timeout(0) |
| 28 | .disable_signals() |
| 29 | .run(); |
| 30 | |
| 31 | let srv_handle = srv.handle(); |
| 32 | let srv_task = rt::spawn(srv); |
| 33 | |
| 34 | // Use DirectoryUrl::LetsEncryptStaging for dev/testing. |
| 35 | let url = DirectoryUrl::LetsEncrypt; |
| 36 | |
| 37 | // Create a directory entrypoint. |
| 38 | let dir = Directory::fetch(url).await?; |
| 39 | |
| 40 | // Our contact addresses; note the `mailto:` |
| 41 | let user_email_mailto = format!("mailto:{contact_email}"); |
| 42 | let contact = vec![user_email_mailto]; |
| 43 | |
| 44 | // Generate a private key and register an account with our ACME provider. |
| 45 | // We should write it to disk any use `load_account` afterwards. |
| 46 | let acc = dir.register_account(Some(contact.clone())).await?; |
| 47 | |
| 48 | // Load an account from string |
| 49 | let priv_key = acc.acme_private_key_pem()?; |
| 50 | let acc = dir.load_account(&priv_key, Some(contact)).await?; |
| 51 | |
| 52 | // Order a new TLS certificate for the domain. |
| 53 | let mut ord_new = acc.new_order(user_domain, &[]).await?; |
| 54 | |
| 55 | // If the ownership of the domain have already been |
| 56 | // authorized in a previous order, we might be able to |
| 57 | // skip validation. The ACME API provider decides. |
| 58 | let ord_csr = loop { |
| 59 | // Are we done? |
| 60 | if let Some(ord_csr) = ord_new.confirm_validations() { |
| 61 | break ord_csr; |
| 62 | } |
| 63 | |
| 64 | // Get the possible authorizations (for a single domain |
| 65 | // this will only be one element). |
| 66 | let auths = ord_new.authorizations().await?; |
| 67 | |
| 68 | // For HTTP, the challenge is a text file that needs to be placed so it |
| 69 | // is accessible to our web server: |
| 70 | // |
| 71 | // ./acme-challenge/<token> |