scertec

README

scertec

This is scertec, a Let's Encrypt ACME client that stores certs in setec and a Go client library that reads those certs back out of setec at serving time via a tls.Config.GetCertificate hook.

It only supports ACME DNS challenges using Amazon Route53.

Directories involved:

• . (package scertec): the client library that gets certs from setec
• scertecd (package scertecd): the ACME client code that runs either in the foreground once or in the background as an HTTP server, keeping the certs refreshed in setec
• cmd/scertecd: a little package main wrapper around the earlier item.

Documentation

Overview

Package scertec provides a client for the TLS certs stored in setec as placed there by the scertecd service.

Think of it as a replacement for x/crypto/acme/autocert in that it provides the tls.Config.GetCertificate hook that provides the cert.

Index

• type Client
  • func NewClient(ctx context.Context, c setec.Client, cache setec.Cache, prefix string, ...) (*Client, error)
  • func (c *Client) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client looks up TLS certs stored in setec by scertecd as a function of a tls.ClientHelloInfo.

It does not connect to scertecd directly. (in fact, scertecd provides no cert fetching service; scertecd only updates TLS cert secrets in setec.)

func NewClient

func NewClient(ctx context.Context, c setec.Client, cache setec.Cache, prefix string, domains ...string) (*Client, error)

NewClient returns a new HTTPS cert client. It blocks until all the needed secrets are available for retrieval by the Secret method, or ctx ends. The context passed to NewStore is only used for initializing the store.

func (*Client) GetCertificate

func (c *Client) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)

GetCertificate returns the RSA or ECDSA certificate for hello.ServerName.

It is the signature needed by tls.Config.GetCertificate.