ref: 6e12ebe0bdeae7519ba142caa1dc7c71d4d6fe09
dir: /acmed.man/
.TH ACMED 8 .SH NAME ip/acmed \- acme certificate client .SH SYNOPSIS .B ip/acmed [ .B -a .I acctkey ] [ .B -o .I chalout ] [ .B -p .I provider ] [ .B -t .I type ] .I acctname .I csr [ .I domain ] .SH DESCRIPTION Acmed fetches and renews TLS certificates using the .I acme (RFC8555) protocol. It requires a pregenerated account key and certificate signing key. .PP There are a number of options. .B -a .I acctkey Specifies that .I acctkey is used to sign requests to the .I provider in place of the default .IR /sys/lib/tls/acme/$acctname.pub . The key must be a .I jwk formatted RSA key. .TP .B -o .I chalout specifies that the challenge material is placed in the location .IR chalout . .IP For HTTP challenges, .I chalout must be a directory that your choice of .I httpd will serve at .IR http://domain.com/.well-known/acme-challenge . For DNS challenges, .I chalout is a file that should be included in your .I ndb database. .IP If unspecified, .I http challenges will output to .IR /usr/web/.well-known/acme-challenge , whle .I dns challenges will output to .IR /lib/ndb/dnschallenge . .TP .B -p .I provider Specifies that .I provider is used as the provider URL, in place of the default .IR https://acme-v02.api.letsencrypt.org/directory . This must be the directory URL for the desired .I RFC8555 compliant provider .TP .B -t .I type Specifies that the challenge type. Supported challenge types are currently .I http and .IR dns . .SH EXAMPLES Before .B acmed is run, the keys must be generated. .IP .EX auth/rsagen -t 'service=acme role=sign hash=sha256 acct=a@b.org'\\ >acct.key auth/rsa2jwk acct.key >/sys/lib/tls/acmed/me@example.org.pub auth/rsagen -t 'service=tls owner=*' >cert.key auth/rsa2csr 'CN=mydomain.com' cert.key \\ >/sys/lib/tls/acmed/mydomain.com.csr} \\ .EE .PP This need only be run once. .EE .PP The certificate for the domain can now be fetched: .IP .EX acmed me@example.org /sys/lib/tls/acmed/mydomain.com.csr \\ >/sys/lib/tls/acmed/mydomain.com.crt .EE .PP When using a DNS challenge, your DNS server must be configured, and must be configured to include the DNS challenge file: .EX database= file=/net/ndb file=/lib/ndb/local file=/lib/ndb/common file=/lib/ndb/dnschallenge .EE And .I acmed must be invoked with the domain: .EX acmed me@example.org \\ /sys/lib/tls/acmed/mydomain.com.csr \\ mydomain.com \\ >/sys/lib/tls/acmed/mydomain.com.crt .EE .SH SOURCE .B /sys/src/cmd/ip/acmed.c