Module acme 

Orchestrating one ACME order against DNS-01, generic over the DNS seam in crate::dns.

The two-value collision, made concrete

An order for ["pds.did.bot", "*.pds.did.bot"] gets two authorizations. Both put their DNS-01 challenge at the same record name – _acme-challenge.pds.did.bot – because RFC 8555 §8.4 strips the wildcard label before constructing the challenge name. This module makes two passes over the order’s authorizations rather than the compute-then-immediately-set-ready loop instant-acme’s own docs show, because that loop publishes and confirms one value at a time: the second publish_challenge call would replace the first identifier’s value before the CA ever saw both. Pass one collects every value, grouped by name; then every name’s whole set is published once; only after that does pass two mark each challenge ready.

What is, and is not, exercised here

This module’s own unit tests below only cover group_challenges_by_name as a pure function – there is no way to construct a real [instant_acme::Account] without an HTTP round trip to a directory, so a fake Account was never attempted here. The full exchange – a real Account, a real order, both DNS-01 authorizations grouped and published together, cleanup on every exit path – is instead exercised by tests/acme_conformance.rs, against an in-process fake ACME directory (tests/support::FakeAcmeServer); no real CA has ever answered a call from this module. See that test file and this crate’s top-level documentation for exactly what the fake does and does not stand in for.

Structs

IssuedCertificate

A certificate chain and its private key, both PEM, as ACME hands them back.

Enums

IssueError

Why issuance did not produce a certificate.

Functions

challenge_record_name 🔒

The _acme-challenge.<name> record a DNS-01 answer for identifier (as rendered by instant_acme’s AuthorizedIdentifier’s Display, which prints *.<name> for a wildcard authorization) belongs at.

finish_order 🔒

group_challenges_by_name 🔒

Groups (name, value) into the value sets that must be published together. Exposed for tests without needing a real order: this is where the apex-plus-wildcard collision either is or is not avoided.

issue

Requests a certificate covering every domain in domains from account, completing every dns-01 challenge through dns.

zone_and_wildcard

The full domain name(s) a certificate should cover: <zone> and *.<zone>.