Skip to main content

AcmeDnsChallenge

didbot_tls::dns

Trait AcmeDnsChallenge 

Source 
pub trait AcmeDnsChallenge: Send + Sync {
    // Required methods
    fn publish_challenge(
        &self,
        name: &str,
        values: &[String],
    ) -> Result<(), AcmeDnsError>;
    fn clear_challenge(&self, name: &str) -> Result<(), AcmeDnsError>;
    fn authorize_issuer(
        &self,
        zone: &str,
        policy: &IssuancePolicy,
    ) -> Result<(), AcmeDnsError>;
}
Expand description

What ACME’s DNS-01 step needs from a DNS backend, and nothing more.

name is always a full _acme-challenge.<host> name; this trait does not prepend the label, because the caller is the one that knows how many identifiers share it. values is the complete set that must be visible at once — a wildcard-plus-apex order asks for two — and a real implementation must publish all of them as one operation’s worth of records, not a sequence of single-value writes that a resolver could catch mid-update.

Required Methods§

Source

fn publish_challenge( &self, name: &str, values: &[String], ) -> Result<(), AcmeDnsError>

Publishes exactly values as TXT records at name, replacing whatever this backend had published there before.

Idempotent by design: a renewal that retries after a partial failure must be able to call this again with the same or a refreshed value set without first working out what is already there.

Source

fn clear_challenge(&self, name: &str) -> Result<(), AcmeDnsError>

Removes every value published at name.

Called once the order no longer needs the challenge, whether it succeeded or failed — a stale challenge TXT record is not harmful the way a stale did:web record is, but it is a leftover nobody should have to notice and clean up by hand.

Source

fn authorize_issuer( &self, zone: &str, policy: &IssuancePolicy, ) -> Result<(), AcmeDnsError>

Publishes policy as the CAA record set at zone, replacing whatever was there.

Called at every start, before the first order, so the record always names the account the process is about to use. There is no method to remove it: a zone with no CAA record authorises every authority, which is the state this exists to leave.

This is not a defence against whoever holds the credential that writes it — that holder can rewrite this record along with everything else in the zone. It narrows issuance to one account, so obtaining a certificate for a name here by any other route requires changing this record first, and it points refusals at a contact the authority reaches directly rather than through this host.

Implementors§