Module manager 

Ties storage, the DNS-01 seam, the renewal clock and the swappable certificate together into the one thing a server needs: a [rustls::ServerConfig] that renews itself.

What this crate’s tests verify, and what they still cannot

../tests/acme_conformance.rs drives the full instant_acme exchange this module orders through – new_order, both authorizations, dns-01 challenges, finalize, certificate – against an in-process fake ACME directory (../tests/support::FakeAcmeServer), through CertificateManager::bootstrap_with_account. That covers: the apex+wildcard grouping actually reaching a CA-shaped server rather than only the pure grouping function; a challenge that never validates; a renewal that fails repeatedly (still serving the old certificate, warning after three failures, critical inside three days of expiry); a crash between publishing a challenge and withdrawing it; and two zones ordering concurrently without sharing a challenge name.

What that still does not cover: a real CA (rate limits, real validation, real certificate chains – the fake signs the order’s CSR key with a throwaway issuer nothing trusts), real DNS-01 propagation over the network, and ReqwestAcmeClient actually reaching a directory – CertificateManager::bootstrap itself is real-network-only and has no fake-directory path of its own, which is exactly why CertificateManager::bootstrap_with_account exists as a seam. Also exercised, independent of any of the above, purely as functions of a clock the tests supply:

• crate::renew::RenewalTracker – when a renewal is due and how loud a failing one gets.
• crate::acme::group_challenges_by_name – the grouping that avoids publishing the apex’s DNS-01 value and then overwriting it with the wildcard’s, or vice versa.
• crate::resolver::SwappableCert – that a certificate swap is invisible to a connection already past its handshake, and visible to the very next one. See tests/rotation.rs.
• crate::storage – permissions and round-tripping on disk.

Structs

CertificateManager

The PDS’s own certificate: issuance, renewal and the live rustls state, in one place.

Enums

BootstrapError

Why the manager could not be built, or could not obtain a first certificate.

Constants

CHECK_INTERVAL

How often the background loop checks whether renewal is due. Independent of RenewalPolicy::retry_interval: this is the poll granularity, that is the minimum gap between actual attempts.

Functions

load_or_register_account

The ACME account directory_url should be reached through: the one saved in store if it was registered there, and a freshly registered one otherwise, saved over it.

stored_certificate 🔒

The certificate stored for zone if this run can serve it, with its expiry and metadata. None means order a new one.