22 lines
1.2 KiB
OCaml
22 lines
1.2 KiB
OCaml
|
(* (c) 2017, 2018 Hannes Mehnert, all rights reserved *)
|
||
|
|
module Make (S : Tcpip.Stack.V4V6) : sig
|
||
|
|
|
||
|
|
val retrieve_certificate :
|
||
|
|
S.t -> ([`raw ] Domain_name.t * Dns.Dnskey.t) ->
|
||
|
|
hostname:[ `host ] Domain_name.t ->
|
||
|
|
?additional_hostnames:[ `raw ] Domain_name.t list ->
|
||
|
|
?key_type:X509.Key_type.t -> ?key_data:string -> ?key_seed:string ->
|
||
|
|
?bits:int -> S.TCP.ipaddr -> int ->
|
||
|
|
(X509.Certificate.t list * X509.Private_key.t, [ `Msg of string ]) result Lwt.t
|
||
|
|
(** [retrieve_certificate stack dns_key ~hostname ~key_type ~key_data ~key_seed ~bits server_ip port]
|
||
|
|
generates a private key (using [key_type], [key_data], [key_seed], and
|
||
|
|
[bits]), a certificate signing request for the given [hostname] and
|
||
|
|
[additional_hostnames], and sends [server_ip] an nsupdate (DNS-TSIG with
|
||
|
|
[dns_key]) with the csr as TLSA record, awaiting for a matching
|
||
|
|
certificate as TLSA record. Requires a service that interacts with let's
|
||
|
|
encrypt to transform the CSR into a signed certificate. If something
|
||
|
|
fails, an exception (via [Lwt.fail]) is raised. This is meant for
|
||
|
|
unikernels that require a valid TLS certificate before they can start
|
||
|
|
their service (i.e. most web servers, mail servers). *)
|
||
|
|
end
|