unikernel/duniverse/ocaml-dns/mirage/certify/dns_certify_mirage.mli

@@ -0,0 +1,21 @@
+(* (c) 2017, 2018 Hannes Mehnert, all rights reserved *)
+module Make (S : Tcpip.Stack.V4V6) : sig
+
+  val retrieve_certificate :
+    S.t -> ([`raw ] Domain_name.t * Dns.Dnskey.t) ->
+    hostname:[ `host ] Domain_name.t ->
+    ?additional_hostnames:[ `raw ] Domain_name.t list ->
+    ?key_type:X509.Key_type.t -> ?key_data:string -> ?key_seed:string ->
+    ?bits:int -> S.TCP.ipaddr -> int ->
+    (X509.Certificate.t list * X509.Private_key.t, [ `Msg of string ]) result Lwt.t
+  (** [retrieve_certificate stack dns_key ~hostname ~key_type ~key_data ~key_seed ~bits server_ip port]
+      generates a private key (using [key_type], [key_data], [key_seed], and
+      [bits]), a certificate signing request for the given [hostname] and
+      [additional_hostnames], and sends [server_ip] an nsupdate (DNS-TSIG with
+      [dns_key]) with the csr as TLSA record, awaiting for a matching
+      certificate as TLSA record. Requires a service that interacts with let's
+      encrypt to transform the CSR into a signed certificate. If something
+      fails, an exception (via [Lwt.fail]) is raised. This is meant for
+      unikernels that require a valid TLS certificate before they can start
+      their service (i.e. most web servers, mail servers). *)
+end