93 lines
4 KiB
OCaml
93 lines
4 KiB
OCaml
open Dns
|
|
|
|
val signing_request : [`host] Domain_name.t ->
|
|
?more_hostnames:([`raw] Domain_name.t list) ->
|
|
X509.Private_key.t -> (X509.Signing_request.t, [> `Msg of string ]) result
|
|
(** [signing_request name ~more_hostnames key] creates a X509 signing request
|
|
where [name] will be the common name in its subject, and if [more_hostnames]
|
|
is provided and non-empty, [name :: more_hostnames] will be the value of a
|
|
subjectAlternativeName extension. *)
|
|
|
|
val letsencrypt_name : 'a Domain_name.t ->
|
|
([ `raw ] Domain_name.t, [> `Msg of string ]) result
|
|
(** [letsencrypt_name host] is the service name at which we store let's encrypt
|
|
certificates for the [host]. *)
|
|
|
|
val is_csr : Dns.Tlsa.t -> bool
|
|
(** [is_csr tlsa] is true if [tlsa] is a certificate signing request (cert_usage
|
|
is Domain_issued_certificate, selector is Private, and matching_type is
|
|
No_hash). *)
|
|
|
|
val csr : X509.Signing_request.t -> Dns.Tlsa.t
|
|
(** [csr req] is the signing request [req] encoded as TLSA record. *)
|
|
|
|
val is_certificate : Dns.Tlsa.t -> bool
|
|
(** [is_certificate tlsa] is true if [tlsa] is a certificate (cert_usage is
|
|
Domain_issued_certificate, selector is Full_certificate, and matching_type
|
|
is No_hash). *)
|
|
|
|
val certificate : X509.Certificate.t -> Dns.Tlsa.t
|
|
(** [certificate crt] is the certificate [crt] encoded as TLSA record. *)
|
|
|
|
val is_ca_certificate : Dns.Tlsa.t -> bool
|
|
(** [is_ca_certificate tlsa] is true if [tlsa] is a CA certificate (cert_usage
|
|
is CA_constraint, selector is Full_certificate, and matching_type is
|
|
No_hash). *)
|
|
|
|
val ca_certificate : string -> Dns.Tlsa.t
|
|
(** [ca_certificate data] is the CA certificate [data] encoded as TLSA record. *)
|
|
|
|
val is_name : 'a Domain_name.t -> bool
|
|
(** [is_name domain_name] is true if it contains the prefix used in this
|
|
library ("_letsencrypt._tcp"). *)
|
|
|
|
type u_err = [
|
|
| `Tsig of Dns_tsig.e
|
|
| `Bad_reply of Packet.mismatch * Packet.t
|
|
| `Unexpected_reply of Packet.reply
|
|
]
|
|
(** The type of update errors. *)
|
|
|
|
val pp_u_err : u_err Fmt.t
|
|
(** [pp_u_err ppf u] pretty-prints [u] on [ppf]. *)
|
|
|
|
val nsupdate : (int -> string) -> (unit -> Ptime.t) ->
|
|
host:[ `host ] Domain_name.t -> keyname:'b Domain_name.t ->
|
|
zone:[ `host ] Domain_name.t -> Dns.Dnskey.t -> X509.Signing_request.t ->
|
|
(string * (string -> (unit, [> u_err ]) result),
|
|
[> `Msg of string ]) result
|
|
(** [nsupdate rng now ~host ~keyname ~zone dnskey csr] is a buffer with a DNS
|
|
update that removes all TLSA records from the given [host], and adds a single
|
|
TLSA record containing the certificate signing request. It also returns a
|
|
function which decodes a given answer, checks it to be a valid reply, and
|
|
returns either unit or an error. The outgoing packet is signed with the
|
|
provided [dnskey], the answer is checked to be signed by the same key. If
|
|
the sign operation fails, [nsupdate] returns an error. *)
|
|
|
|
type q_err = [
|
|
| `Decode of Packet.err
|
|
| `Bad_reply of Packet.mismatch * Packet.t
|
|
| `Unexpected_reply of Packet.reply
|
|
| `No_tlsa
|
|
]
|
|
(** The type for query errors. *)
|
|
|
|
val pp_q_err : q_err Fmt.t
|
|
(** [pp_q_err ppf q] pretty-prints [q] on [ppf]. *)
|
|
|
|
val cert_matches_csr : ?until:Ptime.t -> Ptime.t -> X509.Signing_request.t ->
|
|
X509.Certificate.t -> bool
|
|
(** [cert_matches_csr ~until now csr cert] is [true] if [cert] matches the
|
|
signing request [csr], and is valid from [now] until [until] (defaults to
|
|
[now]). The matching is [true] if the public key matches, and the set of
|
|
hostnames in [csr] and [cert] are equal. A log message on the info level
|
|
is emitted if the return value if [false]. *)
|
|
|
|
val query : (int -> string) -> Ptime.t -> [ `host ] Domain_name.t ->
|
|
X509.Signing_request.t ->
|
|
(string *
|
|
(string -> (X509.Certificate.t * X509.Certificate.t list, [> q_err ]) result),
|
|
[> `Msg of string ]) result
|
|
(** [query rng now csr] is a [buffer] with a DNS TLSA query for the name of
|
|
[csr], and a function that decodes a given answer, either returning a X.509
|
|
certificate valid [now] and matching [csr], and a CA chain, or an error. *)
|