A greenlock keypair and certificate storage strategy with wildcard support (simpler successor to le-store-certbot)
Go to file
AJ ONeal b8fe2e5cbe update docs 2019-11-02 13:28:53 -06:00
.gitignore initial commit 2019-04-01 01:56:41 -06:00
.prettierrc make Prettier 2019-11-02 12:38:12 -06:00
LICENSE initial commit 2019-04-01 01:56:41 -06:00
README.md update docs 2019-11-02 13:28:53 -06:00
accounts.js make Prettier 2019-11-02 12:38:12 -06:00
certificates.js update docs 2019-11-02 13:26:08 -06:00
index.js make Prettier 2019-11-02 12:38:12 -06:00
package-lock.json make Prettier 2019-11-02 12:38:12 -06:00
package.json update docs 2019-11-02 13:26:08 -06:00
promise.js make Prettier 2019-11-02 12:38:12 -06:00
test.js make Prettier 2019-11-02 12:38:12 -06:00
utils.js make Prettier 2019-11-02 12:38:12 -06:00

README.md

greenlock-store-fs | A Root project

A keypair and certificate storage strategy for Greenlock v2.7+ (and v3). The (much simpler) successor to le-store-certbot.

Works with all ACME (Let's Encrypt) SSL certificate sytles:

  • single domains
  • multiple domains (SANs, AltNames)
  • wildcards
  • private / localhost domains

Usage

Global config:

greenlock.manager.defaults({
    store: {
        module: "greenlock-store-fs",
        basePath: "~/.config/greenlock"
    }
});

Per-site config:

greenlock.add({
    subject: "example.com",
    altnames: ["example.com", "www.example.com"],
    store: {
        module: "greenlock-store-fs",
        basePath: "~/.config/greenlock"
    }
});

File System

The default file system layout mirrors that of certbot (python Let's Encrypt implementation) and the prior le-store-certbot in order to make transitioning effortless.

The default structure looks like this:

.config
└── greenlock
    ├── accounts
    │   └── acme-staging-v02.api.letsencrypt.org
    │       └── directory
    │           └── sites@example.com.json
    ├── staging
    │   └── (same as live)
    └── live
        ├── example.com
        │   ├── bundle.pem
        │   ├── cert.pem
        │   ├── chain.pem
        │   ├── fullchain.pem
        │   └── privkey.pem
        └── www.example.com
            ├── bundle.pem
            ├── cert.pem
            ├── chain.pem
            ├── fullchain.pem
            └── privkey.pem

Internal Implementation Details

You DO NOT NEED TO KNOW these details.

They're provided for the sake of understanding what happens "under the hood" to help you make better choices "in the seat".

Note: The actual code could stand to be tidied up. It does need to continue to support Greenlock v2 for a few more months, so I didn't rip out the old v1 -> v2 -> v3 cruft yet.

Parameters

parameters example notes
env staging or live -
directoryUrl https://acme-staging-v02.api.letsencrypt.org/directory -
keypair { privateKeyPem, privateKeyJwk }
account { id: "an-arbitrary-id" } account only
subscriberEmail webhost@example.com account only
certificate { id: "an-arbitrary-id" } certificate only
subject example.com certificate only
pems { privkey, cert, chain, issuedAt, expiresAt } certificate only

Account Keypair

accounts.setKeypair = async function({
    env,
    basePath,
    directoryUrl,
    email,
    account
}) {
    var id = account.id || email;
    var serverDir = directoryUrl.replace("https://", "");
};
accounts.checkKeypair = async function({
    env,
    basePath,
    directoryUrl,
    email,
    account
}) {
    var id = account.id || email;
    var serverDir = directoryUrl.replace("https://", "");

    return {
        privateKeyPem,
        privateKeyJwk
    };
};

Certificate Keypair

certificate.setKeypair = async function({
    env,
    basePath,
    directoryUrl,
    subject,
    certificate
}) {
    var id = account.id || email;
    env = env || directoryUrl.replace("https://", "");
};
certificate.checkKeypair = async function({
    env,
    basePath,
    directoryUrl,
    subject,
    certificate
}) {
    var id = account.id || email;
    env = env || directoryUrl.replace("https://", "");

    return {
        privateKeyPem,
        privateKeyJwk
    };
};

Certificate PEMs

certificate.set = async function({
    env,
    basePath,
    directoryUrl,
    subject,
    certificate,
    pems
}) {
    var id = account.id || email;
    env = env || directoryUrl.replace("https://", "");
};
certificate.check = async function({
    env,
    basePath,
    directoryUrl,
    subject,
    certificate
}) {
    var id = account.id || email;
    env = env || directoryUrl.replace("https://", "");

    return {
        privkey,
        cert,
        chain,
        issuedAt,
        expiresAt
    };
};