View Source CertMagex.Acmev2 (CertMagex v1.0.9)

Implementation of the ACMEv2 protocol for Zerossl (on Elliptic Curves cryptography)

Summary

Functions

Print a certificate content

Generates a certificate through ACMEv2 protocol for the specified domain.

Print a JWS content

Functions

cert_print(cert)

Print a certificate content

csr(args \\ [])

(macro)

csr(record, args)

(macro)

ecdsa_key(args \\ [])

(macro)

ecdsa_key(record, args)

(macro)

ecdsa_signature(args \\ [])

(macro)

ecdsa_signature(record, args)

(macro)

gen_cert(domain)

@spec gen_cert(domain :: binary()) :: {key :: binary(), cert :: binary()}

Generates a certificate through ACMEv2 protocol for the specified domain.

The following ACMEv2 providers are supported

  • :zerossl [*]
  • :letsencrypt
  • :letsencrypt_test

Zerossl requires EAB (External Account Binding) prior to issue a certificate: you will have to register with a proper email to it. Once you've created an account, you can either provide the email or the account key (I've seen it called "access key" or "API key" around) in the configuration. The code tries to lookup for the email, and when not found, defaults to the :account_key. You can find your account key (called API key in zerossl) here:

https://app.zerossl.com/developer

To perform the authentication the EAB credentails must be retrieved. These are saved on a file eab_credentials.json to be reused for the following interactions with Zerossl service APIs

The authentication method relies on the HTTP (not DNS). For it to work gen_cert opens a listening socket on port 80 where it serves the well-known file retrieved from the APIs exchange. When the procedure completes the socket is closed.

By demonstrating the ownership of the site the user gets trusted by the Zerossl service and the certificate is emitted.

The function returns a key and its related certificate. Those can be used to run a trusted HTTPs server.

The key and certificate values are in binary encoded format and can be directly written on a file

jws_dec(data)

Print a JWS content