nx_acme_dns01_issue.nx
buildroot/runtime/nx_acme_dns01_issue.nx
about
nx_acme_dns01_issue.nx -- live ACME (RFC 8555) DNS-01 *WILDCARD* issuance
drive loop (ES256 account key). Renews the *.nishifamily.com + nishifamily.com
certificate using Porkbun DNS-01 validation (the ONLY method that can prove
control of a wildcard name -- HTTP-01 cannot issue wildcards).
COMPOSES (do not rewrite -- reuse):
nx_acme_issue.nx -- acme_dup_cstr / acme_account_key / acme_nonce_from /
acme_signed_post / acme_json_array_nth (+ the whole
ES256 + HTTPS + CSR closure it transitively imports).
Its own main() is dropped as a non-root import.
nx_acme_es256.nx -- nx_acme_dns01_txt_value (TXT = b64url(SHA256(keyAuth))),
payload builders, CSR builder, new-account JWS.
nx_acme_porkbun.nx -- nx_porkbun_set_txt / nx_porkbun_delete_txt /
pk_readline_file (Porkbun DNS API over sovereign TLS).
nx_pem.nx -- pem_decode (PEM cert -> DER), reused per chain block.
FLOW: trust -> directory -> newAccount(reuse persistent key) -> newNonce ->
newOrder(nishifamily.com + *.nishifamily.com) -> for each authz:
find dns-01 -> compute TXT -> Porkbun CREATE _acme-challenge TXT ->
[DNS propagation window -- see TODO] -> trigger -> poll valid ->
Porkbun DELETE TXT (every exit path) -> generate cert key -> CSR ->
finalize -> poll order -> download PEM chain -> PEM->DER concat ->
write /tmp/new_le_fullchain.der + /tmp/new_le_ecdsa_key.bin (TEMP ONLY).
SAFETY: writes ONLY to /tmp. The live daemon cert paths
/volume1/homes/elderwesto/nishihost/certs/le_fullchain.der
/volume1/homes/elderwesto/nishihost/certs/le_ecdsa_key.bin
are NEVER touched here -- the human reviews the /tmp artifacts then deploys.
ENV: default = Let's Encrypt PRODUCTION. Run with argv[1] starting "s"
(e.g. "staging") to use the STAGING directory. NOTE: staging chains to
the "(STAGING) Pretend Pear X1" / "(STAGING) Doctored Durian Root CA X3"
roots, which are NOT in Mozilla's certdata -- the human must add them to
/tmp/mozilla_certdata.txt for a staging TLS handshake to validate.
license_tier: ORIGINAL (composes RFC 8555 DNS-01 + Porkbun API + the P-256 stack)
dependencies 4 imports · 0 importers
imports: nx_acme_issue.nxnx_acme_porkbun.nxnx_pem.nxnx_acme_dns01_propagation.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 42 | const ACME_MAGIC_16384: i64 = 16384 |
| 43 | const ACME_MAGIC_4194304: i64 = 4194304 |
| 44 | const ACME_MAGIC_2048: i64 = 2048 |
| 45 | const ACME_MAGIC_65536: i64 = 65536 |
| 46 | const ACME_MAGIC_8192: i64 = 8192 |
| 47 | const ACME_MAGIC_3000: i64 = 3000 |
| 48 | const ACME_MAGIC_4096: i64 = 4096 |
| 51 | const ACME_DIR_PROD: *u8 = "https://acme-v02.api.letsencrypt.org/directory\x00" |
| 52 | const ACME_DIR_PROD_N: i64 = 46 |
| 53 | const ACME_DIR_STAGING: *u8 = "https://acme-staging-v02.api.letsencrypt.org/directory\x00" |
| 54 | const ACME_DIR_STAGING_N: i64 = 54 |
| 59 | const DNS01_DOMAIN: *u8 = "nishifamily.com\x00" |
| 60 | const DNS01_DOMAIN_N: i64 = 15 |
| 65 | const PORKBUN_KEY_PATH: *u8 = "/tmp/nxsecret.out\x00" |
| 69 | const CERT_KEY_PATH: *u8 = "/tmp/acme_cert_key.bin\x00" |
| 72 | const OUT_FULLCHAIN_DER: *u8 = "/tmp/new_le_fullchain.der\x00" |
| 73 | const OUT_ECDSA_KEY: *u8 = "/tmp/new_le_ecdsa_key.bin\x00" |
| 74 | const OUT_FULLCHAIN_PEM: *u8 = "/tmp/new_nishifamily_fullchain.pem\x00" |
functions
| 77 | func d1_pp(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 78 | func d1_pe(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(2, s, n); return 0 } |
| 81 | func d1_strlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 1: main |
| 83 | func d1_has_dot(s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { if s[i] == (0x2e as u8) { return 1 } i = i + 1 } return 0 } called by 1: main |
| 85 | func d1_mk_wild(dom: *u8, dom_n: i64, out: *u8) -> i64 |
| 94 | func d1_mk_path(pre: *u8, dom: *u8, dom_n: i64, suf: *u8, out: *u8) -> i64 |
| 110 | func d1_find_dns01(body: *u8, start: i64, len: i64, |
| 149 | func d1_find_begin(buf: *u8, end: i64, from: i64) -> i64 |
| 169 | func d1_cleanup(ak: *u8, akn: i64, sk: *u8, skn: i64, store: *TrustStore, now: i64, dom: *u8, dom_n: i64) -> i64 |
| 178 | func main(argc: i64, argv: *i64) -> i64 |