code wiki / (root) / nx_acme_es256.nx

nx_acme_es256.nx

buildroot/runtime/nx_acme_es256.nx

13179 B283 linesdepth 13pulls 37 transitivereach 2 importersview sourcekind tooltopic acme
docsdependenciesstructsconstsfunctions

about

nx_acme_es256.nx -- ACME (RFC 8555) request builders for the ES256 account-key path, on the nx_syscalls graph. WHY a second ACME file: the legacy nx_acme.nx is EdDSA + sits on the nx_syscalls_x86_64 graph (via nx_jose/nx_jwk). Let's Encrypt's production CA does NOT accept Ed25519 account keys -- it requires ES256 (ECDSA P-256) or RS256 -- and the whole HTTPS client + P-256 crypto + CSR stack lives on the nx_syscalls graph. Two syscall variants define duplicate sys_* symbols and cannot link together, so the ES256 ACME client must be its own file on the nx_syscalls graph. This supersedes nx_acme.nx for live issuance. Composes (all nx_syscalls graph): nx_jose_es256.nx -- ES256 JWS flattened sign + nxes_put_* + pubkey nx_jwk_ec.nx -- EC P-256 JWK emit + RFC 7638 thumbprint nx_acme_csr.nx -- ECDSA P-256 PKCS#10 CSR (pulls nx_x509_build hub) nx_https_client.nx-- live HTTPS POST/GET to the CA (next slice) This file is the REQUEST-BUILDER + DNS-01 layer. All functions here are offline-deterministic and KAT-verifiable; the live state-machine drive (newNonce -> newAccount -> newOrder -> authz -> dns-01 -> poll -> finalize -> download) layers on top using nx_https_client. license_tier: ORIGINAL (composes RFC 8555 + RFC 7515/7518/7638 + P-256)

dependencies 3 imports · 1 importers

nx_jose_es256.nx nx_jwk_ec.nx nx_acme_csr.nx nx_acme_es256.nx nx_acme_issue.nx

imports: nx_jose_es256.nxnx_jwk_ec.nxnx_acme_csr.nx

imported by: nx_acme_issue.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main u256_alloc nx_scratch nx_scratch_init sys_mmap nx_scratch_oom sys_write sys_exit sys_mmap ↻ u256_load_be nx_p256_pubkey_from_priv p256_point_alloc nx_scratch ↻ u256_alloc ↻ p256_field_one u256_one u256_zero p256_field_zero u256_zero ↻ p256_point_load_g p256_field_one ↻ p256_scalar_mul nx_scratch_save nx_scratch_init ↻ p256_point_alloc ↻ p256_point_copy u256_copy p256_point_zero p256_field_one ↻ p256_field_zero ↻ p256_point_double p256_point_is_infinity u256_is_zero p256_point_zero ↻ u256_is_zero ↻ nx_scratch_save ↻ u256_alloc ↻ u256_copy ↻ p256_field_sq p256_field_mul

structs

none

consts

29const NXACMEES_MAGIC_1024: i64 = 1024
30const NXACMEES_MAGIC_4096: i64 = 4096
32const NXACMEES_OK: i64 = 0
33const NXACMEES_OOM: i64 = 1
34const NXACMEES_BAD_ARG: i64 = 2
35const NXACMEES_SIGN_ERR: i64 = 3

functions

41func nx_acme_es256_protected_jwk_form(
called by 1: nx_acme_build_new_account_jws_es256 calls 2: nxes_put_cstrnxes_put_bytes
64func nx_acme_es256_protected_kid_form(
called by 1: acme_signed_post calls 2: nxes_put_cstrnxes_put_bytes
89func nx_acme_payload_new_account(
called by 1: nx_acme_build_new_account_jws_es256 calls 2: nxes_put_cstrnxes_put_bytes
102func nx_acme_payload_new_order(
called by 1: main calls 2: nxes_put_cstrnxes_put_bytes
124func nx_acme_payload_finalize(
called by 1: main calls 2: nxes_put_cstrnxes_put_bytes
148func nx_acme_key_authorization(
called by 1: acme_do_http01 calls 1: nx_jwk_ec_p256_thumbprint
169func nx_acme_dns01_txt_value(
called by 1: main calls 1: nx_jwk_ec_p256_thumbprint
201func nx_acme_build_new_account_jws_es256(
called by 1: main calls 4: nx_jwk_ec_p256_emitnx_acme_es256_protected_jwk_formnx_acme_payload_new_accountnx_jose_sign_es256_flattened
229func main() -> i64
calls 3: u256_allocu256_load_benx_p256_pubkey_from_priv