`nx_acme_issue.nx` source

↩ module page · 511 lines · 24154 B
1// nx_acme_issue.nx -- live ACME issuance drive loop (ES256, DNS-01).
2//
3// Composes the two ACME layers (both nx_syscalls graph):
4//   nx_acme_es256.nx -- ES256 JWS builders + DNS-01 + pubkey_from_priv
5//   nx_acme_http.nx  -- TLS transport + JSON reader + header reader
6//
7// Built + tested INCREMENTALLY against Let's Encrypt PRODUCTION.  The
8// pre-challenge steps (directory / nonce / newAccount / newOrder / authz
9// fetch) are NOT failed-validation-rate-limited, so they are safe to
10// exercise repeatedly; only triggering a challenge that then fails counts
11// against the 5/hour/hostname budget, so that step is gated separately.
12//
13// Stage selector: argv-free; this build does directory -> nonce ->
14// newAccount -> newOrder -> authz fetch, printing each result.  The
15// account key is persisted (reused across renewals).
16//
17// license_tier: ORIGINAL
18
19import "nx_acme_es256.nx"
20import "nx_acme_http.nx"
21const ACME_MAGIC_2048: i64 = 2048
22const ACME_MAGIC_8192: i64 = 8192
23const ACME_MAGIC_16384: i64 = 16384
24const ACME_MAGIC_3000: i64 = 3000
25const ACME_MAGIC_4194304: i64 = 4194304
26const ACME_MAGIC_1779284141: i64 = 1779284141
27const ACME_MAGIC_65536: i64 = 65536
28const ACME_MAGIC_4096: i64 = 4096
29
30const ACME_ACCT_KEY_PATH: *u8 = "/tmp/acme_acct_key.bin\x00"
31
32// Copy src[off..off+len] into a fresh NUL-terminated buffer; return it.
33func acme_dup_cstr(src: *u8, off: i64, len: i64) -> *u8 {
  let out: *u8 = sys_mmap(len + 1)
  var i: i64 = 0
  while i < len { out[i] = src[off + i]; i = i + 1 }
  out[len] = 0 as u8
  return out
39}
40
41// Load the persistent ECDSA P-256 account key (32-byte big-endian scalar),
42// generating + saving it on first use.  Fills priv_limbs.
43func acme_account_key(priv_limbs: *i64) -> i64 {
  let priv_be: *u8 = sys_mmap(32)
  let fd: i64 = sys_openat_rd(ACME_ACCT_KEY_PATH)
  if fd > 0 {
      let n: i64 = sys_read(fd, priv_be, 32)
      sys_close(fd)
      if n == 32 {
          u256_load_be(priv_limbs, priv_be)
          return 0
      }
  }
  // generate + persist (0600)
  nx_csprng_fill(priv_be, 32)
  let wfd: i64 = sys_openat_wr(ACME_ACCT_KEY_PATH, 0x180)   // 0600
  if wfd > 0 {
      sys_write(wfd, priv_be, 32)
      sys_close(wfd)
  }
  u256_load_be(priv_limbs, priv_be)
  return 1
63}
64
65func acme_print(label: *u8, label_n: i64, s: *u8, s_n: i64) -> i64 {
  sys_write(1, label, label_n)
  sys_write(1, s, s_n)
  sys_write(1, "\n" as *u8, 1)
  return 0
70}
71
72// Extract a fresh Replay-Nonce from a response into a new buffer.
73func acme_nonce_from(resp: *u8, total: i64, r: *i64, out_n: *i64) -> *u8 {
  let no: *i64 = sys_mmap(8) as *i64
  let nl: *i64 = sys_mmap(8) as *i64
  if nx_http_response_header(resp, total, r, "Replay-Nonce" as *u8, 12, no, nl) != 1 {
      out_n[0] = 0; return 0 as *u8
  }
  out_n[0] = nl[0]
  return acme_dup_cstr(resp, no[0], nl[0])
81}
82
83// Build a kid-form ES256 JWS over `payload` (pay_n may be 0 for the
84// RFC 8555 §6.3 POST-as-GET).  Returns 0 on success.
85func acme_signed_post(priv: *i64, kid: *u8, kid_n: i64,
                    nonce: *u8, nonce_n: i64, url: *u8, url_n: i64,
                    payload: *u8, pay_n: i64,
                    jws: *u8, jws_cap: i64, jws_n: *i64) -> i64 {
  let prot: *u8 = sys_mmap(ACME_MAGIC_2048)
  let poff: *i64 = sys_mmap(8) as *i64
  poff[0] = 0
  if nx_acme_es256_protected_kid_form(prot, poff, ACME_MAGIC_2048, kid, kid_n, nonce, nonce_n, url, url_n) != NXACMEES_OK { return 0 - 1 }
  if nx_jose_sign_es256_flattened(prot, poff[0], payload, pay_n, priv, jws, jws_cap, jws_n) != NXES_OK { return 0 - 2 }
  return 0
95}
96
97// Locate the dns-01 challenge object inside an authorization JSON body
98// and extract its token + url.  The challenges array holds several
99// {type,url,token,status} objects; we find the one whose type is
100// "dns-01" by locating that substring then bounding its enclosing
101// {...} object and reading token/url within.  Returns 1 on success.
102func acme_find_http01(body: *u8, start: i64, len: i64,
                    tok_off: *i64, tok_len: *i64,
                    url_off: *i64, url_len: *i64) -> i64 {
  let end: i64 = start + len
  // find "http-01" (7 bytes; distinct from "https")
  var p: i64 = 0 - 1
  var i: i64 = start
  while i < end - 7 {
      if body[i] == 0x68 {                         // 'h'
          if body[i+1] == 0x74 {                    // 't'
              if body[i+2] == 0x74 {                // 't'
                  if body[i+3] == 0x70 {            // 'p'
                      if body[i+4] == 0x2d {        // '-'
                          if body[i+5] == 0x30 {    // '0'
                              if body[i+6] == 0x31 { p = i; break }   // '1'
                          }
                      }
                  }
              }
          }
      }
      i = i + 1
  }
  if p < 0 { return 0 }
  // enclosing object: previous '{' .. next '}'
  var obj_start: i64 = p
  while obj_start > start {
      if body[obj_start] == 0x7b { break }          // '{'
      obj_start = obj_start - 1
  }
  var obj_end: i64 = p
  while obj_end < end {
      if body[obj_end] == 0x7d { break }            // '}'
      obj_end = obj_end + 1
  }
  let span: i64 = obj_end - obj_start + 1
  if nx_acme_json_str(body, obj_start, span, "token" as *u8, 5, tok_off, tok_len) != 1 { return 0 }
  if nx_acme_json_str(body, obj_start, span, "url" as *u8, 3, url_off, url_len) != 1 { return 0 }
  return 1
141}
142
143// Extract the idx-th string element of a JSON "key":[ "..", ".." ] array.
144func acme_json_array_nth(buf: *u8, start: i64, n: i64,
                       key: *u8, key_len: i64, idx: i64,
                       out_off: *i64, out_len: *i64) -> i64 {
  let end: i64 = start + n
  var kp: i64 = 0 - 1
  var i: i64 = start
  while i < end - key_len - 1 {
      if buf[i] == 0x22 {
          var m: i64 = 1
          var k: i64 = 0
          while k < key_len { if buf[i + 1 + k] != key[k] { m = 0; break } k = k + 1 }
          if m == 1 { if buf[i + 1 + key_len] == 0x22 { kp = i; break } }
      }
      i = i + 1
  }
  if kp < 0 { return 0 }
  var b: i64 = kp
  while b < end { if buf[b] == 0x5b { break } b = b + 1 }     // '['
  if b >= end { return 0 }
  var e: i64 = b
  while e < end { if buf[e] == 0x5d { break } e = e + 1 }     // ']'
  var c: i64 = b
  var found: i64 = 0
  while c < e {
      if buf[c] == 0x22 {
          let vs: i64 = c + 1
          var ve: i64 = vs
          while ve < e { if buf[ve] == 0x22 { break } ve = ve + 1 }
          if found == idx { out_off[0] = vs; out_len[0] = ve - vs; return 1 }
          found = found + 1
          c = ve + 1
      } else { c = c + 1 }
  }
  return 0
178}
179
180// Validate ONE authorization over HTTP-01: POST-as-GET the authz -> find the
181// http-01 challenge -> compute keyAuth -> write it to the daemon's serve path
182// -> POST the challenge to trigger -> poll the authz until "valid".  Returns
183// the latest Replay-Nonce (or 0 on failure); writes its length to out_nn.
184func acme_do_http01(au: *u8, aun: i64,
                  priv: *i64, kid: *u8, kid_n: i64,
                  px: *i64, py: *i64,
                  store: *TrustStore, now: i64, ct: *u8,
                  nonce: *u8, nonce_n: i64, out_nn: *i64) -> *u8 {
  // fetch authz
  let aj: *u8 = sys_mmap(ACME_MAGIC_8192)
  let ajn: *i64 = sys_mmap(8) as *i64
  if acme_signed_post(priv, kid, kid_n, nonce, nonce_n, au, aun, "" as *u8, 0, aj, ACME_MAGIC_8192, ajn) != 0 { return 0 as *u8 }
  let zb: *u8 = sys_mmap(ACME_MAGIC_16384)
  let zbt: *i64 = sys_mmap(8) as *i64
  if nx_acme_req(au, aun, 1, ct, 21, aj, ajn[0], store, now, zb, ACME_MAGIC_16384, zbt) != NX_ACME_HTTP_OK { return 0 as *u8 }
  let zr: *i64 = nx_http_resp_alloc()
  if nx_http_response_parse(zb, zbt[0], zr) != 0 { return 0 as *u8 }
  if zr[1] != 200 { return 0 as *u8 }
  // If this authz is already "valid" (LE reuses prior validations), skip
  // trigger+poll -- the authz's top-level status is the first "status".
  let aso: *i64 = sys_mmap(8) as *i64
  let asl: *i64 = sys_mmap(8) as *i64
  if nx_acme_json_str(zb, zr[6], zbt[0] - zr[6], "status" as *u8, 6, aso, asl) == 1 {
      if asl[0] == 5 { if zb[aso[0]] == 0x76 {                                  // "valid"
          sys_write(1, "  authz already valid (reused)\n" as *u8, 31)
          return acme_nonce_from(zb, zbt[0], zr, out_nn)
      } }
  }
  let cto: *i64 = sys_mmap(8) as *i64
  let ctl: *i64 = sys_mmap(8) as *i64
  let cuo: *i64 = sys_mmap(8) as *i64
  let cul: *i64 = sys_mmap(8) as *i64
  if acme_find_http01(zb, zr[6], zbt[0] - zr[6], cto, ctl, cuo, cul) != 1 { return 0 as *u8 }
  let token: *u8 = acme_dup_cstr(zb, cto[0], ctl[0])
  let token_n: i64 = ctl[0]
  let chal_url: *u8 = acme_dup_cstr(zb, cuo[0], cul[0])
  let chal_url_n: i64 = cul[0]
  // keyAuth -> serve path
  let ka: *u8 = sys_mmap(256)
  let kan: *i64 = sys_mmap(8) as *i64
  if nx_acme_key_authorization(token, token_n, px, py, ka, 256, kan) != NXACMEES_OK { return 0 as *u8 }
  let kfd2: i64 = sys_openat_wr("/volume1/homes/elderwesto/nishihost/acme-challenge/keyauth\x00" as *u8, 0x1A4)
  if kfd2 > 0 { sys_write(kfd2, ka, kan[0]); sys_close(kfd2) }
  sys_write(1, "  serving keyAuth for token " as *u8, 28); sys_write(1, token, token_n); sys_write(1, "\n" as *u8, 1)
  // trigger
  var cur: *u8 = acme_nonce_from(zb, zbt[0], zr, out_nn)
  if out_nn[0] == 0 { return 0 as *u8 }
  let tjws: *u8 = sys_mmap(ACME_MAGIC_8192)
  let tjn: *i64 = sys_mmap(8) as *i64
  if acme_signed_post(priv, kid, kid_n, cur, out_nn[0], chal_url, chal_url_n, "{}" as *u8, 2, tjws, ACME_MAGIC_8192, tjn) != 0 { return 0 as *u8 }
  let tb: *u8 = sys_mmap(ACME_MAGIC_16384)
  let tbt: *i64 = sys_mmap(8) as *i64
  if nx_acme_req(chal_url, chal_url_n, 1, ct, 21, tjws, tjn[0], store, now, tb, ACME_MAGIC_16384, tbt) != NX_ACME_HTTP_OK { return 0 as *u8 }
  let tr: *i64 = nx_http_resp_alloc()
  nx_http_response_parse(tb, tbt[0], tr)
  cur = acme_nonce_from(tb, tbt[0], tr, out_nn)
  // poll authz valid
  var ai: i64 = 0
  while ai < 40 {
      sys_sleep_ms(ACME_MAGIC_3000)
      let pj: *u8 = sys_mmap(ACME_MAGIC_8192)
      let pjn: *i64 = sys_mmap(8) as *i64
      if acme_signed_post(priv, kid, kid_n, cur, out_nn[0], au, aun, "" as *u8, 0, pj, ACME_MAGIC_8192, pjn) != 0 { return 0 as *u8 }
      let pb: *u8 = sys_mmap(ACME_MAGIC_16384)
      let pbt: *i64 = sys_mmap(8) as *i64
      if nx_acme_req(au, aun, 1, ct, 21, pj, pjn[0], store, now, pb, ACME_MAGIC_16384, pbt) != NX_ACME_HTTP_OK { return 0 as *u8 }
      let pr: *i64 = nx_http_resp_alloc()
      nx_http_response_parse(pb, pbt[0], pr)
      cur = acme_nonce_from(pb, pbt[0], pr, out_nn)
      let so: *i64 = sys_mmap(8) as *i64
      let sl: *i64 = sys_mmap(8) as *i64
      if nx_acme_json_str(pb, pr[6], pbt[0] - pr[6], "status" as *u8, 6, so, sl) == 1 {
          if sl[0] == 5 { if pb[so[0]] == 0x76 { return cur } }                 // "valid"
          if sl[0] == 7 { if pb[so[0]] == 0x69 { return 0 as *u8 } }            // "invalid"
      }
      ai = ai + 1
  }
  return 0 as *u8
259}
260
261func main() -> i64 {
  let cdpath: *u8 = "/tmp/mozilla_certdata.txt\x00"
  let lr: i64 = nx_trust_store_load_from_certdata(cdpath, 300, ACME_MAGIC_4194304)
  if lr <= 0 { sys_write(2, "trust load FAIL\n" as *u8, 16); return 1 }
  let store: *TrustStore = lr as *TrustStore
  let now: i64 = ACME_MAGIC_1779284141
267
  // ---- 1. directory ----
  let dir_url: *u8 = "https://acme-v02.api.letsencrypt.org/directory\x00"
  let buf: *u8 = sys_mmap(ACME_MAGIC_65536)
  let tot: *i64 = sys_mmap(8) as *i64
  let drc: i64 = nx_acme_req(dir_url, 46, 0, 0 as *u8, 0, 0 as *u8, 0, store, now, buf, ACME_MAGIC_65536, tot)
  if drc != NX_ACME_HTTP_OK {
      sys_write(2, "directory FAIL rc=" as *u8, 18)
      let rb: *u8 = sys_mmap(8)
      var av: i64 = drc
      if av < 0 { sys_write(2, "-" as *u8, 1); av = 0 - av }
      rb[0] = (0x30 + (av % 10)) as u8
      sys_write(2, rb, 1); sys_write(2, "\n" as *u8, 1)
      return 2
  }
  let r: *i64 = nx_http_resp_alloc()
  if nx_http_response_parse(buf, tot[0], r) != 0 { return 3 }
  if r[1] != 200 { sys_write(2, "dir!=200\n" as *u8, 9); return 4 }
  let boff: i64 = r[6]
  let blen: i64 = tot[0] - boff
  let vo: *i64 = sys_mmap(8) as *i64
  let vl: *i64 = sys_mmap(8) as *i64
  if nx_acme_json_str(buf, boff, blen, "newAccount" as *u8, 10, vo, vl) != 1 { return 5 }
  let acct_url: *u8 = acme_dup_cstr(buf, vo[0], vl[0])
  let acct_url_n: i64 = vl[0]
  if nx_acme_json_str(buf, boff, blen, "newNonce" as *u8, 8, vo, vl) != 1 { return 6 }
  let nonce_url: *u8 = acme_dup_cstr(buf, vo[0], vl[0])
  let nonce_url_n: i64 = vl[0]
  if nx_acme_json_str(buf, boff, blen, "newOrder" as *u8, 8, vo, vl) != 1 { return 7 }
  let order_url: *u8 = acme_dup_cstr(buf, vo[0], vl[0])
  let order_url_n: i64 = vl[0]
  acme_print("newAccount: " as *u8, 12, acct_url, acct_url_n)
299
  // ---- 2. fresh nonce ----
  let nb: *u8 = sys_mmap(ACME_MAGIC_16384)
  let nbt: *i64 = sys_mmap(8) as *i64
  if nx_acme_req(nonce_url, nonce_url_n, 0, 0 as *u8, 0, 0 as *u8, 0, store, now, nb, ACME_MAGIC_16384, nbt) != NX_ACME_HTTP_OK { return 8 }
  let nr: *i64 = nx_http_resp_alloc()
  if nx_http_response_parse(nb, nbt[0], nr) != 0 { return 9 }
  let nno: *i64 = sys_mmap(8) as *i64
  let nnl: *i64 = sys_mmap(8) as *i64
  if nx_http_response_header(nb, nbt[0], nr, "Replay-Nonce" as *u8, 12, nno, nnl) != 1 { return 10 }
  let nonce: *u8 = acme_dup_cstr(nb, nno[0], nnl[0])
  let nonce_n: i64 = nnl[0]
  acme_print("nonce: " as *u8, 7, nonce, nonce_n)
312
  // ---- 3. account key + new-account JWS ----
  let priv: *i64 = u256_alloc()
  acme_account_key(priv)
  let px: *i64 = u256_alloc()
  let py: *i64 = u256_alloc()
  nx_p256_pubkey_from_priv(priv, px, py)
319
  let email: *u8 = "elderwesto@gmail.com" as *u8
  let jws: *u8 = sys_mmap(ACME_MAGIC_8192)
  let jwsn: *i64 = sys_mmap(8) as *i64
  if nx_acme_build_new_account_jws_es256(priv, px, py, nonce, nonce_n,
                                         acct_url, acct_url_n, email, 20,
                                         jws, ACME_MAGIC_8192, jwsn) != NXACMEES_OK {
      sys_write(2, "JWS build FAIL\n" as *u8, 15); return 11
  }
328
  // ---- 4. POST newAccount ----
  let ct: *u8 = "application/jose+json" as *u8
  let ab: *u8 = sys_mmap(ACME_MAGIC_16384)
  let abt: *i64 = sys_mmap(8) as *i64
  if nx_acme_req(acct_url, acct_url_n, 1, ct, 21, jws, jwsn[0], store, now, ab, ACME_MAGIC_16384, abt) != NX_ACME_HTTP_OK {
      sys_write(2, "newAccount req FAIL\n" as *u8, 20); return 12
  }
  let ar: *i64 = nx_http_resp_alloc()
  if nx_http_response_parse(ab, abt[0], ar) != 0 { return 13 }
338
  // status
  let sc: i64 = ar[1]
  let scb: *u8 = sys_mmap(8)
  scb[0] = (0x30 + (sc / 100)) as u8
  scb[1] = (0x30 + ((sc / 10) % 10)) as u8
  scb[2] = (0x30 + (sc % 10)) as u8
  acme_print("newAccount status: " as *u8, 19, scb, 3)
346
  if sc != 200 { if sc != 201 {
      let bo2: i64 = ar[6]
      sys_write(2, "newAccount FAIL body:\n" as *u8, 22)
      sys_write(2, ab + bo2, abt[0] - bo2); sys_write(2, "\n" as *u8, 1)
      return 20
  } }
  // account kid (Location header)
  let lo: *i64 = sys_mmap(8) as *i64
  let ll: *i64 = sys_mmap(8) as *i64
  if nx_http_response_header(ab, abt[0], ar, "Location" as *u8, 8, lo, ll) != 1 { return 21 }
  let kid: *u8 = acme_dup_cstr(ab, lo[0], ll[0])
  let kid_n: i64 = ll[0]
  acme_print("account kid: " as *u8, 13, kid, kid_n)
  // nonce for next request from the newAccount response
  let n2o: *i64 = sys_mmap(8) as *i64
  let n2l: *i64 = sys_mmap(8) as *i64
  if nx_http_response_header(ab, abt[0], ar, "Replay-Nonce" as *u8, 12, n2o, n2l) != 1 { return 22 }
  var nonce2: *u8 = acme_dup_cstr(ab, n2o[0], n2l[0])
  var nonce2_n: i64 = n2l[0]
366
  // ---- 5. newOrder (2 domains: andelinwest.com + nishifamily.com) ----
  let dp: *i64 = sys_mmap(32) as *i64
  let dl: *i64 = sys_mmap(32) as *i64
  dp[0] = ("andelinwest.com" as *u8) as i64; dl[0] = 15
  dp[1] = ("nishifamily.com" as *u8) as i64; dl[1] = 15
  let opay: *u8 = sys_mmap(512)
  let opoff: *i64 = sys_mmap(8) as *i64
  opoff[0] = 0
  if nx_acme_payload_new_order(opay, opoff, 512, dp, dl, 2) != NXACMEES_OK { return 30 }
  let ojws: *u8 = sys_mmap(ACME_MAGIC_8192)
  let ojn: *i64 = sys_mmap(8) as *i64
  if acme_signed_post(priv, kid, kid_n, nonce2, nonce2_n, order_url, order_url_n, opay, opoff[0], ojws, ACME_MAGIC_8192, ojn) != 0 { return 31 }
  let ob: *u8 = sys_mmap(ACME_MAGIC_16384)
  let obt: *i64 = sys_mmap(8) as *i64
  if nx_acme_req(order_url, order_url_n, 1, ct, 21, ojws, ojn[0], store, now, ob, ACME_MAGIC_16384, obt) != NX_ACME_HTTP_OK { return 32 }
  let orr: *i64 = nx_http_resp_alloc()
  if nx_http_response_parse(ob, obt[0], orr) != 0 { return 33 }
  if orr[1] != 201 {
      sys_write(2, "newOrder body:\n" as *u8, 15); sys_write(2, ob + orr[6], obt[0] - orr[6]); sys_write(2, "\n" as *u8, 1)
      return 34
  }
  sys_write(1, "newOrder 201 (2 domains)\n" as *u8, 25)
  let oolo: *i64 = sys_mmap(8) as *i64
  let ooll: *i64 = sys_mmap(8) as *i64
  var the_order_url: *u8 = 0 as *u8
  var the_order_url_n: i64 = 0
  if nx_http_response_header(ob, obt[0], orr, "Location" as *u8, 8, oolo, ooll) == 1 {
      the_order_url = acme_dup_cstr(ob, oolo[0], ooll[0]); the_order_url_n = ooll[0]
  }
  let obody: i64 = orr[6]
  let oblen: i64 = obt[0] - obody
  let fvo: *i64 = sys_mmap(8) as *i64
  let fvl: *i64 = sys_mmap(8) as *i64
  if nx_acme_json_str(ob, obody, oblen, "finalize" as *u8, 8, fvo, fvl) != 1 { return 35 }
  let finalize_url: *u8 = acme_dup_cstr(ob, fvo[0], fvl[0])
  let finalize_url_n: i64 = fvl[0]
  // both authz URLs (one per domain)
  let a0o: *i64 = sys_mmap(8) as *i64; let a0l: *i64 = sys_mmap(8) as *i64
  let a1o: *i64 = sys_mmap(8) as *i64; let a1l: *i64 = sys_mmap(8) as *i64
  if acme_json_array_nth(ob, obody, oblen, "authorizations" as *u8, 14, 0, a0o, a0l) != 1 { return 36 }
  if acme_json_array_nth(ob, obody, oblen, "authorizations" as *u8, 14, 1, a1o, a1l) != 1 { return 37 }
  let az0: *u8 = acme_dup_cstr(ob, a0o[0], a0l[0]); let az0n: i64 = a0l[0]
  let az1: *u8 = acme_dup_cstr(ob, a1o[0], a1l[0]); let az1n: i64 = a1l[0]
  // nonce from order response
  let n3o: *i64 = sys_mmap(8) as *i64
  let n3l: *i64 = sys_mmap(8) as *i64
  if nx_http_response_header(ob, obt[0], orr, "Replay-Nonce" as *u8, 12, n3o, n3l) != 1 { return 38 }
  var nonce3: *u8 = acme_dup_cstr(ob, n3o[0], n3l[0])
  var nn: i64 = n3l[0]
416
  // ---- 6-9. validate BOTH authorizations over HTTP-01 (sequential) ----
  sys_write(1, "validating authz #1...\n" as *u8, 23)
  nonce3 = acme_do_http01(az0, az0n, priv, kid, kid_n, px, py, store, now, ct, nonce3, nn, &nn)
  if (nonce3 as i64) == 0 { sys_write(2, "authz#1 FAIL\n" as *u8, 12); return 50 }
  sys_write(1, "authz #1 VALID\n" as *u8, 15)
  sys_write(1, "validating authz #2...\n" as *u8, 23)
  nonce3 = acme_do_http01(az1, az1n, priv, kid, kid_n, px, py, store, now, ct, nonce3, nn, &nn)
  if (nonce3 as i64) == 0 { sys_write(2, "authz#2 FAIL\n" as *u8, 12); return 51 }
  sys_write(1, "authz #2 VALID\n" as *u8, 15)
426
  // ---- 10. cert key (separate persistent P-256) ----
  let cpriv_be: *u8 = sys_mmap(32)
  let ckfd: i64 = sys_openat_rd("/tmp/acme_cert_key.bin\x00" as *u8)
  if ckfd > 0 {
      let cn2: i64 = sys_read(ckfd, cpriv_be, 32); sys_close(ckfd)
      if cn2 != 32 { nx_csprng_fill(cpriv_be, 32) }
  } else {
      nx_csprng_fill(cpriv_be, 32)
      let cwf: i64 = sys_openat_wr("/tmp/acme_cert_key.bin\x00" as *u8, 0x180)
      if cwf > 0 { sys_write(cwf, cpriv_be, 32); sys_close(cwf) }
  }
  let cpriv: *i64 = u256_alloc(); u256_load_be(cpriv, cpriv_be)
  let cpx: *i64 = u256_alloc()
  let cpy: *i64 = u256_alloc()
  nx_p256_pubkey_from_priv(cpriv, cpx, cpy)
442
  // ---- 11. CSR (CN=andelinwest.com, SAN both domains) ----
  let sp: *i64 = sys_mmap(32) as *i64
  let sln: *i64 = sys_mmap(32) as *i64
  sp[0] = ("andelinwest.com" as *u8) as i64; sln[0] = 15
  sp[1] = ("nishifamily.com" as *u8) as i64; sln[1] = 15
  let csr: *u8 = sys_mmap(ACME_MAGIC_2048)
  let csrn: *i64 = sys_mmap(8) as *i64
  if nx_acme_build_csr_ecdsa_p256("andelinwest.com" as *u8, 15, sp, sln, 2, cpriv, cpx, cpy, csr, ACME_MAGIC_2048, csrn) != 0 { return 70 }
451
  // ---- 12. finalize (POST the CSR) ----
  let fpay: *u8 = sys_mmap(ACME_MAGIC_4096)
  let fpo: *i64 = sys_mmap(8) as *i64
  fpo[0] = 0
  if nx_acme_payload_finalize(fpay, fpo, ACME_MAGIC_4096, csr, csrn[0]) != NXACMEES_OK { return 71 }
  let fjws: *u8 = sys_mmap(ACME_MAGIC_8192)
  let fjn: *i64 = sys_mmap(8) as *i64
  if acme_signed_post(priv, kid, kid_n, nonce3, nn, finalize_url, finalize_url_n, fpay, fpo[0], fjws, ACME_MAGIC_8192, fjn) != 0 { return 72 }
  let fb: *u8 = sys_mmap(ACME_MAGIC_16384)
  let fbt: *i64 = sys_mmap(8) as *i64
  if nx_acme_req(finalize_url, finalize_url_n, 1, ct, 21, fjws, fjn[0], store, now, fb, ACME_MAGIC_16384, fbt) != NX_ACME_HTTP_OK { return 73 }
  let fr: *i64 = nx_http_resp_alloc()
  nx_http_response_parse(fb, fbt[0], fr)
  nonce3 = acme_nonce_from(fb, fbt[0], fr, &nn)
  sys_write(1, "finalize posted\n" as *u8, 16)
467
  // ---- 13. poll the order until the certificate URL appears ----
  var oi: i64 = 0
  var cert_url: *u8 = 0 as *u8
  var cert_url_n: i64 = 0
  while oi < 40 {
      sys_sleep_ms(ACME_MAGIC_3000)
      let qj: *u8 = sys_mmap(ACME_MAGIC_8192)
      let qjn: *i64 = sys_mmap(8) as *i64
      if acme_signed_post(priv, kid, kid_n, nonce3, nn, the_order_url, the_order_url_n, "" as *u8, 0, qj, ACME_MAGIC_8192, qjn) != 0 { return 74 }
      let qb: *u8 = sys_mmap(ACME_MAGIC_16384)
      let qbt: *i64 = sys_mmap(8) as *i64
      if nx_acme_req(the_order_url, the_order_url_n, 1, ct, 21, qj, qjn[0], store, now, qb, ACME_MAGIC_16384, qbt) != NX_ACME_HTTP_OK { return 75 }
      let qr: *i64 = nx_http_resp_alloc()
      nx_http_response_parse(qb, qbt[0], qr)
      nonce3 = acme_nonce_from(qb, qbt[0], qr, &nn)
      let cvo: *i64 = sys_mmap(8) as *i64
      let cvl: *i64 = sys_mmap(8) as *i64
      if nx_acme_json_str(qb, qr[6], qbt[0] - qr[6], "certificate" as *u8, 11, cvo, cvl) == 1 {
          cert_url = acme_dup_cstr(qb, cvo[0], cvl[0]); cert_url_n = cvl[0]; oi = 40
      }
      oi = oi + 1
  }
  if (cert_url as i64) == 0 { sys_write(2, "order poll: no cert url\n" as *u8, 24); return 76 }
  acme_print("certificate url: " as *u8, 17, cert_url, cert_url_n)
492
  // ---- 14. download the cert chain (PEM) ----
  let dj: *u8 = sys_mmap(ACME_MAGIC_8192)
  let djn: *i64 = sys_mmap(8) as *i64
  if acme_signed_post(priv, kid, kid_n, nonce3, nn, cert_url, cert_url_n, "" as *u8, 0, dj, ACME_MAGIC_8192, djn) != 0 { return 77 }
  let dbb: *u8 = sys_mmap(ACME_MAGIC_65536)
  let dbt: *i64 = sys_mmap(8) as *i64
  if nx_acme_req(cert_url, cert_url_n, 1, ct, 21, dj, djn[0], store, now, dbb, ACME_MAGIC_65536, dbt) != NX_ACME_HTTP_OK { return 78 }
  let dr: *i64 = nx_http_resp_alloc()
  nx_http_response_parse(dbb, dbt[0], dr)
  let pem_off: i64 = dr[6]
  let pem_n: i64 = dbt[0] - pem_off
  let cfd3: i64 = sys_openat_wr("/volume1/homes/elderwesto/nishihost/certs/andelinwest_fullchain.pem\x00" as *u8, 0x1A4)
  if cfd3 > 0 { sys_write(cfd3, dbb + pem_off, pem_n); sys_close(cfd3) }
  let cfd4: i64 = sys_openat_wr("/tmp/andelinwest_fullchain.pem\x00" as *u8, 0x1A4)
  if cfd4 > 0 { sys_write(cfd4, dbb + pem_off, pem_n); sys_close(cfd4) }
  sys_write(1, "*** CERT ISSUED -- fullchain PEM saved ***\n" as *u8, 43)
  sys_write(1, dbb + pem_off, pem_n); sys_write(1, "\n" as *u8, 1)
  return 0
511}
nx_acme_issue.nx source

`nx_acme_issue.nx` source
