acme-not-a-joke: a very serious certificate seal

acme-not-a-joke

A Haskell library of primitives to perform ACME certifications (RFC 8555): the protocol by which a provider such as Let’s Encrypt issues TLS certificates.

The package is named acme-not-a-joke because acme- packages on Hackage typically are “joke” packages. This one is not.

New: acme-not-a-joke 0.2.0.0 is on Hackage, together with the first releases of acme-not-a-joke-wai and acme-not-a-joke-warp (automatic HTTPS for warp). It adds TLS-ALPN-01 challenges (certificates without port 80), wildcard and multi-name certificates over DNS-01, certificate revocation, account key rollover and deactivation, and EC/EdDSA account keys. Read what’s new in 0.2.0.0.

import Acme.NotAJoke.Api.Account
import Acme.NotAJoke.Api.Directory
import Acme.NotAJoke.Api.Endpoint
import Acme.NotAJoke.Api.Nonce
import Acme.NotAJoke.KeyManagement
import Acme.NotAJoke.LetsEncrypt

Right jwk <- loadOrCreateJWKFile "staging/key.jwk"
let contacts = ["mailto:certmaster@dicioccio.fr"]

Right leDir <- fetchDirectory (directory staging_letsencryptv2)
Right nonce0 <- getNonce leDir.newNonce
created <- postCreateAccount jwk leDir.newAccount nonce0 (createAccount contacts)
either (\err -> print (readProblem err)) print created

The library is subject to changes, but it covers the life of a certificate: create an account, place an order, answer a DNS-01, HTTP-01 or TLS-ALPN-01 challenge, fetch the certificate, and revoke it; change the account key or deactivate the account. API calls return an Either AcmeError a rather than throw.

Three packages, on Hackage:

The code is on GitHub at lucasdicioccio/acme-not-a-joke.

Explore