func OrderedHTTPSRRALPN(alpnSet map[string]struct{}) []string

type ACMEIssuer struct {


	CA string `json:"ca,omitempty"`


	TestCA string `json:"test_ca,omitempty"`


	Email string `json:"email,omitempty"`


	Profile string `json:"profile,omitempty"`


	AccountKey string `json:"account_key,omitempty"`


	ExternalAccount *acme.EAB `json:"external_account,omitempty"`


	ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"`

	Challenges *ChallengesConfig `json:"challenges,omitempty"`


	TrustedRootsPEMFiles []string `json:"trusted_roots_pem_files,omitempty"`


	PreferredChains *ChainPreference `json:"preferred_chains,omitempty"`


	CertificateLifetime caddy.Duration `json:"certificate_lifetime,omitempty"`

	NetworkProxyRaw json.RawMessage `json:"network_proxy,omitempty" caddy:"namespace=caddy.network_proxy inline_key=from"`
}

CaddyModule returns the Caddy module information.

func (iss *ACMEIssuer) GetACMEIssuer() *ACMEIssuer

GetACMEIssuer returns iss. This is useful when other types embed ACMEIssuer, because type-asserting them to *ACMEIssuer will fail, but type-asserting them to an interface with only this method will succeed, and will still allow the embedded ACMEIssuer to be accessed and manipulated.

GetRenewalInfo wraps the underlying GetRenewalInfo method and satisfies the CertMagic interface for ARI support.

Issue obtains a certificate for the given csr.

IssuerKey returns the unique issuer key for the configured CA endpoint.

PreCheck implements the certmagic.PreChecker interface.

Provision sets up iss.

Revoke revokes the given certificate.

SetConfig sets the associated certmagic config for this issuer. This is required because ACME needs values from the config in order to solve the challenges during issuance. This implements the ConfigSetter interface.

UnmarshalCaddyfile deserializes Caddyfile tokens into iss.

... acme [<directory_url>] {
    dir <directory_url>
    test_dir <test_directory_url>
    email <email>
    profile <profile_name>
    timeout <duration>
    disable_http_challenge
    disable_tlsalpn_challenge
    alt_http_port    <port>
    alt_tlsalpn_port <port>
    eab <key_id> <mac_key>
    trusted_roots <pem_files...>
    dns <provider_name> [<options>]
    propagation_delay <duration>
    propagation_timeout <duration>
    resolvers <dns_servers...>
    dns_ttl <duration>
    dns_challenge_override_domain <domain>
    preferred_chains [smallest] {
        root_common_name <common_names...>
        any_common_name  <common_names...>
    }
}

CaddyModule returns the Caddy module information.

type AutomationConfig struct {


	Policies []*AutomationPolicy `json:"policies,omitempty"`


	OnDemand *OnDemandConfig `json:"on_demand,omitempty"`


	OCSPCheckInterval caddy.Duration `json:"ocsp_interval,omitempty"`


	RenewCheckInterval caddy.Duration `json:"renew_interval,omitempty"`


	StorageCleanInterval caddy.Duration `json:"storage_clean_interval,omitempty"`
}

type AutomationPolicy struct {


	SubjectsRaw []string `json:"subjects,omitempty"`


	IssuersRaw []json.RawMessage `json:"issuers,omitempty" caddy:"namespace=tls.issuance inline_key=module"`


	ManagersRaw []json.RawMessage `json:"get_certificate,omitempty" caddy:"namespace=tls.get_certificate inline_key=via"`


	MustStaple bool `json:"must_staple,omitempty"`


	RenewalWindowRatio float64 `json:"renewal_window_ratio,omitempty"`


	KeyType string `json:"key_type,omitempty"`


	StorageRaw json.RawMessage `json:"storage,omitempty" caddy:"namespace=caddy.storage inline_key=module"`


	OnDemand bool `json:"on_demand,omitempty"`


	ReusePrivateKeys bool `json:"reuse_private_keys,omitempty"`


	DisableOCSPStapling bool `json:"disable_ocsp_stapling,omitempty"`


	OCSPOverrides map[string]string `json:"ocsp_overrides,omitempty"`
	Issuers  []certmagic.Issuer  `json:"-"`
	Managers []certmagic.Manager `json:"-"`

}

func (ap *AutomationPolicy) AllInternalSubjects() bool

AllInternalSubjects returns true if all the subjects on this policy are internal.

func (ap *AutomationPolicy) IsProvisioned() bool

IsProvisioned reports whether the automation policy has been provisioned. A provisioned policy has an initialized CertMagic instance (i.e. ap.magic != nil).

func (ap *AutomationPolicy) Provision(tlsApp *TLS) error

Provision sets up ap and builds its underlying CertMagic config.

func (ap *AutomationPolicy) RebuildCertMagic(tlsApp *TLS) error

RebuildCertMagic rebuilds the policy's CertMagic configuration from the policy's already-populated fields (Issuers, Managers, storage, etc.) and replaces the internal CertMagic instance. This is a lightweight alternative to calling Provision because it does not re-provision modules or re-run module Provision; instead, it constructs a new certmagic.Config and calls SetConfig on issuers so they receive updated templates (for example, alternate HTTP/TLS ports supplied by the HTTP app). RebuildCertMagic should only be called when the policy's required fields are already populated.

Subjects returns the list of subjects with all placeholders replaced.

type CertCacheOptions struct {


	Capacity int `json:"capacity,omitempty"`
}

type CertKeyFilePair struct {

	Certificate string `json:"certificate"`

	Key string `json:"key"`

	Format string `json:"format,omitempty"`


	Tags []string `json:"tags,omitempty"`
}

type CertKeyPEMPair struct {

	CertificatePEM string `json:"certificate"`

	KeyPEM string `json:"key"`


	Tags []string `json:"tags,omitempty"`
}

type CertificateLoader interface {
	LoadCertificates() ([]Certificate, error)
}

type ChainPreference struct {

	Smallest *bool `json:"smallest,omitempty"`


	RootCommonName []string `json:"root_common_name,omitempty"`


	AnyCommonName []string `json:"any_common_name,omitempty"`
}

type ChallengesConfig struct {


	HTTP *HTTPChallengeConfig `json:"http,omitempty"`


	TLSALPN *TLSALPNChallengeConfig `json:"tls-alpn,omitempty"`


	DNS *DNSChallengeConfig `json:"dns,omitempty"`


	BindHost string `json:"bind_host,omitempty"`


	Distributed *bool `json:"distributed,omitempty"`
}

type ClientAuthentication struct {

	CARaw json.RawMessage `json:"ca,omitempty" caddy:"namespace=tls.ca_pool.source inline_key=provider"`


	TrustedCACerts []string `json:"trusted_ca_certs,omitempty"`


	TrustedCACertPEMFiles []string `json:"trusted_ca_certs_pem_files,omitempty"`


	TrustedLeafCerts []string `json:"trusted_leaf_certs,omitempty"`


	VerifiersRaw []json.RawMessage `json:"verifiers,omitempty" caddy:"namespace=tls.client_auth.verifier inline_key=verifier"`


	Mode string `json:"mode,omitempty"`
}

func (clientauth ClientAuthentication) Active() bool

Active returns true if clientauth has an actionable configuration.

ConfigureTLSConfig sets up cfg to enforce clientauth's configuration.

UnmarshalCaddyfile parses the Caddyfile segment to set up the client authentication. Syntax:

client_auth {
	mode                   [request|require|verify_if_given|require_and_verify]
 	trust_pool			   <module> {
		...
	}
	verifier               <module>
}

If `mode` is not provided, it defaults to `require_and_verify` if `trust_pool` is provided. Otherwise, it defaults to `require`.

type ClientCertificateVerifier interface {
	VerifyClientCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
}

type CombinedCAPool struct {

	SourcesRaw []json.RawMessage `json:"sources,omitempty" caddy:"namespace=tls.ca_pool.source inline_key=provider"`
}

CaddyModule implements caddy.Module.

CertPool implements CA.

Certificates implements CertificateProvider.

Provision implements caddy.Provisioner.

Syntax:

trust_pool combined {
	source <module_name> {
		<module_config>
	}
}

The 'source' directive can be specified multiple times. Sources that don't implement CertificateProvider (like 'system') cannot be combined.

type ConnectionPolicies []*ConnectionPolicy

Provision sets up each connection policy. It should be called during the Validate() phase, after the TLS app (if any) is already set up.

TLSConfig returns a standard-lib-compatible TLS configuration which selects the first matching policy based on the ClientHello.

type ConnectionPolicy struct {


	MatchersRaw caddy.ModuleMap `json:"match,omitempty" caddy:"namespace=tls.handshake_match"`


	CertSelection *CustomCertSelectionPolicy `json:"certificate_selection,omitempty"`


	CipherSuites []string `json:"cipher_suites,omitempty"`


	Curves []string `json:"curves,omitempty"`


	ALPN []string `json:"alpn,omitempty"`

	ProtocolMin string `json:"protocol_min,omitempty"`

	ProtocolMax string `json:"protocol_max,omitempty"`

	Drop bool `json:"drop,omitempty"`

	ClientAuthentication *ClientAuthentication `json:"client_authentication,omitempty"`


	DefaultSNI string `json:"default_sni,omitempty"`


	FallbackSNI string `json:"fallback_sni,omitempty"`


	InsecureSecretsLog string `json:"insecure_secrets_log,omitempty"`


	HandshakeContextRaw json.RawMessage `json:"handshake_context,omitempty" caddy:"namespace=tls.context inline_key=module"`


	TLSConfig *tls.Config `json:"-"`
}

func (p ConnectionPolicy) SettingsEmpty() bool

SettingsEmpty returns true if p's settings (fields except the matchers) are all empty/unset.

SettingsEqual returns true if p's settings (fields except the matchers) are the same as q.

UnmarshalCaddyfile sets up the ConnectionPolicy from Caddyfile tokens. Syntax:

connection_policy {
	alpn                  <values...>
	cert_selection {
		...
	}
	ciphers               <cipher_suites...>
	client_auth {
		...
	}
	curves                <curves...>
	default_sni           <server_name>
	match {
		...
	}
	protocols             <min> [<max>]
	# EXPERIMENTAL:
	drop
	fallback_sni          <server_name>
	insecure_secrets_log  <log_file>
}

type CustomCertSelectionPolicy struct {

	SerialNumber []bigInt `json:"serial_number,omitempty"`

	SubjectOrganization []string `json:"subject_organization,omitempty"`

	PublicKeyAlgorithm PublicKeyAlgorithm `json:"public_key_algorithm,omitempty"`

	AnyTag []string `json:"any_tag,omitempty"`

	AllTags []string `json:"all_tags,omitempty"`
}

SelectCertificate implements certmagic.CertificateSelector. It only chooses a certificate that at least meets the criteria in p. It then chooses the first non-expired certificate that is compatible with the client. If none are valid, it chooses the first viable candidate anyway.

UnmarshalCaddyfile sets up the CustomCertSelectionPolicy from Caddyfile tokens. Syntax:

cert_selection {
	all_tags             <values...>
	any_tag              <values...>
	public_key_algorithm <dsa|ecdsa|rsa>
	serial_number        <big_integers...>
	subject_organization <values...>
}

type DNSChallengeConfig struct {


	ProviderRaw json.RawMessage `json:"provider,omitempty" caddy:"namespace=dns.providers inline_key=name"`

	TTL caddy.Duration `json:"ttl,omitempty"`


	PropagationDelay caddy.Duration `json:"propagation_delay,omitempty"`


	PropagationTimeout caddy.Duration `json:"propagation_timeout,omitempty"`


	Resolvers []string `json:"resolvers,omitempty"`


	OverrideDomain string `json:"override_domain,omitempty"`
}

type ECH struct {


	Configs []ECHConfiguration `json:"configs,omitempty"`


	Publication []*ECHPublication `json:"publication,omitempty"`
}

Provision loads or creates ECH configs and returns outer names (for certificate management), but does not publish any ECH configs. The DNS module is used as a default for later publishing if needed.

type ECHConfiguration struct {


	PublicName string `json:"public_name"`
}

type ECHDNSPublisher struct {

	ProviderRaw json.RawMessage `json:"provider,omitempty" caddy:"namespace=dns.providers inline_key=name"`
}

CaddyModule returns the Caddy module information.

PublishECHConfigList publishes the given ECH config list (as binary) to the given DNS names. If there is an error, it may be of type PublishECHConfigListErrors, detailing potentially multiple errors keyed by associated innerName.

PublisherKey returns the name of the DNS provider module. We intentionally omit specific provider configuration (or a hash thereof, since the config is likely sensitive, potentially containing an API key) because it is unlikely that specific configuration, such as an API key, is relevant to unique key use as an ECH config publisher.

type ECHPublication struct {


	Configs []string `json:"configs,omitempty"`


	Domains []string `json:"domains,omitempty"`


	PublishersRaw caddy.ModuleMap `json:"publishers,omitempty" caddy:"namespace=tls.ech.publishers"`
}

type FileCAPool struct {


	TrustedCACertPEMFiles []string `json:"pem_files,omitempty"`
}

CaddyModule implements caddy.Module.

Certificates implements CertificateProvider.

Loads and decodes the DER and pem files to generate the certificate pool

Syntax:

trust_pool file [<pem_file>...] {
	pem_file <pem_file>...
}

The 'pem_file' directive can be specified multiple times.

type FileLoader []CertKeyFilePair

CaddyModule returns the Caddy module information.

func (fl FileLoader) LoadCertificates() ([]Certificate, error)

LoadCertificates returns the certificates to be loaded by fl.

Provision implements caddy.Provisioner.

CaddyModule returns the Caddy module information.

func (fl FolderLoader) LoadCertificates() ([]Certificate, error)

LoadCertificates loads all the certificates+keys in the directories listed in fl from all files ending with .pem. This method of loading certificates expects the certificate and key to be bundled into the same file.

Provision implements caddy.Provisioner.

type HTTPCertGetter struct {


	URL string `json:"url,omitempty"`
}

CaddyModule returns the Caddy module information.

UnmarshalCaddyfile deserializes Caddyfile tokens into ts.

... http <url>

type HTTPCertPool struct {

	Endpoints []string `json:"endpoints,omitempty"`

	TLS *TLSConfig `json:"tls,omitempty"`
}

CaddyModule implements caddy.Module.

CertPool return the certificate pool generated from the HTTP responses

Certificates implements CertificateProvider.

Provision implements caddy.Provisioner.

Syntax:

trust_pool http [<endpoints...>] {
		endpoints 	<endpoints...>
		tls 		<tls_config>
}

tls_config:

	ca <ca_module>
	insecure_skip_verify
	handshake_timeout <duration>
	server_name <name>
	renegotiation <never|once|freely>
<ca_module> is the name of the CA module to source the trust

certificate pool and follows the syntax of the named CA module.

func (hcp HTTPCertPool) Validate() (err error)

report error if the endpoints are not valid URLs

type HTTPChallengeConfig struct {

	Disabled bool `json:"disabled,omitempty"`


	AlternatePort int `json:"alternate_port,omitempty"`
}

type InlineCAPool struct {


	TrustedCACerts []string `json:"trusted_ca_certs,omitempty"`
}

CaddyModule implements caddy.Module.

CertPool implements CA.

Certificates implements CertificateProvider.

Provision implements caddy.Provisioner.

Syntax:

trust_pool inline {
	trust_der <base64_der_cert>...
}

The 'trust_der' directive can be specified multiple times.

type InternalIssuer struct {


	CA string `json:"ca,omitempty"`

	Lifetime caddy.Duration `json:"lifetime,omitempty"`


	SignWithRoot bool `json:"sign_with_root,omitempty"`
}

CaddyModule returns the Caddy module information.

Issue issues a certificate to satisfy the CSR.

IssuerKey returns the unique issuer key for the configured CA endpoint.

Provision sets up the issuer.

UnmarshalCaddyfile deserializes Caddyfile tokens into iss.

... internal {
    ca       <name>
    lifetime <duration>
    sign_with_root
}

type LeafCertClientAuth struct {
	LeafCertificateLoadersRaw []json.RawMessage `json:"leaf_certs_loaders,omitempty" caddy:"namespace=tls.leaf_cert_loader inline_key=loader"`

}

CaddyModule returns the Caddy module information.

UnmarshalCaddyfile implements caddyfile.Unmarshaler.

type LeafFileLoader struct {
	Files []string `json:"files,omitempty"`
}

CaddyModule returns the Caddy module information.

LoadLeafCertificates returns the certificates to be loaded by fl.

Provision implements caddy.Provisioner.

UnmarshalCaddyfile implements caddyfile.Unmarshaler.

type LeafFolderLoader struct {
	Folders []string `json:"folders,omitempty"`
}

CaddyModule returns the Caddy module information.

LoadLeafCertificates loads all the leaf certificates in the directories listed in fl from all files ending with .pem.

Provision implements caddy.Provisioner.

UnmarshalCaddyfile implements caddyfile.Unmarshaler.

type LeafPEMLoader struct {
	Certificates []string `json:"certificates,omitempty"`
}

CaddyModule returns the Caddy module information.

LoadLeafCertificates returns the certificates contained in pl.

Provision implements caddy.Provisioner.

UnmarshalCaddyfile implements caddyfile.Unmarshaler.

type LeafStorageLoader struct {

	Certificates []string `json:"certificates,omitempty"`


	StorageRaw json.RawMessage `json:"storage,omitempty" caddy:"namespace=caddy.storage inline_key=module"`
}

CaddyModule returns the Caddy module information.

LoadLeafCertificates returns the certificates to be loaded by sl.

Provision loads the storage module for sl.

type MatchLocalIP struct {

	Ranges []string `json:"ranges,omitempty"`
}

CaddyModule returns the Caddy module information.

Match matches hello based on the connection's remote IP.

Provision parses m's IP ranges, either from IP or CIDR expressions.

UnmarshalCaddyfile sets up the MatchLocalIP from Caddyfile tokens. Syntax:

local_ip <ranges...>

type MatchRegexp struct {


	Name string `json:"name,omitempty"`


	Pattern string `json:"pattern"`
}

Match returns true if input matches the compiled regular expression in m. It sets values on the replacer repl associated with capture groups, using the given scope (namespace).

Provision compiles the regular expression which may include placeholders.

UnmarshalCaddyfile implements caddyfile.Unmarshaler.

Validate ensures mre is set up correctly.

type MatchRemoteIP struct {

	Ranges []string `json:"ranges,omitempty"`

	NotRanges []string `json:"not_ranges,omitempty"`
}

CaddyModule returns the Caddy module information.

Match matches hello based on the connection's remote IP.

Provision parses m's IP ranges, either from IP or CIDR expressions.

UnmarshalCaddyfile sets up the MatchRemoteIP from Caddyfile tokens. Syntax:

remote_ip <ranges...>

Note: IPs and CIDRs prefixed with ! symbol are treated as not_ranges

CaddyModule returns the Caddy module information.

Match matches hello based on SNI.

UnmarshalCaddyfile sets up the MatchServerName from Caddyfile tokens. Syntax:

sni <domains...>

type MatchServerNameRE struct{ MatchRegexp }

CaddyModule returns the Caddy module information.

Match matches hello based on SNI using a regular expression.

type OnDemandConfig struct {

	Ask string `json:"ask,omitempty"`


	PermissionRaw json.RawMessage `json:"permission,omitempty" caddy:"namespace=tls.permission inline_key=module"`
}

type PEMLoader []CertKeyPEMPair

CaddyModule returns the Caddy module information.

func (pl PEMLoader) LoadCertificates() ([]Certificate, error)

LoadCertificates returns the certificates contained in pl.

Provision implements caddy.Provisioner.

type PKIIntermediateCAPool struct {

	Authority []string `json:"authority,omitempty"`
}

CaddyModule implements caddy.Module.

return the certificate pool generated with intermediate certificates from the PKI app

Certificates implements CertificateProvider.

Loads the PKI app and loads the intermediate certificates into the certificate pool

Syntax:

trust_pool pki_intermediate [<ca_name>...] {
	authority <ca_name>...
}

The 'authority' directive can be specified multiple times.

type PKIRootCAPool struct {

	Authority []string `json:"authority,omitempty"`
}

CaddyModule implements caddy.Module.

return the certificate pool generated with root certificates from the PKI app

Certificates implements CertificateProvider.

Loads the PKI app and load the root certificates into the certificate pool

Syntax:

trust_pool pki_root [<ca_name>...] {
	authority <ca_name>...
}

The 'authority' directive can be specified multiple times.

type PermissionByHTTP struct {


	Endpoint string `json:"endpoint"`
}

CaddyModule returns the Caddy module information.

UnmarshalCaddyfile implements caddyfile.Unmarshaler.

UnmarshalJSON satisfies json.Unmarshaler.

type STEKProvider interface {


	Initialize(config *SessionTicketService) ([][32]byte, error)


	Next(doneChan <-chan struct{}) (keysChan <-chan [][32]byte)
}

type SessionTicketService struct {


	KeySource json.RawMessage `json:"key_source,omitempty" caddy:"namespace=tls.stek inline_key=provider"`

	RotationInterval caddy.Duration `json:"rotation_interval,omitempty"`

	MaxKeys int `json:"max_keys,omitempty"`

	DisableRotation bool `json:"disable_rotation,omitempty"`

	Disabled bool `json:"disabled,omitempty"`
}

RotateSTEKs rotates the keys in keys by producing a new key and eliding the oldest one. The new slice of keys is returned.

type StorageLoader struct {


	Pairs []CertKeyFilePair `json:"pairs,omitempty"`
}

CaddyModule returns the Caddy module information.

func (sl StorageLoader) LoadCertificates() ([]Certificate, error)

LoadCertificates returns the certificates to be loaded by sl.

Provision loads the storage module for sl.

type StoragePool struct {


	StorageRaw json.RawMessage `json:"storage,omitempty" caddy:"namespace=caddy.storage inline_key=module"`

	PEMKeys []string `json:"pem_keys,omitempty"`
}

CaddyModule implements caddy.Module.

Certificates implements CertificateProvider.

Provision implements caddy.Provisioner.

Syntax:

trust_pool storage [<storage_keys>...] {
	storage <storage_module>
	keys	<storage_keys>...
}

The 'keys' directive can be specified multiple times. The'storage' directive is optional and defaults to the default storage module.

type SystemCAPool struct {
}

CaddyModule implements caddy.Module.

CertPool implements CA.

Provision implements caddy.Provisioner.

type TLS struct {


	CertificatesRaw caddy.ModuleMap `json:"certificates,omitempty" caddy:"namespace=tls.certificates"`

	Automation *AutomationConfig `json:"automation,omitempty"`

	SessionTickets *SessionTicketService `json:"session_tickets,omitempty"`

	Cache *CertCacheOptions `json:"cache,omitempty"`


	DisableOCSPStapling bool `json:"disable_ocsp_stapling,omitempty"`


	DisableStorageCheck bool `json:"disable_storage_check,omitempty"`


	DisableStorageClean bool `json:"disable_storage_clean,omitempty"`


	EncryptedClientHello *ECH `json:"encrypted_client_hello,omitempty"`


	DNSRaw json.RawMessage `json:"dns,omitempty" caddy:"namespace=dns.providers inline_key=name"`


	Resolvers []string `json:"resolvers,omitempty"`
}

func (t *TLS) AddAutomationPolicy(ap *AutomationPolicy) error

AddAutomationPolicy provisions and adds ap to the list of the app's automation policies. If an existing automation policy exists that has fewer hosts in its list than ap does, ap will be inserted before that other policy (this helps ensure that ap will be prioritized/chosen over, say, a catch-all policy).

CaddyModule returns the Caddy module information.

Cleanup frees up resources allocated during Provision.

func (*TLS) HandleHTTPChallenge ¶

HandleHTTPChallenge ensures that the ACME HTTP challenge or ZeroSSL HTTP validation request is handled for the certificate named by r.Host, if it is an HTTP challenge request. It requires that the automation policy for r.Host has an issuer that implements GetACMEIssuer() or is a *ZeroSSLIssuer.

func (t *TLS) HasCertificateForSubject(subject string) bool

Manage immediately begins managing subjects according to the matching automation policy. The subjects are given in a map to prevent duplication and also because quick lookups are needed to assess wildcard coverage, if any, depending on certain config parameters (with lots of subjects, computing wildcard coverage over a slice can be highly inefficient).

Provision sets up the configuration for the TLS app.

func (t *TLS) RegisterServerNames(dnsNames, alpnValues []string)

RegisterServerNames registers the provided DNS names with the TLS app and associates them with the given HTTPS RR ALPN values, if any. This is currently used to auto-publish Encrypted ClientHello (ECH) configurations, if enabled. Use of this function by apps using the TLS app removes the need for the user to redundantly specify domain names in their configuration. This function separates hostname and port, keeping only the hostname, and filters IP addresses which can't be used with ECH.

EXPERIMENTAL: This function and its semantics/behavior are subject to change.

Start activates the TLS module.

Stop stops the TLS module and cleans up any allocations.

func (t *TLS) Validate() error

Validate validates t's configuration.

type TLSALPNChallengeConfig struct {

	Disabled bool `json:"disabled,omitempty"`


	AlternatePort int `json:"alternate_port,omitempty"`
}

type TLSConfig struct {

	CARaw json.RawMessage `json:"ca,omitempty" caddy:"namespace=tls.ca_pool.source inline_key=provider"`


	InsecureSkipVerify bool `json:"insecure_skip_verify,omitempty"`

	HandshakeTimeout caddy.Duration `json:"handshake_timeout,omitempty"`


	ServerName string `json:"server_name,omitempty"`


	Renegotiation string `json:"renegotiation,omitempty"`
}

type Tailscale struct {
}

CaddyModule returns the Caddy module information.

UnmarshalCaddyfile deserializes Caddyfile tokens into ts.

... tailscale

type ZeroSSLIssuer struct {


	APIKey string `json:"api_key,omitempty"`


	ValidityDays int `json:"validity_days,omitempty"`


	ListenHost string `json:"listen_host,omitempty"`


	AlternateHTTPPort int `json:"alternate_http_port,omitempty"`


	CNAMEValidation *DNSChallengeConfig `json:"cname_validation,omitempty"`
}

CaddyModule returns the Caddy module information.

Issue obtains a certificate for the given csr.

IssuerKey returns the unique issuer key for the configured CA endpoint.

Provision sets up the issuer.

Revoke revokes the given certificate.

UnmarshalCaddyfile deserializes Caddyfile tokens into iss.

... zerossl <api_key> {
	    validity_days <days>
	    alt_http_port <port>
	    dns <provider_name> ...
	    propagation_delay <duration>
	    propagation_timeout <duration>
	    resolvers <list...>
	    dns_ttl <duration>
}