go-acme-server¶
go-acme-server is a Go library for embedding an ACME server into CA and PKI applications.
The library implements the ACME protocol of RFC 8555: accounts, orders, authorizations, challenges, finalization, certificate retrieval and revocation. Your application supplies the parts that differ between deployments through Go interfaces:
- a store that persists resources and background work
- an issuer and a revoker that call your CA
- one validator per challenge type, with HTTP-01, DNS-01, TLS-ALPN-01 and tkauth-01 included
- optional policy hooks, external account binding keys and directory metadata
The result is an http.Handler you mount behind your HTTPS origin and a worker you run next to it.
Standard ACME clients such as Certbot, lego, acmez and cert-manager then obtain certificates from your CA.
Install¶
go get github.com/misiektoja/go-acme-server
The module needs Go 1.26.8 or newer. The root package is imported as acmeserver. The bundled
validators are in challenge, the in-memory store in memstore, the single-process nonce manager
in nonce and the store contract suite in storetest.
Start here¶
Getting started builds a complete local ACME server in one Go file and
issues a certificate with lego. The program is in the repository under examples/quickstart. Read it first, then replace each placeholder piece with your own
implementation by following the integration guide.
Where to go next¶
| I want to | Page |
|---|---|
| Know which RFCs, algorithms and clients are covered | Support matrix |
| Understand how the handler, the worker and my code fit together | Architecture |
| Mount the handler and run the worker correctly | Embedding the server |
| Persist accounts, orders and certificates in my database | Storage |
| Connect my CA | Issuing certificates and Revocation |
| Configure or write challenge validators | Challenge validators |
| Restrict who may register or order | Accounts and policy |
| Issue STIR certificates with Authority Tokens | Authority Token challenges |
| Tell clients when to renew | Renewal information |
| Look up every configuration field | Configuration |
| Configure a reverse proxy or health checks | Deployment |
| Fix something that does not work | Troubleshooting |
| See which clients were tested | Tested clients |
| Understand what is not implemented | Known limitations |
| Ask for help or report a problem | Support |
Design and security¶
- Security model - what the library protects against and what remains with the host
- Compatibility policy - what may change before v1.0.0 and how
- Errors - the problem types clients receive and what causes them
Contributing¶
- Development, Testing and Release process
- Source and issues: github.com/misiektoja/go-acme-server
Support¶
SUPPORT.md routes usage questions, bug reports, feature requests and private security reports. Check Troubleshooting and collect sanitized diagnostics before posting.