README.md in acme-client-0.1.0 vs README.md in acme-client-0.1.1

- old
+ new

@@ -1,10 +1,10 @@ # Acme::Client `acme-client` is a client implementation of the [ACME](https://letsencrypt.github.io/acme-spec) protocol in Ruby. -You can find the server reference implementation for ACME server at [here](github.com/letsencrypt/boulder) and also the a reference [client](github.com/letsencrypt/letsencrypt) written in python. +You can find the server reference implementation for ACME server [here](github.com/letsencrypt/boulder) and also the a reference [client](github.com/letsencrypt/letsencrypt) in python. ACME is part of the [Letsencrypt](https://letsencrypt.org/) project, that are working hard at encrypting all the things. ## Usage @@ -16,51 +16,58 @@ endpoint = 'http://letsencrypt.com/' # Initialize the client client = Acme::Client.new(private_key: private_key, endpoint: endpoint) -# If the private key is not known to the server we need to register for the first time. +# If the private key is not known to the server, we need to register it for the first time. registration = client.register(contact: 'mailto:unixcharles@gmail.com') -# You'll need to agree the term (that's up the to the server to require it or not but boulder does by default) +# You'll may need to agree to the term (that's up the to the server to require it or not but boulder does by default) registration.agree_terms # Let's try to optain a certificate for yourdomain.com + +# We need to prove that we control the domain using one of the challanges method. authorization = client.authorize(domain: 'yourdomain.com') -# We need to prove that we control the domain using one of the challanges method +# For now the only challenge method supprted by the client is simple_http. simple_http = authorization.simple_http # The SimpleHTTP method will require you to response to an HTTP request. -# You can retreive the expected path for the file. +# You can retrieve the expected path for the file. simple_http.filename # => ".well-known/acme-challenge/:some_token" -# You can retrieve the body of the expected response +# You can generate the body of the expected response. simple_http.file_content # => 'string of JWS signed json' -# You can send no Content-Type at all but if you send one it has to be 'application/jose+json' +# You can send no Content-Type at all but if you send one it has to be 'application/jose+json'. simple_http.content_type # Once you are ready to serve the confirmation request you can proceed. simple_http.request_verification # => true simple_http.verify_status # => 'pending' -# Wait a bit for the server to make the request, or really just blink, should be fast. +# Wait a bit for the server to make the request, or really just blink, it should be fast. sleep(1) -simple_http.verify_status # => 'pending' +simple_http.verify_status # => 'valid' -# We're going to need a CSR, let do this real quick with Ruby+OpenSSL. -request = OpenSSL::X509::Request.new -request.subject = OpenSSL::X509::Name.new([ +# We're going to need a CSR, lets do this real quick with Ruby+OpenSSL. +csr = OpenSSL::X509::Request.new + +# We need a private key for the certificate, not the same as the account key. +certificate_private_key = OpenSSL::PKey::RSA.new(2048) + +# We just going to add the domain but normally you might want to provide more information. +csr.subject = OpenSSL::X509::Name.new([ ['CN', common_name, OpenSSL::ASN1::UTF8STRING] ]) -request.public_key = private_key.public_key -request.sign(private_key, OpenSSL::Digest::SHA256.new) +csr.public_key = certificate_private_key.public_key +csr.sign(private_key, OpenSSL::Digest::SHA256.new) -# You can request a new certificate +# We can now request a certificate client.new_certificate(csr) # => #<OpenSSL::X509::Certificate ....> ``` # Not implemented