search

ericchiang / go-acme

A Let's Encrypt client for Go
Apache License 2.0
219 stars 14 forks source link

fix acme retry condition #30

Open mingshun opened 7 years ago

mingshun commented 7 years ago

Refer to the ACME protocol on https://tools.ietf.org/id/draft-ietf-acme-acme-01.xml:

To avoid unnecessary renewals, the CA may choose not to issue a renewed certificate until it receives such a request (if it even allows renewal at all). In such cases, if the CA requires some time to generate the new certificate, the CA MUST return a 202 (Accepted) response, with a Retry-After header field that indicates when the new certificate will be available. The CA MAY include the current (non-renewed) certificate as the body of the response.

When renewing a certificate, the body of the response will be the non-renewed certificate if the certificate is not available. The code should not check if the body of the response is empty. It should check if the status code of the response is 202 based on the ACME protocol.

ericchiang commented 7 years ago

Fine to merge this but this package is largely un-maintained. I'd strongly recommend taking a look at godoc.org/golang.org/x/crypto/acme instead

mingshun commented 7 years ago

Thanks for the recommendation.