m-barthelemy / acmeswift Goto Github PK

tl;dr: Should we add the token to the ChallengeDescription type?

First: Thank you for this package!
When I stumbled over the need to self-manage public certificates I couldn't believe my luck: There is a swift package for ACME!

A tiny little thing I think could be improved:

Currently, you can either call acme.orders.getAuthorizations(from: order) to get the "raw data", or use the acme.orders.describePendingChallenges(from: order, preferring: .http) API to get the little value encoding dance for free.

Getting the correct value for the challenges is clearly nicer, but on ChallengeDescription you can not access the token directly.
Based on how you'd implement "placing" the http value on you server, you'll now have to extract it out of the endpoint URL again.

Additionally, we could also move the get me the value for this challenge code to some reusable place to decouple it from the describePendingChallenges API.

After calling finalize, the order information passed back does not contain a url.

Eg:

let (privateKey, _, finalized) = try await acme.orders.finalizeWithRsa(order: order, domains: [domain])
let refreshed = try await acme.orders.get(url: finalized.url!) //url is not set

Also, acme.orders.get(url:) and acme.orders.refresh(&order) do not seem to include the url in their response.

That means that one cannot write a loop like this ATM:

let (privateKey, _, finalized) = try await acme.orders.finalizeWithRsa(order: order, domains: [domain])

var orderForDownload = finalized

while orderForDownload.status == .processing {
    try await Task.sleep(for: .seconds(1))
    try await acme.orders.refresh(&orderForDownload) //this will fail
    // as a work-around the url of the original order data must be used 
    // orderForDownload = try await acme.orders.get(url: order.url!)
}

Seeing as there are currently no active PRs, now might be a great time to switch to using main as the default branch name for the repo.

https://github.com/apple/swift-certificates can create CSRs.
This means that the basic CSR feature in this lib can be removed, or made to use swift-certificates under the hood