A simple and unopinionated ACME client.
This module is written to handle communication with a Boulder/Let's Encrypt-style ACME API.
- RFC 8555 - Automatic Certificate Management Environment (ACME): https://tools.ietf.org/html/rfc8555
- Boulder divergences from ACME: https://github.com/letsencrypt/boulder/blob/master/docs/acme-divergences.md
acme-client | API | Style | Node.js |
---|---|---|---|
v4.x | ACMEv2 | Promise | >= v10 |
v3.x | ACMEv2 | Promise | >= v8 |
v2.x | ACMEv2 | Promise | >= v4 |
v1.x | ACMEv1 | callback | >= v4 |
$ npm install acme-client
const acme = require('acme-client');
const accountPrivateKey = '<PEM encoded private key>';
const client = new acme.Client({
directoryUrl: acme.directory.letsencrypt.staging,
accountKey: accountPrivateKey
});
acme.directory.letsencrypt.staging;
acme.directory.letsencrypt.production;
For key pair generation and Certificate Signing Requests, acme-client
uses node-forge, a pure JavaScript implementation of the TLS protocol.
These utility methods are exposed through .forge
.
API documentation: docs/forge.md
const privateKey = await acme.forge.createPrivateKey();
const [certificateKey, certificateCsr] = await acme.forge.createCsr({
commonName: '*.example.com',
altNames: ['example.com']
});
For convenience an auto()
method is included in the client that takes a single config object. This method will handle the entire process of getting a certificate for one or multiple domains.
A full example can be found at examples/auto.js.
Documentation: docs/client.md#AcmeClient+auto
const autoOpts = {
csr: '<PEM encoded CSR>',
email: 'test@example.com',
termsOfServiceAgreed: true,
challengeCreateFn: async (authz, challenge, keyAuthorization) => {},
challengeRemoveFn: async (authz, challenge, keyAuthorization) => {}
};
const certificate = await client.auto(autoOpts);
When ordering a certificate using auto mode, acme-client
uses a priority list when selecting challenges to respond to. Its default value is ['http-01', 'dns-01']
which translates to "use http-01
if any challenges exist, otherwise fall back to dns-01
".
While most challenges can be validated using the method of your choosing, please note that wildcard certificates can only be validated through dns-01
. More information regarding Let's Encrypt challenge types can be found here.
To modify challenge priority, provide a list of challenge types in challengePriority
:
await client.auto({
...,
challengePriority: ['http-01', 'dns-01']
});
When using auto mode, acme-client
will first validate that challenges are satisfied internally before completing the challenge at the ACME provider. In some cases (firewalls, etc) this internal challenge verification might not be possible to complete.
If internal challenge validation needs to travel through an HTTP proxy, see HTTP client defaults.
To completely disable acme-client
s internal challenge verification, enable skipChallengeVerification
:
await client.auto({
...,
skipChallengeVerification: true
});
For more fine-grained control you can interact with the ACME API using the methods documented below.
A full example can be found at examples/api.js.
API documentation: docs/client.md
const account = await client.createAccount({
termsOfServiceAgreed: true,
contact: ['mailto:test@example.com']
});
const order = await client.createOrder({
identifiers: [
{ type: 'dns', value: 'example.com' },
{ type: 'dns', value: '*.example.com' }
]
});
This module uses axios when communicating with the ACME HTTP API, and exposes the client instance through .axios
.
For example, should you need to change the default axios configuration to route requests through an HTTP proxy, this can be achieved as follows:
const acme = require('acme-client');
acme.axios.defaults.proxy = {
host: '127.0.0.1',
port: 9000
};
A complete list of axios options and documentation can be found at:
- https://github.com/axios/axios#request-config
- https://github.com/axios/axios#custom-instance-defaults
acme-client
uses debug for debugging which can be enabled by running
DEBUG=acme-client node index.js