Mantissa support for letsencrypt
Closed this issue · 4 comments
Activating this for a particular TLS port would take care of periodically renewing the certificate, most likely using tls-sni-01 verification so that the challenges can be handled through the same port, and restarting the port with the new certificate, for a completely "handsfree" operational experience.
💯
You don't actually need to "restart" the port, because it is at least hypothetically possible to start responding to clientConnectionForTLS and serverConnectionForTLS with connection objects bound to new contexts.
I guess assuming we're using txsni for this, we just need to swap out the certificate in txsni's certificate mapping structure.
You can use the txacme le: endpoint for this (sort of, see twisted/txacme#129 and #54)