From
bafyreicodybm75rdqxj6qcoffpk75qjmphyga64gxqx63e3l46bluf5jny
indexed 2026-09-17 13:01 UTC
View this version
To
bafyreidt7voqlfd7jlybbim7y7doqppsfcbfn6a5xcqy2pit4edrgn5sli
indexed 2026-09-17 17:51 UTC
View this version
Compatibility
backward compatible No changes detected.
Changes
11
{22
"$type": "com.atproto.lexicon.schema",33
"defs": {44
"main": {5
"description": "Choose how names under a proven base obtain certificates. wildcard grants this service one wildcard certificate for the base, validated over DNS-01 through a challenge target of the base's own, and returns the record that delegates it; per-name ends that grant. The caller must be the base's registered identity, and the base must be verified or active. The base does not have to delegate names.",5
"description": "Choose how names under a proven base get certificates. wildcard lets this service get one wildcard certificate for the base over DNS-01, through the base's own challenge target, and returns the record that delegates it. per-name ends that grant. The caller must own the base, which must be verified or active. Delegation does not need to be enabled.",66
"errors": [77
{88
"description": "Not a syntactically valid domain.",99
"name": "InvalidDomain"1010
},1111
{1212
"description": "No verified or active registration of that domain belongs to the caller.",1313
"name": "NotBaseOwner"1414
},1515
{1616
"description": "mode is wildcard and acknowledgeCertificateGrant is not true.",1717
"name": "CertificateGrantNotAcknowledged"1818
},1919
{20
"description": "This service grants no wildcard certificate for the domain: it is a name delegated under another base, it is a name under a base this service offers to anyone without DNS proof, or the deployment has no zone to delegate challenges to. The message says which.",20
"description": "No wildcard certificate is offered for this domain: it is a name delegated under another base, it is under a base offered to anyone without DNS proof, or the deployment has no challenge zone. The error message says which.",2121
"name": "WildcardNotOffered"2222
},2323
{24
"description": "For wildcard, the base's CAA issuewild records, or its issue records where it has none, do not permit this deployment's certificate issuer, account, or DNS-01, or its issue records allow this deployment's issuer DNS-01 only, which the base's probe and its names' own certificates cannot use. For per-name, the base's issue records allow this deployment's issuer DNS-01 only, which no per-name certificate can use. The message names the record in the way.",24
"description": "The base's CAA records block this mode. For wildcard, issuewild (or issue, if there is no issuewild) must allow this deployment's issuer, account and DNS-01. For either mode, issue records must not limit this issuer to DNS-01, because the probe and per-name certificates cannot use it. The error message names the blocking record.",2525
"name": "CaaForbidsIssuance"2626
},2727
{28
"description": "A new wildcard grant within the deployment's cooldown after the base's last grant or ending, or while the wildcard of its last grant is still being retired. Ending a grant is never limited.",28
"description": "A new wildcard grant was requested during the deployment's cooldown after the base's last grant or ending, or while its previous wildcard is still being retired. Ending a grant is never limited.",2929
"name": "RateLimitExceeded"3030
}3131
],3232
"input": {3333
"encoding": "application/json",3434
"schema": {3535
"properties": {3636
"acknowledgeCertificateGrant": {37
"description": "Must be true for wildcard. While the base's _acme-challenge record points at the challenge target, this service can obtain a publicly trusted certificate for the base and for every name in its zone. Removing that record ends the grant.",37
"description": "Must be true for wildcard. While the base's _acme-challenge record points at the challenge target, this service can get a publicly trusted certificate for the base and every name in its zone. Removing that record ends the grant.",3838
"type": "boolean"3939
},4040
"domain": {4141
"description": "The base: a domain registered to the caller.",4242
"maxLength": 253,4343
"type": "string"4444
},4545
"mode": {46
"description": "per-name to obtain one certificate per name, ending any wildcard grant; wildcard to grant this service a wildcard certificate for the base. A grant made after an ending names a new challenge target.",46
"description": "per-name: one certificate per name, ending any wildcard grant. wildcard: grant this service a wildcard certificate for the base. A new grant after an earlier one ended gets a new challenge target.",4747
"knownValues": [4848
"per-name",4949
"wildcard"5050
],5151
"type": "string"5252
}5353
},5454
"required": [5555
"domain",5656
"mode"5757
],5858
"type": "object"5959
}6060
},6161
"output": {6262
"encoding": "application/json",6363
"schema": {6464
"properties": {6565
"domain": {6666
"type": "string"6767
},6868
"mode": {6969
"knownValues": [7070
"per-name",7171
"wildcard"7272
],7373
"type": "string"7474
},7575
"records": {76
"description": "For wildcard, exactly one record: the base's _acme-challenge CNAME to its challenge target, purpose certificate. Empty for per-name.",76
"description": "For wildcard, one record: the base's _acme-challenge CNAME pointing at its challenge target, with purpose certificate. Empty for per-name.",7777
"items": {7878
"ref": "space.highport.defs#dnsInstruction",7979
"type": "ref"8080
},8181
"type": "array"8282
},8383
"verified": {84
"description": "Whether the record this mode asks for is in place. For wildcard, false until the certificate check finds the base's _acme-challenge record pointing at its challenge target. Always true for per-name, which asks for no record.",84
"description": "Whether the record this mode needs is in place. For wildcard, false until the base's _acme-challenge record is found pointing at its challenge target. Always true for per-name, which needs no record.",8585
"type": "boolean"8686
}8787
},8888
"required": [8989
"domain",9090
"mode",9191
"records",9292
"verified"9393
],9494
"type": "object"9595
}9696
},9797
"type": "procedure"9898
}9999
},100100
"id": "space.highport.manage.setCertificateMode",101101
"lexicon": 1102102
}