space.highport.manage.setCertificateMode
Schema Diff
+1 -1
Compatibility Analysis
Backward Compatible
No changes detected.
1
1
{
2
2
"id": "space.highport.manage.setCertificateMode",
3
3
"defs": {
4
4
"main": {
5
5
"type": "procedure",
6
6
"input": {
7
7
"schema": {
8
8
"type": "object",
9
9
"required": [
10
10
"domain",
11
11
"mode"
12
12
],
13
13
"properties": {
14
14
"mode": {
15
15
"type": "string",
16
16
"description": "per-name to obtain one certificate per name, ending any wildcard grant; wildcard to grant this service a wildcard certificate for the base. A grant made after an ending names a new challenge target.",
17
17
"knownValues": [
18
18
"per-name",
19
19
"wildcard"
20
20
]
21
21
},
22
22
"domain": {
23
23
"type": "string",
24
24
"maxLength": 253,
25
25
"description": "The base: a domain registered to the caller."
26
26
},
27
27
"acknowledgeCertificateGrant": {
28
28
"type": "boolean",
29
29
"description": "Must be true for wildcard. While the base's _acme-challenge record points at the challenge target, this service can obtain a publicly trusted certificate for the base and for every name in its zone. Removing that record ends the grant."
30
30
}
31
31
}
32
32
},
33
33
"encoding": "application/json"
34
34
},
35
35
"errors": [
36
36
{
37
37
"name": "InvalidDomain",
38
38
"description": "Not a syntactically valid domain."
39
39
},
40
40
{
41
41
"name": "NotBaseOwner",
42
42
"description": "No verified or active registration of that domain belongs to the caller."
43
43
},
44
44
{
45
45
"name": "CertificateGrantNotAcknowledged",
46
46
"description": "mode is wildcard and acknowledgeCertificateGrant is not true."
47
47
},
48
48
{
49
49
"name": "WildcardNotOffered",
50
-
"description": "This service grants no wildcard certificate for the domain: it is not one of this deployment's own bases while wildcard grants for other bases are closed, it is a name delegated under another base, or the deployment has no zone to delegate challenges to. The message says which."
50
+
"description": "This service grants no wildcard certificate for the domain: it is a name delegated under another base, it is a name under a base this service offers to anyone without DNS proof, or the deployment has no zone to delegate challenges to. The message says which."
51
51
},
52
52
{
53
53
"name": "CaaForbidsIssuance",
54
54
"description": "For wildcard, the base's CAA issuewild records, or its issue records where it has none, do not permit this deployment's certificate issuer, account, or DNS-01, or its issue records allow this deployment's issuer DNS-01 only, which the base's probe and its names' own certificates cannot use. For per-name, the base's issue records allow this deployment's issuer DNS-01 only, which no per-name certificate can use. The message names the record in the way."
55
55
},
56
56
{
57
57
"name": "RateLimitExceeded",
58
58
"description": "A new wildcard grant within the deployment's cooldown after the base's last grant or ending, or while the wildcard of its last grant is still being retired. Ending a grant is never limited."
59
59
}
60
60
],
61
61
"output": {
62
62
"schema": {
63
63
"type": "object",
64
64
"required": [
65
65
"domain",
66
66
"mode",
67
67
"records",
68
68
"verified"
69
69
],
70
70
"properties": {
71
71
"mode": {
72
72
"type": "string",
73
73
"knownValues": [
74
74
"per-name",
75
75
"wildcard"
76
76
]
77
77
},
78
78
"domain": {
79
79
"type": "string"
80
80
},
81
81
"records": {
82
82
"type": "array",
83
83
"items": {
84
84
"ref": "space.highport.defs#dnsInstruction",
85
85
"type": "ref"
86
86
},
87
87
"description": "For wildcard, exactly one record: the base's _acme-challenge CNAME to its challenge target, purpose certificate. Empty for per-name."
88
88
},
89
89
"verified": {
90
90
"type": "boolean",
91
91
"description": "Whether the record this mode asks for is in place. For wildcard, false until the certificate check finds the base's _acme-challenge record pointing at its challenge target. Always true for per-name, which asks for no record."
92
92
}
93
93
}
94
94
},
95
95
"encoding": "application/json"
96
96
},
97
97
"description": "Choose how names under a proven base obtain certificates. wildcard grants this service one wildcard certificate for the base, validated over DNS-01 through a challenge target of the base's own, and returns the record that delegates it; per-name ends that grant. The caller must be the base's registered identity, and the base must be verified or active. The base does not have to delegate names."
98
98
}
99
99
},
100
100
"$type": "com.atproto.lexicon.schema",
101
101
"lexicon": 1
102
102
}