space.highport.manage.setCertificateMode

{
  "id": "space.highport.manage.setCertificateMode",
  "defs": {
    "main": {
      "type": "procedure",
      "input": {
        "schema": {
          "type": "object",
          "required": [
            "domain",
            "mode"
          ],
          "properties": {
            "mode": {
              "type": "string",
              "description": "per-name to obtain one certificate per name, ending any wildcard grant; wildcard to grant this service a wildcard certificate for the base. A grant made after an ending names a new challenge target.",
              "knownValues": [
                "per-name",
                "wildcard"
              ]
            },
            "domain": {
              "type": "string",
              "maxLength": 253,
              "description": "The base: a domain registered to the caller."
            },
            "acknowledgeCertificateGrant": {
              "type": "boolean",
              "description": "Must be true for wildcard. While the base's _acme-challenge record points at the challenge target, this service can obtain a publicly trusted certificate for the base and for every name in its zone. Removing that record ends the grant."
            }
          }
        },
        "encoding": "application/json"
      },
      "errors": [
        {
          "name": "InvalidDomain",
          "description": "Not a syntactically valid domain."
        },
        {
          "name": "NotBaseOwner",
          "description": "No verified or active registration of that domain belongs to the caller."
        },
        {
          "name": "CertificateGrantNotAcknowledged",
          "description": "mode is wildcard and acknowledgeCertificateGrant is not true."
        },
        {
          "name": "WildcardNotOffered",
          "description": "This service grants no wildcard certificate for the domain: it is not one of this deployment's own bases while wildcard grants for other bases are closed, it is a name delegated under another base, or the deployment has no zone to delegate challenges to. The message says which."
        },
        {
          "name": "CaaForbidsIssuance",
          "description": "For wildcard, the base's CAA issuewild records, or its issue records where it has none, do not permit this deployment's certificate issuer, account, or DNS-01, or its issue records allow this deployment's issuer DNS-01 only, which the base's probe and its names' own certificates cannot use. For per-name, the base's issue records allow this deployment's issuer DNS-01 only, which no per-name certificate can use. The message names the record in the way."
        },
        {
          "name": "RateLimitExceeded",
          "description": "A new wildcard grant within the deployment's cooldown after the base's last grant or ending, or while the wildcard of its last grant is still being retired. Ending a grant is never limited."
        }
      ],
      "output": {
        "schema": {
          "type": "object",
          "required": [
            "domain",
            "mode",
            "records",
            "verified"
          ],
          "properties": {
            "mode": {
              "type": "string",
              "knownValues": [
                "per-name",
                "wildcard"
              ]
            },
            "domain": {
              "type": "string"
            },
            "records": {
              "type": "array",
              "items": {
                "ref": "space.highport.defs#dnsInstruction",
                "type": "ref"
              },
              "description": "For wildcard, exactly one record: the base's _acme-challenge CNAME to its challenge target, purpose certificate. Empty for per-name."
            },
            "verified": {
              "type": "boolean",
              "description": "Whether the record this mode asks for is in place. For wildcard, false until the certificate check finds the base's _acme-challenge record pointing at its challenge target. Always true for per-name, which asks for no record."
            }
          }
        },
        "encoding": "application/json"
      },
      "description": "Choose how names under a proven base obtain certificates. wildcard grants this service one wildcard certificate for the base, validated over DNS-01 through a challenge target of the base's own, and returns the record that delegates it; per-name ends that grant. The caller must be the base's registered identity, and the base must be verified or active. The base does not have to delegate names."
    }
  },
  "$type": "com.atproto.lexicon.schema",
  "lexicon": 1
}