space.highport.manage.setCertificateMode
Schema Diff
+8 -8
Compatibility Analysis
Backward Compatible
No changes detected.
1
1
{
2
2
"$type": "com.atproto.lexicon.schema",
3
3
"defs": {
4
4
"main": {
5
-
"description": "Choose how names under a proven base obtain certificates. wildcard grants this service one wildcard certificate for the base, validated over DNS-01 through a challenge target of the base's own, and returns the record that delegates it; per-name ends that grant. The caller must be the base's registered identity, and the base must be verified or active. The base does not have to delegate names.",
5
+
"description": "Choose how names under a proven base get certificates. wildcard lets this service get one wildcard certificate for the base over DNS-01, through the base's own challenge target, and returns the record that delegates it. per-name ends that grant. The caller must own the base, which must be verified or active. Delegation does not need to be enabled.",
6
6
"errors": [
7
7
{
8
8
"description": "Not a syntactically valid domain.",
9
9
"name": "InvalidDomain"
10
10
},
11
11
{
12
12
"description": "No verified or active registration of that domain belongs to the caller.",
13
13
"name": "NotBaseOwner"
14
14
},
15
15
{
16
16
"description": "mode is wildcard and acknowledgeCertificateGrant is not true.",
17
17
"name": "CertificateGrantNotAcknowledged"
18
18
},
19
19
{
20
-
"description": "This service grants no wildcard certificate for the domain: it is a name delegated under another base, it is a name under a base this service offers to anyone without DNS proof, or the deployment has no zone to delegate challenges to. The message says which.",
20
+
"description": "No wildcard certificate is offered for this domain: it is a name delegated under another base, it is under a base offered to anyone without DNS proof, or the deployment has no challenge zone. The error message says which.",
21
21
"name": "WildcardNotOffered"
22
22
},
23
23
{
24
-
"description": "For wildcard, the base's CAA issuewild records, or its issue records where it has none, do not permit this deployment's certificate issuer, account, or DNS-01, or its issue records allow this deployment's issuer DNS-01 only, which the base's probe and its names' own certificates cannot use. For per-name, the base's issue records allow this deployment's issuer DNS-01 only, which no per-name certificate can use. The message names the record in the way.",
24
+
"description": "The base's CAA records block this mode. For wildcard, issuewild (or issue, if there is no issuewild) must allow this deployment's issuer, account and DNS-01. For either mode, issue records must not limit this issuer to DNS-01, because the probe and per-name certificates cannot use it. The error message names the blocking record.",
25
25
"name": "CaaForbidsIssuance"
26
26
},
27
27
{
28
-
"description": "A new wildcard grant within the deployment's cooldown after the base's last grant or ending, or while the wildcard of its last grant is still being retired. Ending a grant is never limited.",
28
+
"description": "A new wildcard grant was requested during the deployment's cooldown after the base's last grant or ending, or while its previous wildcard is still being retired. Ending a grant is never limited.",
29
29
"name": "RateLimitExceeded"
30
30
}
31
31
],
32
32
"input": {
33
33
"encoding": "application/json",
34
34
"schema": {
35
35
"properties": {
36
36
"acknowledgeCertificateGrant": {
37
-
"description": "Must be true for wildcard. While the base's _acme-challenge record points at the challenge target, this service can obtain a publicly trusted certificate for the base and for every name in its zone. Removing that record ends the grant.",
37
+
"description": "Must be true for wildcard. While the base's _acme-challenge record points at the challenge target, this service can get a publicly trusted certificate for the base and every name in its zone. Removing that record ends the grant.",
38
38
"type": "boolean"
39
39
},
40
40
"domain": {
41
41
"description": "The base: a domain registered to the caller.",
42
42
"maxLength": 253,
43
43
"type": "string"
44
44
},
45
45
"mode": {
46
-
"description": "per-name to obtain one certificate per name, ending any wildcard grant; wildcard to grant this service a wildcard certificate for the base. A grant made after an ending names a new challenge target.",
46
+
"description": "per-name: one certificate per name, ending any wildcard grant. wildcard: grant this service a wildcard certificate for the base. A new grant after an earlier one ended gets a new challenge target.",
47
47
"knownValues": [
48
48
"per-name",
49
49
"wildcard"
50
50
],
51
51
"type": "string"
52
52
}
53
53
},
54
54
"required": [
55
55
"domain",
56
56
"mode"
57
57
],
58
58
"type": "object"
59
59
}
60
60
},
61
61
"output": {
62
62
"encoding": "application/json",
63
63
"schema": {
64
64
"properties": {
65
65
"domain": {
66
66
"type": "string"
67
67
},
68
68
"mode": {
69
69
"knownValues": [
70
70
"per-name",
71
71
"wildcard"
72
72
],
73
73
"type": "string"
74
74
},
75
75
"records": {
76
-
"description": "For wildcard, exactly one record: the base's _acme-challenge CNAME to its challenge target, purpose certificate. Empty for per-name.",
76
+
"description": "For wildcard, one record: the base's _acme-challenge CNAME pointing at its challenge target, with purpose certificate. Empty for per-name.",
77
77
"items": {
78
78
"ref": "space.highport.defs#dnsInstruction",
79
79
"type": "ref"
80
80
},
81
81
"type": "array"
82
82
},
83
83
"verified": {
84
-
"description": "Whether the record this mode asks for is in place. For wildcard, false until the certificate check finds the base's _acme-challenge record pointing at its challenge target. Always true for per-name, which asks for no record.",
84
+
"description": "Whether the record this mode needs is in place. For wildcard, false until the base's _acme-challenge record is found pointing at its challenge target. Always true for per-name, which needs no record.",
85
85
"type": "boolean"
86
86
}
87
87
},
88
88
"required": [
89
89
"domain",
90
90
"mode",
91
91
"records",
92
92
"verified"
93
93
],
94
94
"type": "object"
95
95
}
96
96
},
97
97
"type": "procedure"
98
98
}
99
99
},
100
100
"id": "space.highport.manage.setCertificateMode",
101
101
"lexicon": 1
102
102
}