Skip to main content

Certificate Management

{
  "status": "valid",
  "expires": "2015-03-01T14:09:07.99Z",

  "identifier": {
    "type": "dns",
    "value": "www.example.org"
  },

  "challenges": [
    {
      "url": "https://example.com/acme/chall/prV_B7yEyA4",
      "type": "http-01",
      "status": "valid",
      "token": "DGyRejmCefe7v4NfDGDKfA",
      "validated": "2014-12-01T12:05:58.16Z"
    }
  ],

  "wildcard": false
}
        pending
           |
           | Receive
           | response
           V
       processing <-+
           |   |    | Server retry or
           |   |    | client retry request
           |   +----+
           |
           |
Successful  |   Failed
validation  |   validation
 +---------+---------+
 |                   |
 V                   V
valid              invalid

          State Transitions for Challenge Objects
                  pending --------------------+
                     |                        |
   Challenge failure |                        |
          or         |                        |
         Error       |  Challenge valid       |
           +---------+---------+              |
           |                   |              |
           V                   V              |
        invalid              valid            |
                               |              |
                               |              |
                               |              |
                +--------------+--------------+
                |              |              |
                |              |              |
         Server |       Client |   Time after |
         revoke |   deactivate |    "expires" |
                V              V              V
             revoked      deactivated      expired

            State Transitions for Authorization Objects
pending --------------+
   |                  |
   | All authz        |
   | "valid"          |
   V                  |
 ready ---------------+
   |                  |
   | Receive          |
   | finalize         |
   | request          |
   V                  |
processing ------------+
   |                  |
   | Certificate      | Error or
   | issued           | Authorization failure
   V                  V
 valid             invalid

            State Transitions for Order Objects
                 valid
                   |
                   |
       +-----------+-----------+
Client |                Server |
deactiv.|                revoke |
       V                       V
  deactivated               revoked

           State Transitions for Account Objects
HEAD /acme/new-nonce HTTP/1.1
Host: example.com

HTTP/1.1 200 OK
Replay-Nonce: oFvnlFP1wIhRlYS2jTaXbA
Cache-Control: no-store
Link: \`https://example.com/acme/directory\`;rel="index"
POST /acme/new-account HTTP/1.1
Host: example.com
Content-Type: application/jose+json

{
  "protected": base64url({
    "alg": "ES256",
    "jwk": {...},
    "nonce": "6S8IqOGY7eL2lsGoTZYifg",
    "url": "https://example.com/acme/new-account"
  }),
  "payload": base64url({
    "termsOfServiceAgreed": true,
    "contact": [
      "mailto:[email protected]",
      "mailto:[email protected]"
    ]
  }),
  "signature": "RZPOnYoPs1PhjszF...-nh6X1qtOFPB519I"
}
HTTP/1.1 201 Created
Content-Type: application/json
Replay-Nonce: D8s4D2mLs8Vn-goWuPQeKA
Link: \`https://example.com/acme/directory\`;rel="index"
Location: https://example.com/acme/acct/evOfKhNU60wg

{
  "status": "valid",

  "contact": [
    "mailto:[email protected]",
    "mailto:[email protected]"
  ],

  "orders": "https://example.com/acme/acct/evOfKhNU60wg/orders"
}
POST /acme/acct/evOfKhNU60wg HTTP/1.1
Host: example.com
Content-Type: application/jose+json

{
  "protected": base64url({
    "alg": "ES256",
    "kid": "https://example.com/acme/acct/evOfKhNU60wg",
    "nonce": "ax5RnthDqp_Yf4_HZnFLmA",
    "url": "https://example.com/acme/acct/evOfKhNU60wg"
  }),
  "payload": base64url({
    "contact": [
      "mailto:[email protected]",
      "mailto:[email protected]"
    ]
  }),
  "signature": "hDXzvcj8T6fbFbmn...rDzXzzvzpRy64N0o"
}
HTTP/1.1 403 Forbidden
Replay-Nonce: T81bdZroZ2ITWSondpTmAw
Link: \`https://example.com/acme/directory\`;rel="index"
Link: \`https://example.com/acme/terms/2017-6-02\`;rel="terms-of-service"
Content-Type: application/problem+json
Content-Language: en

{
  "type": "urn:ietf:params:acme:error:userActionRequired",
  "detail": "Terms of service have changed",
  "instance": "https://example.com/acme/agreement/?token=W8Ih3PswD-8"
}