got HTTPS fully working

Cargo.lock

@@ -47,6 +47,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "anstream"
 version = "0.3.2"
@@ -209,6 +218,19 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
+[[package]]
+name = "chrono"
+version = "0.4.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e3c5919066adf22df73762e50cffcde3a758f2a848b113b586d1f86728b673b"
+dependencies = [
+ "iana-time-zone",
+ "num-integer",
+ "num-traits",
+ "serde",
+ "winapi",
+]
+
 [[package]]
 name = "clap"
 version = "4.2.7"
@@ -263,6 +285,12 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
 
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.7"
@@ -358,6 +386,41 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "darling"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0558d22a7b463ed0241e993f76f09f30b126687447751a8638587b864e4b3944"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab8bfa2e259f8ee1ce5e97824a3c55ec4404a0d772ca7fa96bf19f0752a046eb"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29a358ff9f12ec09c3e61fef9b5a9902623a695a46a917b07f269bff1445611a"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 2.0.15",
+]
+
 [[package]]
 name = "data-encoding"
 version = "2.3.3"
@@ -395,16 +458,21 @@ dependencies = [
  "mime_guess",
  "mockall",
  "openssl",
+ "pem",
  "rust-embed",
+ "rustls 0.21.1",
  "serde",
  "serde_json",
  "serde_urlencoded",
+ "serde_with",
  "sha2",
  "signal-hook",
  "signal-hook-tokio",
  "tempdir",
  "thiserror",
+ "tls-listener",
  "tokio",
+ "tokio-rustls 0.24.0",
  "tokio-util",
  "trust-dns-client",
 ]
@@ -1432,11 +1500,40 @@ checksum = "1788965e61b367cd03a62950836d5cd41560c3577d90e40e0819373194d1661c"
 dependencies = [
  "http",
  "hyper",
- "rustls",
+ "rustls 0.20.8",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.23.4",
 ]
 
+[[package]]
+name = "iana-time-zone"
+version = "0.1.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0722cd7114b7de04316e7ea5456a0bbb20e4adb46fd27a3697adb812cff0f37c"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
 [[package]]
 name = "idna"
 version = "0.2.3"
@@ -1476,6 +1573,7 @@ checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
 dependencies = [
  "autocfg",
  "hashbrown 0.12.3",
+ "serde",
 ]
 
 [[package]]
@@ -1775,6 +1873,16 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
 
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.15"
@@ -1870,6 +1978,16 @@ dependencies = [
  "windows-sys 0.45.0",
 ]
 
+[[package]]
+name = "pem"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b13fe415cdf3c8e44518e18a7c95a13431d9bdf6d15367d82b23c377fdd441a"
+dependencies = [
+ "base64 0.21.0",
+ "serde",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.2.0"
@@ -2200,13 +2318,13 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls",
+ "rustls 0.20.8",
  "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.23.4",
  "tower-service",
  "trust-dns-resolver",
  "url",
@@ -2302,6 +2420,18 @@ dependencies = [
  "webpki",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c911ba11bc8433e811ce56fde130ccf32f5127cab0e0194e9c68c5a5b671791e"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-webpki",
+ "sct",
+]
+
 [[package]]
 name = "rustls-pemfile"
 version = "1.0.2"
@@ -2311,6 +2441,16 @@ dependencies = [
  "base64 0.21.0",
 ]
 
+[[package]]
+name = "rustls-webpki"
+version = "0.100.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6207cd5ed3d8dca7816f8f3725513a34609c0c765bf652b8c3cb4cfd87db46b"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.13"
@@ -2385,6 +2525,34 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_with"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f02d8aa6e3c385bf084924f660ce2a3a6bd333ba55b35e8590b321f35d88513"
+dependencies = [
+ "base64 0.21.0",
+ "chrono",
+ "hex",
+ "indexmap",
+ "serde",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edc7d5d3932fb12ce722ee5e64dd38c504efba37567f0c402f6ca728c3b8b070"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.15",
+]
+
 [[package]]
 name = "sha1_smol"
 version = "1.0.0"
@@ -2591,6 +2759,20 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
+[[package]]
+name = "tls-listener"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81294c017957a1a69794f506723519255879e15a870507faf45dfed288b763dd"
+dependencies = [
+ "futures-util",
+ "hyper",
+ "pin-project-lite",
+ "thiserror",
+ "tokio",
+ "tokio-rustls 0.24.0",
+]
+
 [[package]]
 name = "tokio"
 version = "1.28.1"
@@ -2627,11 +2809,21 @@ version = "0.23.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c43ee83903113e03984cb9e5cebe6c04a5116269e900e3ddba8f068a62adda59"
 dependencies = [
- "rustls",
+ "rustls 0.20.8",
  "tokio",
  "webpki",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0d409377ff5b1e3ca6437aa86c1eb7d40c134bfec254e44c830defa92669db5"
+dependencies = [
+ "rustls 0.21.1",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.8"

Cargo.toml

@@ -28,9 +28,14 @@ clap = { version = "4.2.7", features = ["derive", "env"] }
 handlebars = { version = "4.3.7", features = [ "rust-embed" ]}
 rust-embed = "6.6.1"
 mime_guess = "2.0.4"
-hyper = { version = "0.14.26", features = [ "server" ]}
+hyper = { version = "0.14.26", features = [ "server", "stream" ]}
 http = "0.2.9"
 serde_urlencoded = "0.7.1"
 tokio-util = "0.7.8"
 acme2 = "0.5.1"
 openssl = "0.10.52"
+rustls = "0.21.1"
+pem = "2.0.1"
+serde_with = "3.0.0"
+tls-listener = { version = "0.7.0", features = [ "rustls", "hyper-h1" ]}
+tokio-rustls = "0.24.0"

TODO

@@ -1,11 +1,3 @@
-- make acme store implement https://docs.rs/rustls/latest/rustls/server/trait.ResolvesServerCert.html
-
-- pass that into https://docs.rs/rustls/latest/rustls/struct.ConfigBuilder.html#
-
-- turn that into a TlsAcceptor (From is implemented here:
-  https://docs.rs/tokio-rustls/latest/tokio_rustls/struct.TlsAcceptor.html#impl-From%3CArc%3CServerConfig%3E%3E-for-TlsAcceptor)
-
-- use tls-listener crate to wrap hyper accepter: https://github.com/tmccombs/tls-listener/blob/main/examples/http.rs#L24
-    - https://github.com/tmccombs/tls-listener/blob/main/examples/tls_config/mod.rs
-
 - logging
+- expect statements (pretend it's "expected", not "expect")
+- map_unexpected annotation string

src/domain/acme.rs

@@ -1,6 +1,8 @@
 pub mod manager;
 pub mod store;
 
-pub type PrivateKey = openssl::pkey::PKey<openssl::pkey::Private>;
+mod private_key;
+pub use self::private_key::PrivateKey;
 
-pub type Certificate = openssl::x509::X509;
+mod certificate;
+pub use self::certificate::Certificate;

src/domain/acme/certificate.rs

@@ -0,0 +1,45 @@
+use std::convert::{From, TryFrom};
+use std::fmt;
+use std::str::FromStr;
+
+use serde_with::{DeserializeFromStr, SerializeDisplay};
+
+#[derive(Debug, Clone, PartialEq, DeserializeFromStr, SerializeDisplay)]
+/// DER-encoded X.509, like rustls::Certificate.
+pub struct Certificate(Vec<u8>);
+
+impl FromStr for Certificate {
+    type Err = pem::PemError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(Certificate(pem::parse(s)?.into_contents()))
+    }
+}
+
+impl fmt::Display for Certificate {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        pem::Pem::new("CERTIFICATE", self.0.clone()).fmt(f)
+    }
+}
+
+impl TryFrom<&openssl::x509::X509Ref> for Certificate {
+    type Error = openssl::error::ErrorStack;
+
+    fn try_from(c: &openssl::x509::X509Ref) -> Result<Self, Self::Error> {
+        Ok(Certificate(c.to_der()?))
+    }
+}
+
+impl TryFrom<&Certificate> for openssl::x509::X509 {
+    type Error = openssl::error::ErrorStack;
+
+    fn try_from(c: &Certificate) -> Result<Self, Self::Error> {
+        Ok(openssl::x509::X509::from_der(&c.0)?)
+    }
+}
+
+impl From<Certificate> for rustls::Certificate {
+    fn from(c: Certificate) -> Self {
+        rustls::Certificate(c.0)
+    }
+}

src/domain/acme/manager.rs

@@ -55,17 +55,17 @@ where
 
     match store.get_account_key() {
         Ok(account_key) => {
-            builder.private_key(account_key);
+            builder.private_key((&account_key).try_into().map_unexpected()?);
         }
         Err(acme::store::GetAccountKeyError::NotFound) => (),
         Err(acme::store::GetAccountKeyError::Unexpected(err)) => return Err(err.to_unexpected()),
     }
 
     let account = builder.build().await.map_unexpected()?;
+    let account_key: acme::PrivateKey =
+        account.private_key().as_ref().try_into().map_unexpected()?;
 
-    store
+    store.set_account_key(&account_key).map_unexpected()?;
-        .set_account_key(&account.private_key())
-        .map_unexpected()?;
 
     Ok(sync::Arc::new(ManagerImpl { store, account }))
 }
@@ -89,6 +89,10 @@ where
                     .expect("parsed thirty days from now as Asn1Time");
 
                 let cert_with_soonest_not_after = cert
+                    .into_iter()
+                    .map(|cert| openssl::x509::X509::try_from(&cert))
+                    .try_collect::<Vec<openssl::x509::X509>>()
+                    .map_unexpected()?
                     .into_iter()
                     .reduce(|a, b| if a.not_after() < b.not_after() { a } else { b })
                     .ok_or(error::Unexpected::from(
@@ -206,12 +210,14 @@ where
             }
 
             // Generate an RSA private key for the certificate.
-            let pkey = acme2::gen_rsa_private_key(4096).map_unexpected()?;
+            let pkey = acme::PrivateKey::new();
+
+            let acme2_pkey = (&pkey).try_into().map_unexpected()?;
 
             // Create a certificate signing request for the order, and request
             // the certificate.
             let order = order
-                .finalize(acme2::Csr::Automatic(pkey.clone()))
+                .finalize(acme2::Csr::Automatic(acme2_pkey))
                 .await
                 .map_unexpected()?;
 
@@ -239,14 +245,17 @@ where
 
             // Download the certificate, and panic if it doesn't exist.
             println!("fetching certificate for domain {}", domain.as_str());
-            let cert =
+            let cert = order
-                order
+                .certificate()
-                    .certificate()
+                .await
-                    .await
+                .map_unexpected()?
-                    .map_unexpected()?
+                .ok_or(error::Unexpected::from(
-                    .ok_or(error::Unexpected::from(
+                    "expected the order to return a certificate",
-                        "expected the order to return a certificate",
+                ))?
-                    ))?;
+                .into_iter()
+                .map(|cert| acme::Certificate::try_from(cert.as_ref()))
+                .try_collect::<Vec<acme::Certificate>>()
+                .map_unexpected()?;
 
             if cert.len() <= 1 {
                 return Err(error::Unexpected::from(
@@ -260,7 +269,7 @@ where
 
             println!("certificate for {} successfully retrieved", domain.as_str());
             self.store
-                .set_certificate(domain.as_str(), &pkey, cert)
+                .set_certificate(domain.as_str(), pkey, cert)
                 .map_unexpected()?;
 
             Ok(())

src/domain/acme/private_key.rs

@@ -0,0 +1,55 @@
+use std::convert::{From, TryFrom};
+use std::fmt;
+use std::str::FromStr;
+
+use serde_with::{DeserializeFromStr, SerializeDisplay};
+
+#[derive(Debug, Clone, PartialEq, DeserializeFromStr, SerializeDisplay)]
+/// DER-encoded ASN.1 in either PKCS#8, PKCS#1, or Sec1 format, like rustls::PrivateKey.
+pub struct PrivateKey(Vec<u8>);
+
+impl PrivateKey {
+    pub fn new() -> PrivateKey {
+        acme2::gen_rsa_private_key(4096)
+            .expect("RSA private key generated")
+            .as_ref()
+            .try_into()
+            .expect("RSA private key converted to internal representation")
+    }
+}
+
+impl FromStr for PrivateKey {
+    type Err = pem::PemError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(PrivateKey(pem::parse(s)?.into_contents()))
+    }
+}
+
+impl fmt::Display for PrivateKey {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        pem::Pem::new("PRIVATE KEY", self.0.clone()).fmt(f)
+    }
+}
+
+impl TryFrom<&openssl::pkey::PKeyRef<openssl::pkey::Private>> for PrivateKey {
+    type Error = openssl::error::ErrorStack;
+
+    fn try_from(k: &openssl::pkey::PKeyRef<openssl::pkey::Private>) -> Result<Self, Self::Error> {
+        Ok(PrivateKey(k.private_key_to_der()?))
+    }
+}
+
+impl TryFrom<&PrivateKey> for openssl::pkey::PKey<openssl::pkey::Private> {
+    type Error = openssl::error::ErrorStack;
+
+    fn try_from(k: &PrivateKey) -> Result<Self, Self::Error> {
+        Ok(openssl::pkey::PKey::private_key_from_der(&k.0)?)
+    }
+}
+
+impl From<PrivateKey> for rustls::PrivateKey {
+    fn from(k: PrivateKey) -> Self {
+        rustls::PrivateKey(k.0)
+    }
+}

src/domain/acme/store.rs

@@ -1,4 +1,5 @@
 use std::io::{Read, Write};
+use std::str::FromStr;
 use std::{fs, io, path, sync};
 
 use crate::domain::acme::{Certificate, PrivateKey};
@@ -48,7 +49,7 @@ pub trait Store {
     fn set_certificate(
         &self,
         domain: &str,
-        key: &PrivateKey,
+        key: PrivateKey,
         cert: Vec<Certificate>,
     ) -> Result<(), error::Unexpected>;
 
@@ -63,27 +64,32 @@ pub trait BoxedStore: Store + Send + Sync + Clone + 'static {}
 
 #[derive(Debug, Serialize, Deserialize)]
 struct StoredPKeyCert {
-    private_key_pem: String,
+    private_key: PrivateKey,
-    cert_pems: Vec<String>,
+    cert: Vec<Certificate>,
 }
 
 struct FSStore {
     dir_path: path::PathBuf,
 }
 
-pub fn new(dir_path: &path::Path) -> Result<impl BoxedStore, error::Unexpected> {
+#[derive(Clone)]
+struct BoxedFSStore(sync::Arc<FSStore>);
+
+pub fn new(
+    dir_path: &path::Path,
+) -> Result<impl BoxedStore + rustls::server::ResolvesServerCert, error::Unexpected> {
     fs::create_dir_all(dir_path).map_unexpected()?;
     fs::create_dir_all(dir_path.join("http01_challenge_keys")).map_unexpected()?;
     fs::create_dir_all(dir_path.join("certificates")).map_unexpected()?;
 
-    Ok(sync::Arc::new(FSStore {
+    Ok(BoxedFSStore(sync::Arc::new(FSStore {
         dir_path: dir_path.into(),
-    }))
+    })))
 }
 
-impl FSStore {
+impl BoxedFSStore {
     fn account_key_path(&self) -> path::PathBuf {
-        self.dir_path.join("account.key")
+        self.0.dir_path.join("account.key")
     }
 
     fn http01_challenge_key_path(&self, token: &str) -> path::PathBuf {
@@ -93,24 +99,23 @@ impl FSStore {
             .expect("token successfully hashed");
         let n = h.finalize().encode_hex::<String>();
 
-        self.dir_path.join("http01_challenge_keys").join(n)
+        self.0.dir_path.join("http01_challenge_keys").join(n)
     }
 
     fn certificate_path(&self, domain: &str) -> path::PathBuf {
-        self.dir_path
+        let mut domain = domain.to_string();
-            .join("certificates")
+        domain.push_str(".json");
-            .join(domain)
+
-            .with_extension("json")
+        self.0.dir_path.join("certificates").join(domain)
     }
 }
 
-impl BoxedStore for sync::Arc<FSStore> {}
+impl BoxedStore for BoxedFSStore {}
 
-impl Store for sync::Arc<FSStore> {
+impl Store for BoxedFSStore {
     fn set_account_key(&self, k: &PrivateKey) -> Result<(), error::Unexpected> {
         let mut file = fs::File::create(self.account_key_path()).map_unexpected()?;
-        let pem = k.private_key_to_pem_pkcs8().map_unexpected()?;
+        file.write_all(k.to_string().as_bytes()).map_unexpected()?;
-        file.write_all(&pem).map_unexpected()?;
         Ok(())
     }
 
@@ -120,11 +125,11 @@ impl Store for sync::Arc<FSStore> {
             _ => e.to_unexpected().into(),
         })?;
 
-        let mut pem = Vec::<u8>::new();
+        let mut key = String::new();
-        file.read_to_end(&mut pem).map_unexpected()?;
+        file.read_to_string(&mut key).map_unexpected()?;
 
-        let k = PrivateKey::private_key_from_pem(&pem).map_unexpected()?;
+        let key = PrivateKey::from_str(&key).map_unexpected()?;
-        Ok(k)
+        Ok(key)
     }
 
     fn set_http01_challenge_key(&self, token: &str, key: &str) -> Result<(), error::Unexpected> {
@@ -154,20 +159,12 @@ impl Store for sync::Arc<FSStore> {
     fn set_certificate(
         &self,
         domain: &str,
-        key: &PrivateKey,
+        key: PrivateKey,
         cert: Vec<Certificate>,
     ) -> Result<(), error::Unexpected> {
         let to_store = StoredPKeyCert {
-            private_key_pem: String::from_utf8(key.private_key_to_pem_pkcs8().map_unexpected()?)
+            private_key: key,
-                .map_unexpected()?,
+            cert: cert,
-            cert_pems: cert
-                .into_iter()
-                .map(|cert| {
-                    let cert_pem = cert.to_pem().map_unexpected()?;
-                    let cert_pem = String::from_utf8(cert_pem).map_unexpected()?;
-                    Ok::<String, error::Unexpected>(cert_pem)
-                })
-                .try_collect()?,
         };
 
         let cert_file = fs::File::create(self.certificate_path(domain)).map_unexpected()?;
@@ -188,22 +185,47 @@ impl Store for sync::Arc<FSStore> {
 
         let stored: StoredPKeyCert = serde_json::from_reader(file).map_unexpected()?;
 
-        let key =
+        Ok((stored.private_key, stored.cert))
-            PrivateKey::private_key_from_pem(stored.private_key_pem.as_bytes()).map_unexpected()?;
+    }
+}
 
-        let cert: Vec<Certificate> = stored
+impl rustls::server::ResolvesServerCert for BoxedFSStore {
-            .cert_pems
+    fn resolve(
-            .into_iter()
+        &self,
-            .map(|cert| openssl::x509::X509::from_pem(cert.as_bytes()).map_unexpected())
+        client_hello: rustls::server::ClientHello<'_>,
-            .try_collect()?;
+    ) -> Option<sync::Arc<rustls::sign::CertifiedKey>> {
+        let domain = if let Some(domain) = client_hello.server_name() {
+            domain
+        } else {
+            return None;
+        };
 
-        Ok((key, cert))
+        match self.get_certificate(domain) {
+            Err(GetCertificateError::NotFound) => Ok(None),
+            Err(GetCertificateError::Unexpected(err)) => Err(err),
+            Ok((key, cert)) => {
+                match rustls::sign::any_supported_type(&key.into()).map_unexpected() {
+                    Err(err) => Err(err),
+                    Ok(key) => Ok(Some(sync::Arc::new(rustls::sign::CertifiedKey {
+                        cert: cert.into_iter().map(|cert| cert.into()).collect(),
+                        key: key,
+                        ocsp: None,
+                        sct_list: None,
+                    }))),
+                }
+            }
+        }
+        .unwrap_or_else(|err| {
+            println!("Unexpected error getting cert for domain {domain}: {err}");
+            None
+        })
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::domain::acme;
     use tempdir::TempDir;
 
     #[test]
@@ -216,17 +238,15 @@ mod tests {
             Err::<PrivateKey, GetAccountKeyError>(GetAccountKeyError::NotFound)
         ));
 
-        let k = acme2::gen_rsa_private_key(4096).expect("private key generated");
+        let k = acme::PrivateKey::new();
 
         store.set_account_key(&k).expect("account private key set");
 
         assert_eq!(
-            k.private_key_to_pem_pkcs8().unwrap(),
+            k,
             store
                 .get_account_key()
                 .expect("account private key retrieved")
-                .private_key_to_pem_pkcs8()
-                .unwrap()
         );
     }
 

src/domain/checker.rs

@@ -1,6 +1,5 @@
 use std::net;
 use std::str::FromStr;
-use std::sync;
 
 use crate::error::MapUnexpected;
 use crate::{domain, error};
@@ -37,8 +36,7 @@ pub struct DNSChecker {
     client: tokio::sync::Mutex<AsyncClient>,
 }
 
-pub fn new(
+pub async fn new(
-    tokio_runtime: sync::Arc<tokio::runtime::Runtime>,
     target_a: net::Ipv4Addr,
     resolver_addr: &str,
 ) -> Result<DNSChecker, NewDNSCheckerError> {
@@ -48,11 +46,9 @@ pub fn new(
 
     let stream = udp::UdpClientStream::<tokio::net::UdpSocket>::new(resolver_addr);
 
-    let (client, bg) = tokio_runtime
+    let (client, bg) = AsyncClient::connect(stream).await.map_unexpected()?;
-        .block_on(async { AsyncClient::connect(stream).await })
-        .map_unexpected()?;
 
-    tokio_runtime.spawn(bg);
+    tokio::spawn(bg);
 
     Ok(DNSChecker {
         target_a,

src/main.rs

@@ -56,23 +56,17 @@ struct Cli {
     domain_acme_contact_email: Option<String>,
 }
 
-fn main() {
+#[tokio::main]
+async fn main() {
     let config = Cli::parse();
 
     let mut wait_group = FuturesUnordered::new();
-
+    let canceller = tokio_util::sync::CancellationToken::new();
-    let tokio_runtime = std::sync::Arc::new(
-        tokio::runtime::Builder::new_multi_thread()
-            .enable_all()
-            .build()
-            .unwrap(),
-    );
-
-    let canceller = tokio_runtime.block_on(async { tokio_util::sync::CancellationToken::new() });
 
     {
         let canceller = canceller.clone();
-        tokio_runtime.spawn(async move {
+
+        tokio::spawn(async move {
             let mut signals =
                 Signals::new(signal_hook::consts::TERM_SIGNALS).expect("initialized signals");
 
@@ -92,16 +86,16 @@ fn main() {
         .expect("git origin store initialized");
 
     let domain_checker = domiply::domain::checker::new(
-        tokio_runtime.clone(),
         config.domain_checker_target_a,
         &config.domain_checker_resolver_addr,
     )
+    .await
     .expect("domain checker initialized");
 
     let domain_config_store = domiply::domain::config::new(&config.domain_config_store_dir_path)
         .expect("domain config store initialized");
 
-    let domain_acme_manager = config.https_listen_addr.and_then(|_addr| {
+    let (domain_acme_store, domain_acme_manager) = if config.https_listen_addr.is_some() {
         let domain_acme_store =
             domiply::domain::acme::store::new(&config.domain_acme_store_dir_path)
                 .expect("domain acme store initialized");
@@ -110,14 +104,17 @@ fn main() {
         // settings.
         let domain_acme_contact_email = config.domain_acme_contact_email.unwrap();
 
-        let domain_acme_manager = tokio_runtime.block_on(async {
+        let domain_acme_manager = domiply::domain::acme::manager::new(
-            domiply::domain::acme::manager::new(domain_acme_store, &domain_acme_contact_email)
+            domain_acme_store.clone(),
-                .await
+            &domain_acme_contact_email,
-                .expect("domain acme manager initialized")
+        )
-        });
+        .await
+        .expect("domain acme manager initialized");
 
-        Some(domain_acme_manager)
+        (Some(domain_acme_store), Some(domain_acme_manager))
-    });
+    } else {
+        (None, None)
+    };
 
     let manager = domiply::domain::manager::new(
         origin_store,
@@ -130,7 +127,7 @@ fn main() {
         let manager = manager.clone();
         let canceller = canceller.clone();
 
-        tokio_runtime.spawn(async move {
+        tokio::spawn(async move {
             let mut interval = time::interval(time::Duration::from_secs(20 * 60));
 
             loop {
@@ -166,8 +163,12 @@ fn main() {
 
     let service = sync::Arc::new(service);
 
-    let make_service =
+    wait_group.push({
-        hyper::service::make_service_fn(move |_conn: &hyper::server::conn::AddrStream| {
+        let http_domain = config.http_domain.clone();
+        let canceller = canceller.clone();
+        let service = service.clone();
+
+        let make_service = hyper::service::make_service_fn(move |_| {
             let service = service.clone();
 
             // Create a `Service` for responding to the request.
@@ -179,11 +180,7 @@ fn main() {
             async move { Ok::<_, Infallible>(service) }
         });
 
-    wait_group.push({
+        tokio::spawn(async move {
-        let http_domain = config.http_domain.clone();
-        let canceller = canceller.clone();
-
-        tokio_runtime.spawn(async move {
             let addr = config.http_listen_addr;
 
             println!(
@@ -203,61 +200,119 @@ fn main() {
         })
     });
 
-    // if there's an acme manager then it means that https is enabled, and we should ensure that
+    // if there's an acme manager then it means that https is enabled
-    // the http domain for domiply itself has a valid certificate.
+    if let (Some(domain_acme_store), Some(domain_acme_manager)) =
-    if let Some(domain_acme_manager) = domain_acme_manager {
+        (domain_acme_store, domain_acme_manager)
-        let manager = manager.clone();
+    {
-        let canceller = canceller.clone();
+        // Periodically refresh all domain certs, including the http_domain passed in the Cli opts
-        let http_domain = config.http_domain.clone();
+        wait_group.push({
+            let manager = manager.clone();
+            let http_domain = config.http_domain.clone();
+            let canceller = canceller.clone();
 
-        // Periodically refresh all domain certs
+            tokio::spawn(async move {
-        wait_group.push(tokio_runtime.spawn(async move {
+                let mut interval = time::interval(time::Duration::from_secs(60 * 60));
-            let mut interval = time::interval(time::Duration::from_secs(60 * 60));
 
-            loop {
+                loop {
-                select! {
+                    select! {
-                _ = interval.tick() => (),
+                    _ = interval.tick() => (),
-                _ = canceller.cancelled() => return,
+                    _ = canceller.cancelled() => return,
+                    }
+
+                    _ = domain_acme_manager
+                        .sync_domain(http_domain.clone())
+                        .await
+                        .inspect_err(|err| {
+                            println!(
+                                "Error while getting cert for {}: {err}",
+                                http_domain.as_str()
+                            )
+                        });
+
+                    let domains_iter = manager.all_domains();
+
+                    if let Err(err) = domains_iter {
+                        println!("Got error calling all_domains: {err}");
+                        continue;
+                    }
+
+                    for domain in domains_iter.unwrap().into_iter() {
+                        match domain {
+                            Ok(domain) => {
+                                let _ = domain_acme_manager
+                                    .sync_domain(domain.clone())
+                                    .await
+                                    .inspect_err(|err| {
+                                        println!(
+                                            "Error while getting cert for {}: {err}",
+                                            domain.as_str(),
+                                        )
+                                    });
+                            }
+                            Err(err) => println!("Error iterating through domains: {err}"),
+                        };
+                    }
                 }
+            })
+        });
 
-                _ = domain_acme_manager
+        // HTTPS server
-                    .sync_domain(http_domain.clone())
+        wait_group.push({
-                    .await
+            let http_domain = config.http_domain.clone();
-                    .inspect_err(|err| {
+            let canceller = canceller.clone();
-                        println!(
+            let service = service.clone();
-                            "Error while getting cert for {}: {err}",
-                            http_domain.as_str()
-                        )
-                    });
 
-                let domains_iter = manager.all_domains();
+            let make_service = hyper::service::make_service_fn(move |_| {
+                let service = service.clone();
 
-                if let Err(err) = domains_iter {
+                // Create a `Service` for responding to the request.
-                    println!("Got error calling all_domains: {err}");
+                let service = hyper::service::service_fn(move |req| {
-                    continue;
+                    domiply::service::handle_request(service.clone(), req)
-                }
+                });
 
-                for domain in domains_iter.unwrap().into_iter() {
+                // Return the service to hyper.
-                    match domain {
+                async move { Ok::<_, Infallible>(service) }
-                        Ok(domain) => {
+            });
-                            let _ = domain_acme_manager
+
-                                .sync_domain(domain.clone())
+            tokio::spawn(async move {
-                                .await
+                let canceller = canceller.clone();
-                                .inspect_err(|err| {
+                let server_config: tokio_rustls::TlsAcceptor = sync::Arc::new(
-                                    println!(
+                    rustls::server::ServerConfig::builder()
-                                        "Error while getting cert for {}: {err}",
+                        .with_safe_default_cipher_suites()
-                                        domain.as_str(),
+                        .with_safe_default_kx_groups()
-                                    )
+                        .with_safe_default_protocol_versions()
-                                });
+                        .unwrap()
-                        }
+                        .with_no_client_auth()
-                        Err(err) => println!("Error iterating through domains: {err}"),
+                        .with_cert_resolver(sync::Arc::from(domain_acme_store)),
-                    };
+                )
-                }
+                .into();
-            }
+
-        }));
+                let addr = config.https_listen_addr.unwrap();
+                let addr_incoming = hyper::server::conn::AddrIncoming::bind(&addr)
+                    .expect("https listen socket created");
+
+                let incoming = tls_listener::TlsListener::new(server_config, addr_incoming);
+
+                println!(
+                    "Listening on https://{}:{}",
+                    http_domain.as_str(),
+                    addr.port()
+                );
+
+                let server = hyper::Server::builder(incoming).serve(make_service);
+
+                let graceful = server.with_graceful_shutdown(async {
+                    canceller.cancelled().await;
+                });
+
+                if let Err(e) = graceful.await {
+                    panic!("server error: {}", e);
+                };
+            })
+        })
     }
 
-    tokio_runtime.block_on(async { while let Some(_) = wait_group.next().await {} });
+    while let Some(_) = wait_group.next().await {}
 
     println!("Graceful shutdown complete");
 }