Struct IssuerAcme

pub struct IssuerAcme {
    pub ca_bundle: Option<String>,
    pub disable_account_key_generation: Option<bool>,
    pub email: Option<String>,
    pub enable_duration_feature: Option<bool>,
    pub external_account_binding: Option<IssuerAcmeExternalAccountBinding>,
    pub preferred_chain: Option<String>,
    pub private_key_secret_ref: IssuerAcmePrivateKeySecretRef,
    pub server: String,
    pub skip_tls_verify: Option<bool>,
    pub solvers: Option<Vec<IssuerAcmeSolvers>>,
}

ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates.

Fields

ca_bundle: Option<String>

Base64-encoded bundle of PEM CAs which can be used to validate the certificate chain presented by the ACME server. Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection.

disable_account_key_generation: Option<bool>

Enables or disables generating a new ACME account key. If true, the Issuer resource will not request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false.

email: Option<String>

Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered.

enable_duration_feature: Option<bool>

Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let’s Encrypt. If set to true when the ACME server does not support it, it will create an error on the Order. Defaults to false.

external_account_binding: Option<IssuerAcmeExternalAccountBinding>

ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account.

preferred_chain: Option<String>

PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let’s Encrypt’s DST crosssign you would use: “DST Root CA X3” or “ISRG Root X1” for the newer Let’s Encrypt root CA. This value picks the first certificate bundle in the combined set of ACME default and alternative chains that has a root-most certificate with this value as its issuer’s commonname.

private_key_secret_ref: IssuerAcmePrivateKeySecretRef

PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a key may be specified to select a specific entry within the named Secret resource. If key is not specified, a default of tls.key will be used.

server: String

Server is the URL used to access the ACME server’s ‘directory’ endpoint. For example, for Let’s Encrypt’s staging endpoint, you would use: “https://acme-staging-v02.api.letsencrypt.org/directory”. Only ACME v2 endpoints (i.e. RFC 8555) are supported.

skip_tls_verify: Option<bool>

INSECURE: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have the TLS certificate chain validated. Mutually exclusive with CABundle; prefer using CABundle to prevent various kinds of security vulnerabilities. Only enable this option in development environments. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. Defaults to false.

solvers: Option<Vec<IssuerAcmeSolvers>>

Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/

Trait Implementations

impl Clone for IssuerAcme

fn clone(&self) -> IssuerAcme

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IssuerAcme

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for IssuerAcme

fn default() -> IssuerAcme

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for IssuerAcme

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for IssuerAcme

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.