greenlock-store-fs | A Root project
A keypair and certificate storage strategy for Greenlock v2.7+ (and v3). The (much simpler) successor to le-store-certbot.
Works with all ACME (Let's Encrypt) SSL certificate sytles:
- single domains
- multiple domains (SANs, AltNames)
- wildcards
- private / localhost domains
Usage
Global config:
greenlockmanager;
Per-site config:
greenlock;
File System
The default file system layout mirrors that of certbot (python Let's Encrypt implementation) and the prior le-store-certbot in order to make transitioning effortless.
The default structure looks like this:
.config└── greenlock ├── accounts │ └── acme-staging-v02.api.letsencrypt.org │ └── directory │ └── sites@example.com.json ├── staging │ └── (same as live) └── live ├── example.com │ ├── bundle.pem │ ├── cert.pem │ ├── chain.pem │ ├── fullchain.pem │ └── privkey.pem └── www.example.com ├── bundle.pem ├── cert.pem ├── chain.pem ├── fullchain.pem └── privkey.pem
Internal Implementation Details
You DO NOT NEED TO KNOW these details.
They're provided for the sake of understanding what happens "under the hood" to help you make better choices "in the seat".
Parameters
parameters | example | notes |
---|---|---|
env |
staging or live |
- |
directoryUrl |
https://acme-staging-v02.api.letsencrypt.org/directory |
- |
keypair |
{ privateKeyPem, privateKeyJwk } |
|
account |
{ id: "an-arbitrary-id" } |
account only |
subscriberEmail |
webhost@example.com |
account only |
certificate |
{ id: "an-arbitrary-id" } |
certificate only |
subject |
example.com |
certificate only |
pems |
{ privkey, cert, chain, issuedAt, expiresAt } |
certificate only |
Account Keypair
accounts { var id = accountid || email; var serverDir = directoryUrl;};
accounts { var id = accountid || email; var serverDir = directoryUrl; return privateKeyPem privateKeyJwk ;};
Certificate Keypair
certificate { var id = accountid || email; env = env || directoryUrl;};
certificate { var id = accountid || email; env = env || directoryUrl; return privateKeyPem privateKeyJwk ;};
Certificate PEMs
certificate { var id = accountid || email; env = env || directoryUrl;};
certificate { var id = accountid || email; env = env || directoryUrl; return privkey cert chain issuedAt expiresAt ;};