acme-client

What is acme-client?

The acme-client npm package is a client library for the ACME (Automated Certificate Management Environment) protocol, which is used to automate the process of obtaining and renewing SSL/TLS certificates. It is commonly used with Let's Encrypt, a free, automated, and open Certificate Authority.

What are acme-client's main functionalities?

Creating an ACME client instance

This code demonstrates how to create an instance of the ACME client. The client is configured to use Let's Encrypt's production directory and a newly generated account key.

const acme = require('acme-client');
const client = new acme.Client({
  directoryUrl: acme.directory.letsencrypt.production,
  accountKey: await acme.forge.createPrivateKey()
});

Creating a new account

This code shows how to create a new account with the ACME server. It agrees to the terms of service and provides a contact email.

await client.createAccount({
  termsOfServiceAgreed: true,
  contact: ['mailto:[e-mail]']
});

Generating a certificate

This code demonstrates how to generate a certificate signing request (CSR) and then use the ACME client to automatically obtain a certificate for the domain 'example.com'.

const [key, csr] = await acme.forge.createCsr({
  commonName: 'example.com'
});
const cert = await client.auto({
  csr,
  email: '[e-mail]',
  termsOfServiceAgreed: true
});

Renewing a certificate

This code shows how to renew an existing certificate using the ACME client. It requires the existing certificate and CSR.

const renewedCert = await client.renewCertificate({
  certificate: existingCert,
  csr: existingCsr
});

Other packages similar to acme-client

greenlock

Greenlock is another ACME client for Node.js that simplifies the process of obtaining and renewing SSL/TLS certificates from Let's Encrypt. It provides a higher-level API compared to acme-client and includes additional features like automatic renewal and integration with various web servers.

letsencrypt

The letsencrypt package is a Node.js client for Let's Encrypt. It is designed to be simple and easy to use, providing basic functionality for obtaining and renewing certificates. It is less feature-rich compared to acme-client but can be a good choice for straightforward use cases.

certbot

Certbot is a popular ACME client developed by the Electronic Frontier Foundation (EFF). While it is not a Node.js package, it is widely used for obtaining and renewing Let's Encrypt certificates. It offers a comprehensive set of features and is highly configurable, making it suitable for a variety of environments.

README

acme-client

A simple and unopinionated ACME client.

This module is written to handle communication with a Boulder/Let's Encrypt-style ACME API.

• RFC 8555 - Automatic Certificate Management Environment (ACME): https://tools.ietf.org/html/rfc8555
• Boulder divergences from ACME: https://github.com/letsencrypt/boulder/blob/master/docs/acme-divergences.md

Important upgrade notice

On September 15, 2022, Let's Encrypt will stop accepting Certificate Signing Requests signed using the obsolete SHA-1 hash. This change affects all acme-client versions lower than 3.3.2 and 4.2.4. Please upgrade ASAP to ensure that your certificates can still be issued following this date.

A more detailed explanation can be found at the Let's Encrypt forums.

Compatibility

acme-client	Node.js
v5.x	>= v16	Upgrade guide
v4.x	>= v10	Changelog
v3.x	>= v8	Changelog
v2.x	>= v4	Changelog
v1.x	>= v4	Changelog

Table of contents

• Installation
• Usage
  • Directory URLs
  • External account binding
  • Specifying the account URL
• Cryptography
  • Legacy .forge interface
• Auto mode
  • Challenge priority
  • Internal challenge verification
• API
• HTTP client defaults
• Debugging
• License

Installation

$ npm install acme-client

Usage

const acme = require('acme-client');

const accountPrivateKey = '<PEM encoded private key>';

const client = new acme.Client({
    directoryUrl: acme.directory.letsencrypt.staging,
    accountKey: accountPrivateKey
});

Directory URLs

acme.directory.buypass.staging;
acme.directory.buypass.production;

acme.directory.letsencrypt.staging;
acme.directory.letsencrypt.production;

acme.directory.zerossl.production;

External account binding

To enable external account binding when creating your ACME account, provide your KID and HMAC key to the client constructor.

const client = new acme.Client({
    directoryUrl: 'https://acme-provider.example.com/directory-url',
    accountKey: accountPrivateKey,
    externalAccountBinding: {
        kid: 'YOUR-EAB-KID',
        hmacKey: 'YOUR-EAB-HMAC-KEY'
    }
});

Specifying the account URL

During the ACME account creation process, the server will check the supplied account key and either create a new account if the key is unused, or return the existing ACME account bound to that key.

In some cases, for example with some EAB providers, this account creation step may be prohibited and might require you to manually specify the account URL beforehand. This can be done through accountUrl in the client constructor.

const client = new acme.Client({
    directoryUrl: acme.directory.letsencrypt.staging,
    accountKey: accountPrivateKey,
    accountUrl: 'https://acme-v02.api.letsencrypt.org/acme/acct/12345678'
});

You can fetch the clients current account URL, either after creating an account or supplying it through the constructor, using getAccountUrl():

const myAccountUrl = client.getAccountUrl();

Cryptography

For key pairs acme-client utilizes native Node.js cryptography APIs, supporting signing and generation of both RSA and ECDSA keys. The module jsrsasign is used to generate and parse Certificate Signing Requests.

These utility methods are exposed through .crypto.

• Documentation: docs/crypto.md

const privateRsaKey = await acme.crypto.createPrivateRsaKey();
const privateEcdsaKey = await acme.crypto.createPrivateEcdsaKey();

const [certificateKey, certificateCsr] = await acme.crypto.createCsr({
    commonName: '*.example.com',
    altNames: ['example.com']
});

Legacy .forge interface

The legacy node-forge crypto interface is still available for backward compatibility, however this interface is now considered deprecated and will be removed in a future major version of acme-client.

You should consider migrating to the new .crypto API at your earliest convenience. More details can be found in the acme-client v5 upgrade guide.

• Documentation: docs/forge.md

Auto mode

For convenience an auto() method is included in the client that takes a single config object. This method will handle the entire process of getting a certificate for one or multiple domains.

• Documentation: docs/client.md#AcmeClient+auto
• Full example: examples/auto.js

const autoOpts = {
    csr: '<PEM encoded CSR>',
    email: '[e-mail]',
    termsOfServiceAgreed: true,
    challengeCreateFn: async (authz, challenge, keyAuthorization) => {},
    challengeRemoveFn: async (authz, challenge, keyAuthorization) => {}
};

const certificate = await client.auto(autoOpts);

Challenge priority

When ordering a certificate using auto mode, acme-client uses a priority list when selecting challenges to respond to. Its default value is ['http-01', 'dns-01'] which translates to "use http-01 if any challenges exist, otherwise fall back to dns-01".

While most challenges can be validated using the method of your choosing, please note that wildcard certificates can only be validated through dns-01. More information regarding Let's Encrypt challenge types can be found here.

To modify challenge priority, provide a list of challenge types in challengePriority:

await client.auto({
    ...,
    challengePriority: ['http-01', 'dns-01']
});

Internal challenge verification

When using auto mode, acme-client will first validate that challenges are satisfied internally before completing the challenge at the ACME provider. In some cases (firewalls, etc) this internal challenge verification might not be possible to complete.

If internal challenge validation needs to travel through an HTTP proxy, see HTTP client defaults.

To completely disable acme-clients internal challenge verification, enable skipChallengeVerification:

await client.auto({
    ...,
    skipChallengeVerification: true
});

API

For more fine-grained control you can interact with the ACME API using the methods documented below.

• Documentation: docs/client.md
• Full example: examples/api.js

const account = await client.createAccount({
    termsOfServiceAgreed: true,
    contact: ['mailto:[e-mail]']
});

const order = await client.createOrder({
    identifiers: [
        { type: 'dns', value: 'example.com' },
        { type: 'dns', value: '*.example.com' }
    ]
});

HTTP client defaults

This module uses axios when communicating with the ACME HTTP API, and exposes the client instance through .axios.

For example, should you need to change the default axios configuration to route requests through an HTTP proxy, this can be achieved as follows:

const acme = require('acme-client');

acme.axios.defaults.proxy = {
    host: '127.0.0.1',
    port: 9000
};

A complete list of axios options and documentation can be found at:

• https://github.com/axios/axios#request-config
• https://github.com/axios/axios#custom-instance-defaults

Debugging

To get a better grasp of what acme-client is doing behind the scenes, you can either pass it a logger function, or enable debugging through an environment variable.

Setting a logger function may for example be useful for passing messages on to another logging system, or just dumping them to the console.

acme.setLogger((message) => {
    console.log(message);
});

Debugging to the console can also be enabled through debug by setting an environment variable.

DEBUG=acme-client node index.js

License

MIT

Changelog

v5.0.0 (2022-07-28)

• Upgrade guide here
• added New native crypto interface, ECC/ECDSA support
• breaking Remove support for Node v10, v12 and v14
• breaking Prioritize issuer closest to root during preferred chain selection - #46
• changed Replace bluebird dependency with native promise APIs
• changed Replace backo2 dependency with internal utility