Class AcmeService

java.lang.Object
zeroecho.pki.server.acme.AcmeService
public final class AcmeService extends Object
Transport-neutral durable ACME state machine and constrained PKI integration.

Account identity is protocol-scoped. No method accepts an administrative principal or permission as issuance authority. Directory activation freezes one exact authority, profile, issuer generation, chain path, provider set, and profile-owned confirmation policy. External validators return evidence only.

  • Constructor Details

    • AcmeService

      public AcmeService(ServerRealmContext realm, Clock clock, SecureRandom random, Map<String, AcmeChallengeProvider> providers, Map<String, ProviderConfig> providerConfigurations, Map<String, AcmeExternalAccountBindingProvider> eabProviders, Map<String, ProviderConfig> eabProviderConfigurations, Runnable reconciliationWake)
      Creates a realm-bound ACME service from explicitly enabled providers.
      Parameters:
      realm - realm context owning all ACME state
      clock - authoritative server clock
      random - cryptographically secure identifier source
      providers - explicitly enabled challenge providers keyed by identifier
      providerConfigurations - validated configuration for each challenge provider
      eabProviders - explicitly enabled external-account-binding providers
      eabProviderConfigurations - validated configuration for each EAB provider
      reconciliationWake - callback that promptly wakes durable signing reconciliation

    • AcmeService

      public AcmeService(ServerRealmContext realm, Clock clock, SecureRandom random, Map<String, AcmeChallengeProvider> providers, Map<String, ProviderConfig> providerConfigurations, Map<String, AcmeExternalAccountBindingProvider> eabProviders, Map<String, ProviderConfig> eabProviderConfigurations)
      Creates a realm-bound ACME service with periodic-only reconciliation compatibility.
      Parameters:
      realm - realm context owning all ACME state
      clock - authoritative server clock
      random - cryptographically secure identifier source
      providers - explicitly enabled challenge providers keyed by identifier
      providerConfigurations - validated configuration for each challenge provider
      eabProviders - explicitly enabled external-account-binding providers
      eabProviderConfigurations - validated configuration for each EAB provider

    • AcmeService

      public AcmeService(ServerRealmContext realm, Clock clock, SecureRandom random, Map<String, AcmeChallengeProvider> providers, Map<String, ProviderConfig> providerConfigurations)
      Creates an ACME service without EAB providers.
      Parameters:
      realm - realm context owning all ACME state
      clock - authoritative server clock
      random - cryptographically secure identifier source
      providers - explicitly enabled challenge providers keyed by identifier
      providerConfigurations - validated configuration for each challenge provider

  • Method Details

    • configuredChallengeProviders

      public Map<String, Set<AcmeState.ChallengeType>> configuredChallengeProviders()
      Returns configured challenge-provider identities and supported challenge types without options.
      Returns:
      immutable map of non-secret configured provider metadata

    • configuredEabProviders

      public Set<String> configuredEabProviders()
      Returns explicitly configured external-account-binding provider identifiers without options.
      Returns:
      immutable configured provider identifiers

    • resolveDirectoryProfilePrecondition

      public ServerControlOperation.AcmeDirectoryProfilePrecondition resolveDirectoryProfilePrecondition(AcmeService.DirectoryRegistration registration)
      Resolves the active profile precondition that must be bound into approval.
      Parameters:
      registration - validated directory registration input
      Returns:
      authoritative profile and policy precondition

    • registerDirectory

      public AcmeState.Directory registerDirectory(AcmeService.DirectoryRegistration registration, ServerControlOperation.AcmeDirectoryProfilePrecondition profilePrecondition)
      Registers one immutable inactive directory revision from an approval-bound profile precondition.
      Parameters:
      registration - validated directory registration input
      profilePrecondition - approval-bound authoritative profile precondition
      Returns:
      durably registered inactive directory revision

    • registerDirectory

      public AcmeState.Directory registerDirectory(AcmeService.DirectoryRegistration registration)
      Registers directly after resolving the same exact active-profile precondition.
      Parameters:
      registration - validated directory registration input
      Returns:
      durably registered inactive directory revision

    • activateDirectory

      public AcmeState.Directory activateDirectory(String directoryId)
      Activates one exact directory revision after revalidating all frozen PKI authority.
      Parameters:
      directoryId - stable directory identifier
      Returns:
      active directory revision

    • deactivateDirectory

      public AcmeState.Directory deactivateDirectory(String directoryId)
      Deactivates new account/order admission while existing unexpired orders remain usable.
      Parameters:
      directoryId - stable directory identifier
      Returns:
      inactive directory revision

    • activeDirectory

      public AcmeState.Directory activeDirectory(String alias)
      Resolves the sole active directory revision for one public alias.
      Parameters:
      alias - public directory alias
      Returns:
      sole active directory revision

    • nonceScope

      public String nonceScope(String alias)
      Returns the canonical nonce scope for one known directory alias.
      Parameters:
      alias - public directory alias
      Returns:
      canonical nonce scope

    • directory

      public AcmeState.Directory directory(String directoryId)
      Returns one exact directory revision for administrative and protocol inspection.
      Parameters:
      directoryId - stable directory identifier
      Returns:
      exact directory revision

    • accountDirectory

      public AcmeState.Directory accountDirectory(String accountId)
      Resolves the exact frozen directory for one existing account resource.
      Parameters:
      accountId - stable account identifier
      Returns:
      account's frozen directory revision

    • orderDirectory

      public AcmeState.Directory orderDirectory(String orderId)
      Resolves the exact frozen directory for one existing order resource.
      Parameters:
      orderId - stable order identifier
      Returns:
      order's frozen directory revision

    • authorizationDirectory

      public AcmeState.Directory authorizationDirectory(String authorizationId)
      Resolves the exact frozen directory for one existing authorization resource.
      Parameters:
      authorizationId - stable authorization identifier
      Returns:
      authorization's frozen directory revision

    • challengeDirectory

      public AcmeState.Directory challengeDirectory(String challengeId)
      Resolves the exact frozen directory for one existing challenge resource.
      Parameters:
      challengeId - stable challenge identifier
      Returns:
      challenge's frozen directory revision

    • directories

      public ServerControlStore.Page<AcmeState.Directory> directories(int offset, int limit)
      Returns a deterministic bounded page of directory revisions.
      Parameters:
      offset - zero-based page offset
      limit - positive page-size limit
      Returns:
      deterministic bounded directory page

    • createAccount

      public AcmeState.Account createAccount(AcmeState.Directory directory, String keyThumbprint, byte[] publicKeySpki, List<String> contacts, boolean termsAgreed, Optional<String> eabPolicyCommitment, boolean onlyReturnExisting)
      Creates or returns an account under one exact active directory.
      Parameters:
      directory - exact frozen directory revision
      keyThumbprint - authenticated account-key thumbprint
      publicKeySpki - canonical subject-public-key information
      contacts - bounded account contact URIs
      termsAgreed - whether current terms were accepted
      eabPolicyCommitment - optional external-account-binding policy commitment
      onlyReturnExisting - whether account creation must be refused
      Returns:
      existing or newly created account

    • accountByKey

      public Optional<AcmeState.Account> accountByKey(String directoryId, String keyThumbprint)
      Resolves an account by its authenticated key identity within one directory.
      Parameters:
      directoryId - stable directory identifier
      keyThumbprint - authenticated account-key thumbprint
      Returns:
      matching account, or empty when unknown

    • verifyExternalAccountBinding

      public Optional<String> verifyExternalAccountBinding(AcmeState.Directory directory, String keyThumbprint, Optional<byte[]> nestedJws)
      Verifies EAB inside its explicit secret-confining provider and returns only a safe commitment.
      Parameters:
      directory - exact frozen directory revision
      keyThumbprint - authenticated account-key thumbprint
      nestedJws - optional nested EAB JWS document
      Returns:
      safe policy commitment, or empty when EAB is unused

    • accountKey

      public AcmeJwsVerifier.AccountKey accountKey(String accountId, String kid)
      Resolves one active account key for strict KID authentication.
      Parameters:
      accountId - stable account identifier
      kid - exact account key identifier
      Returns:
      validated account key and record commitment

    • account

      public AcmeState.Account account(String accountId)
      Returns one account record without exposing contact data through transport automatically.
      Parameters:
      accountId - stable account identifier
      Returns:
      exact account record

    • deactivateAccount

      public AcmeState.Account deactivateAccount(String accountId)
      Durably changes account status while preserving its key and history commitment.
      Parameters:
      accountId - stable account identifier
      Returns:
      durably deactivated account

    • deactivateAccount

      public AcmeState.Account deactivateAccount(String accountId, String expectedCommitment)
      Durably changes account status after exact account-key authority revalidation.
      Parameters:
      accountId - stable account identifier
      expectedCommitment - expected current account-record commitment
      Returns:
      durably deactivated account

    • updateAccountContacts

      public AcmeState.Account updateAccountContacts(String accountId, String expectedCommitment, List<String> contacts)
      Atomically replaces bounded account contact metadata without changing key authority.
      Parameters:
      accountId - stable account identifier
      expectedCommitment - expected current account-record commitment
      contacts - bounded account contact URIs
      Returns:
      durably updated account

    • rolloverAccount

      public AcmeState.Account rolloverAccount(String accountId, String expectedCommitment, String replacementThumbprint, byte[] replacementSpki)
      Atomically replaces one account key after exact old-record authentication.
      Parameters:
      accountId - stable account identifier
      expectedCommitment - expected current account-record commitment
      replacementThumbprint - replacement account-key thumbprint
      replacementSpki - canonical replacement public key
      Returns:
      account with the replacement key

    • accounts

      public ServerControlStore.Page<AcmeState.Account> accounts(int offset, int limit)
      Returns a deterministic bounded page of accounts for administrative inspection.
      Parameters:
      offset - zero-based page offset
      limit - positive page-size limit
      Returns:
      deterministic bounded account page

    • createOrder

      public AcmeState.Order createOrder(String accountId, String expectedAccountCommitment, AcmeState.Directory directory, List<AcmeState.Identifier> requested, Optional<Instant> notBefore, Optional<Instant> notAfter, Duration orderLifetime)
      Atomically creates one account-owned order, authorization, and challenge graph.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - expected current account-record commitment
      directory - exact frozen directory revision
      requested - requested certificate identifiers
      notBefore - optional requested validity start
      notAfter - optional requested validity end
      orderLifetime - positive order lifetime
      Returns:
      durably created order

    • pendingOrderCount

      public int pendingOrderCount(String accountId, int stopAt)
      Counts pending nonterminal orders up to a caller-supplied finite bound.
      Parameters:
      accountId - stable account identifier
      stopAt - positive early-stop bound
      Returns:
      number of pending orders, capped by the supplied bound

    • revokeCertificate

      public RevocationRecord revokeCertificate(String accountId, String expectedAccountCommitment, AcmeState.Directory directory, byte[] certificateDer, RevocationReason reason, String requestId)
      Revokes one certificate issued to the authenticated account through the bound directory.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - expected current account-record commitment
      directory - exact frozen directory revision
      certificateDer - canonical certificate DER
      reason - permanent revocation reason
      requestId - stable request correlation identifier
      Returns:
      committed revocation record

    • validateChallenge

      public AcmeState.Challenge validateChallenge(String accountId, String expectedAccountCommitment, String challengeId, String accountKeyThumbprint, Instant deadline, CancellationSignal cancellation)
      Claims and performs one explicit challenge validation attempt.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - expected current account-record commitment
      challengeId - stable challenge identifier
      accountKeyThumbprint - authenticated account-key thumbprint
      deadline - absolute validation deadline
      cancellation - cooperative cancellation signal
      Returns:
      durably completed challenge attempt

    • finalizeOrder

      public AcmeState.Order finalizeOrder(String accountId, String expectedAccountCommitment, String orderId, byte[] csrDer)
      Finalizes a ready order through the existing strict CSR and issuance services.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - expected current account-record commitment
      orderId - stable order identifier
      csrDer - canonical PKCS#10 request DER
      Returns:
      current durable order after finalization processing

    • finalizeOrder

      public AcmeState.Order finalizeOrder(String accountId, String expectedAccountCommitment, String orderId, byte[] csrDer, CancellationSignal cancellation)
      Finalizes a ready order while propagating transport cancellation into signing.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - expected current account-record commitment
      orderId - stable order identifier
      csrDer - canonical PKCS#10 request DER
      cancellation - cooperative cancellation signal
      Returns:
      current durable order after finalization processing

    • order

      public AcmeState.Order order(String accountId, String expectedAccountCommitment, String orderId)
      Polls an account-owned order using the exact current authentication snapshot. Pending approvals remain processing; approved retained requests may dispatch.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - current account commitment verified by JWS authentication
      orderId - stable order identifier
      Returns:
      account-owned order after durable continuation

    • order

      public AcmeState.Order order(String accountId, String expectedAccountCommitment, String orderId, CancellationSignal cancellation)
      Continues an authenticated order with cancellation before durable admission.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - current JWS-authenticated account commitment
      orderId - stable order identifier
      cancellation - transport cancellation signal
      Returns:
      account-owned order after durable continuation

    • authorization

      public AcmeState.Authorization authorization(String accountId, String authorizationId)
      Returns one account-owned authorization without revealing another account's state.
      Parameters:
      accountId - stable account identifier
      authorizationId - stable authorization identifier
      Returns:
      account-owned authorization

    • challenge

      public AcmeState.Challenge challenge(String accountId, String challengeId)
      Returns one account-owned challenge without URL-derived authority.
      Parameters:
      accountId - stable account identifier
      challengeId - stable challenge identifier
      Returns:
      account-owned challenge

    • issueCredentialConfirmationChallenge

      public CredentialConfirmationProofChallenge issueCredentialConfirmationChallenge(String accountId, String expectedAccountCommitment, String orderId)
      Issues or exactly replays confirmation proof material for one valid account-owned order.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - expected current account-record commitment
      orderId - stable order identifier
      Returns:
      issued or replayed confirmation challenge

    • completeCredentialConfirmation

      public CredentialConfirmationProofResult completeCredentialConfirmation(String accountId, String expectedAccountCommitment, String orderId, long expectedLifecycleRevision, String expectedLifecycleRecordCommitment, String expectedChallengeRecordCommitment, byte[] response)
      Completes or exactly replays confirmation proof processing for one valid account-owned order.
      Parameters:
      accountId - stable account identifier
      expectedAccountCommitment - expected current account-record commitment
      orderId - stable order identifier
      expectedLifecycleRevision - expected confirmation lifecycle revision
      expectedLifecycleRecordCommitment - expected lifecycle-record commitment
      expectedChallengeRecordCommitment - expected proof-challenge record commitment
      response - suite-defined proof response bytes
      Returns:
      durable confirmation result