@metric-im/administrate 1.1.1 → 1.1.3

package/certify.mjs

@@ -118,7 +118,7 @@ export class Certify {
         return;
       } else {
         if (!this.contactEmail) throw new Error(`cannot request certificate without CONTACT_EMAIL set`);
-        this.pending[sitename] = true;
+        this.pending[sitename] = moment();
 
         try {
           // Add timeout wrapper for the entire certificate renewal process
@@ -137,10 +137,29 @@ export class Certify {
     }
 
     async doRenewCert(sitename) {
-      // create CSR
-      const [key, csr] = await Acme.crypto.createCsr({
+      // Check if domain has an epistery address
+      const domainConfig = this.config.read(sitename);
+      const episteryAddress = domainConfig?.wallet?.address;
+
+      // Prepare CSR options
+      const csrOptions = {
         altNames: [sitename],
-      });
+      };
+
+      // If epistery address exists, bind it to the certificate per X.509 standards
+      if (episteryAddress) {
+        // RFC 5280: Use organization (O) field to identify Rootz Corp as binding provider
+        csrOptions.organization = 'Rootz Corp';
+        // RFC 5280: Use organizationUnit (OU) to store epistery identity address
+        // This binds the domain to the epistery address in the certificate
+        // Users can verify at /.well-known/epistery/status (RFC 8615 well-known URI)
+        csrOptions.organizationUnit = `Epistery: ${episteryAddress}`;
+        console.log(`Binding epistery identity ${episteryAddress} to certificate for ${sitename}`);
+        console.log(`Epistery binding verifiable at https://${sitename}/.well-known/epistery/status`);
+      }
+
+      // create CSR
+      const [key, csr] = await Acme.crypto.createCsr(csrOptions);
 
       // order certificate with timeout
       const cert = await this.acme.auto({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metric-im/administrate",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Tools for site administration",
   "homepage": "https://github.com/metric-im/administrate#readme",
   "bugs": {