@metric-im/administrate 1.1.1 → 1.1.4

package/certify.mjs

@@ -40,6 +40,7 @@ export class Certify {
     get SNI() {
         return {SNICallback: async (hostname, cb) => {
             try {
+              if (this.pending[hostname]) return(cb('pending'));
               console.log(`SNL get keys for ${hostname}`)
               const siteKeys = await this.getSiteKeys(hostname);
               cb(null, tls.createSecureContext(siteKeys));
@@ -54,11 +55,15 @@ export class Certify {
 
         router.get(/^\/\.well-known\/acme-challenge\/([^\/]+)$/,(req,res)=>{
             const token = req.params[0];
+            console.log(`ACME challenge request for token: ${token}`);
+            console.log(`Available challenges:`, Object.keys(this.challenges));
             if (token in this.challenges) {
+                console.log(`✓ Challenge found, responding with authorization`);
                 res.writeHead(200);
                 res.end(this.challenges[token]);
                 return;
             }
+            console.log(`✗ Challenge not found, returning 404`);
             // Don't redirect ACME challenges - return 404 instead (says Claude, used to be 302)
             res.writeHead(404);
             res.end('Challenge not found');
@@ -118,7 +123,7 @@ export class Certify {
         return;
       } else {
         if (!this.contactEmail) throw new Error(`cannot request certificate without CONTACT_EMAIL set`);
-        this.pending[sitename] = true;
+        this.pending[sitename] = moment();
 
         try {
           // Add timeout wrapper for the entire certificate renewal process
@@ -137,10 +142,28 @@ export class Certify {
     }
 
     async doRenewCert(sitename) {
-      // create CSR
-      const [key, csr] = await Acme.crypto.createCsr({
+      // Prepare CSR options
+      const csrOptions = {
         altNames: [sitename],
-      });
+      };
+
+      // // letsencrypt will not accept an OU it doesn't certify
+      // // Check if domain has an epistery address
+      // const domainConfig = this.config.read(sitename);
+      // const episteryAddress = domainConfig?.wallet?.address;
+      // if (episteryAddress) {
+      //   // RFC 5280: Use organization (O) field to identify Rootz Corp as binding provider
+      //   csrOptions.organization = 'Rootz Corp';
+      //   // RFC 5280: Use organizationUnit (OU) to store epistery identity address
+      //   // This binds the domain to the epistery address in the certificate
+      //   // Users can verify at /.well-known/epistery/status (RFC 8615 well-known URI)
+      //   csrOptions.organizationUnit = `Epistery: ${episteryAddress}`;
+      //   console.log(`Binding epistery identity ${episteryAddress} to certificate for ${sitename}`);
+      //   console.log(`Epistery binding verifiable at https://${sitename}/.well-known/epistery/status`);
+      // }
+
+      // create CSR
+      const [key, csr] = await Acme.crypto.createCsr(csrOptions);
 
       // order certificate with timeout
       const cert = await this.acme.auto({
@@ -149,9 +172,12 @@ export class Certify {
         termsOfServiceAgreed: true,
         challengePriority: ['http-01'],
         challengeCreateFn: (authz, challenge, keyAuthorization) => {
+          console.log(`✓ Challenge created - token: ${challenge.token}`);
+          console.log(`  Challenge URL: http://${sitename}/.well-known/acme-challenge/${challenge.token}`);
           this.challenges[challenge.token] = keyAuthorization;
         },
         challengeRemoveFn: (authz, challenge) => {
+          console.log(`✓ Challenge removed - token: ${challenge.token}`);
           delete this.challenges[challenge.token];
         },
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metric-im/administrate",
-  "version": "1.1.1",
+  "version": "1.1.4",
   "description": "Tools for site administration",
   "homepage": "https://github.com/metric-im/administrate#readme",
   "bugs": {