@push.rocks/smartproxy 18.2.0 → 19.2.2

package/ts/proxies/network-proxy/network-proxy.ts

@@ -18,7 +18,6 @@ import { RequestHandler, type IMetricsTracker } from './request-handler.js';
 import { WebSocketHandler } from './websocket-handler.js';
 import { ProxyRouter } from '../../http/router/index.js';
 import { RouteRouter } from '../../http/router/route-router.js';
-import { Port80Handler } from '../../http/port80/port80-handler.js';
 import { FunctionCache } from './function-cache.js';
 
 /**
@@ -221,15 +220,10 @@ export class NetworkProxy implements IMetricsTracker {
   }
 
   /**
-   * Sets an external Port80Handler for certificate management
-   * This allows the NetworkProxy to use a centrally managed Port80Handler
-   * instead of creating its own
-   * 
-   * @param handler The Port80Handler instance to use
+   * @deprecated Use SmartCertManager instead
    */
-  public setExternalPort80Handler(handler: Port80Handler): void {
-    // Connect it to the certificate manager
-    this.certificateManager.setExternalPort80Handler(handler);
+  public setExternalPort80Handler(handler: any): void {
+    this.logger.warn('Port80Handler is deprecated - use SmartCertManager instead');
   }
 
   /**
@@ -238,10 +232,7 @@ export class NetworkProxy implements IMetricsTracker {
   public async start(): Promise<void> {
     this.startTime = Date.now();
     
-    // Initialize Port80Handler if enabled and not using external handler
-    if (this.options.acme?.enabled && !this.options.useExternalPort80Handler) {
-      await this.certificateManager.initializePort80Handler();
-    }
+    // Certificate management is now handled by SmartCertManager
     
     // Create HTTP/2 server with HTTP/1 fallback
     this.httpsServer = plugins.http2.createSecureServer(
@@ -385,7 +376,7 @@ export class NetworkProxy implements IMetricsTracker {
 
     // Directly update the certificate manager with the new routes
     // This will extract domains and handle certificate provisioning
-    this.certificateManager.updateRouteConfigs(routes);
+    this.certificateManager.updateRoutes(routes);
 
     // Collect all domains and certificates for configuration
     const currentHostnames = new Set<string>();
@@ -425,7 +416,7 @@ export class NetworkProxy implements IMetricsTracker {
     // Update certificate cache with any static certificates
     for (const [domain, certData] of certificateUpdates.entries()) {
       try {
-        this.certificateManager.updateCertificateCache(
+        this.certificateManager.updateCertificate(
           domain,
           certData.cert,
           certData.key
@@ -547,8 +538,7 @@ export class NetworkProxy implements IMetricsTracker {
     // Close all connection pool connections
     this.connectionPool.closeAllConnections();
     
-    // Stop Port80Handler if internally managed
-    await this.certificateManager.stopPort80Handler();
+    // Certificate management cleanup is handled by SmartCertManager
     
     // Close the HTTPS server
     return new Promise((resolve) => {
@@ -566,7 +556,8 @@ export class NetworkProxy implements IMetricsTracker {
    * @returns A promise that resolves when the request is submitted (not when the certificate is issued)
    */
   public async requestCertificate(domain: string): Promise<boolean> {
-    return this.certificateManager.requestCertificate(domain);
+    this.logger.warn('requestCertificate is deprecated - use SmartCertManager instead');
+    return false;
   }
   
   /**
@@ -587,7 +578,7 @@ export class NetworkProxy implements IMetricsTracker {
     expiryDate?: Date
   ): void {
     this.logger.info(`Updating certificate for ${domain}`);
-    this.certificateManager.updateCertificateCache(domain, certificate, privateKey, expiryDate);
+    this.certificateManager.updateCertificate(domain, certificate, privateKey);
   }
 
   /**

package/ts/proxies/smart-proxy/certificate-manager.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../../plugins.js';
 import { NetworkProxy } from '../network-proxy/index.js';
 import type { IRouteConfig, IRouteTls } from './models/route-types.js';
+import type { IAcmeOptions } from './models/interfaces.js';
 import { CertStore } from './cert-store.js';
 
 export interface ICertStatus {
@@ -31,6 +32,9 @@ export class SmartCertManager {
   // Track certificate status by route name
   private certStatus: Map<string, ICertStatus> = new Map();
   
+  // Global ACME defaults from top-level configuration
+  private globalAcmeDefaults: IAcmeOptions | null = null;
+  
   // Callback to update SmartProxy routes for challenges
   private updateRoutesCallback?: (routes: IRouteConfig[]) => Promise<void>;
   
@@ -50,6 +54,13 @@ export class SmartCertManager {
     this.networkProxy = networkProxy;
   }
   
+  /**
+   * Set global ACME defaults from top-level configuration
+   */
+  public setGlobalAcmeDefaults(defaults: IAcmeOptions): void {
+    this.globalAcmeDefaults = defaults;
+  }
+  
   /**
    * Set callback for updating routes (used for challenge routes)
    */
@@ -146,7 +157,12 @@ export class SmartCertManager {
     domains: string[]
   ): Promise<void> {
     if (!this.smartAcme) {
-      throw new Error('SmartAcme not initialized');
+      throw new Error(
+        'SmartAcme not initialized. This usually means no ACME email was provided. ' +
+        'Please ensure you have configured ACME with an email address either:\n' +
+        '1. In the top-level "acme" configuration\n' +
+        '2. In the route\'s "tls.acme" configuration'
+      );
     }
     
     const primaryDomain = domains[0];
@@ -161,7 +177,12 @@ export class SmartCertManager {
       return;
     }
     
-    console.log(`Requesting ACME certificate for ${domains.join(', ')}`);
+    // Apply renewal threshold from global defaults or route config
+    const renewThreshold = route.action.tls?.acme?.renewBeforeDays || 
+                         this.globalAcmeDefaults?.renewThresholdDays || 
+                         30;
+    
+    console.log(`Requesting ACME certificate for ${domains.join(', ')} (renew ${renewThreshold} days before expiry)`);
     this.updateCertStatus(routeName, 'pending', 'acme');
     
     try {
@@ -303,7 +324,10 @@ export class SmartCertManager {
    */
   private isCertificateValid(cert: ICertificateData): boolean {
     const now = new Date();
-    const expiryThreshold = new Date(now.getTime() + 30 * 24 * 60 * 60 * 1000); // 30 days
+    
+    // Use renewal threshold from global defaults or fallback to 30 days
+    const renewThresholdDays = this.globalAcmeDefaults?.renewThresholdDays || 30;
+    const expiryThreshold = new Date(now.getTime() + renewThresholdDays * 24 * 60 * 60 * 1000);
     
     return cert.expiryDate > expiryThreshold;
   }
@@ -417,12 +441,15 @@ export class SmartCertManager {
    * Setup challenge handler integration with SmartProxy routing
    */
   private setupChallengeHandler(http01Handler: plugins.smartacme.handlers.Http01MemoryHandler): void {
+    // Use challenge port from global config or default to 80
+    const challengePort = this.globalAcmeDefaults?.port || 80;
+    
     // Create a challenge route that delegates to SmartAcme's HTTP-01 handler
     const challengeRoute: IRouteConfig = {
       name: 'acme-challenge',
       priority: 1000,  // High priority
       match: {
-        ports: 80,
+        ports: challengePort,
         path: '/.well-known/acme-challenge/*'
       },
       action: {

package/ts/proxies/smart-proxy/models/index.ts

@@ -1,5 +1,6 @@
 /**
  * SmartProxy models
  */
-export * from './interfaces.js';
+// Export everything except IAcmeOptions from interfaces
+export type { ISmartProxyOptions, IConnectionRecord, TSmartProxyCertProvisionObject } from './interfaces.js';
 export * from './route-types.js';

package/ts/proxies/smart-proxy/models/interfaces.ts

@@ -1,5 +1,19 @@
 import * as plugins from '../../../plugins.js';
-import type { IAcmeOptions } from '../../../certificate/models/certificate-types.js';
+// Certificate types removed - define IAcmeOptions locally
+export interface IAcmeOptions {
+  enabled?: boolean;
+  email?: string; // Required when any route uses certificate: 'auto'
+  environment?: 'production' | 'staging';
+  accountEmail?: string; // Alias for email
+  port?: number; // Port for HTTP-01 challenges (default: 80)
+  useProduction?: boolean; // Use Let's Encrypt production (default: false)
+  renewThresholdDays?: number; // Days before expiry to renew (default: 30)
+  autoRenew?: boolean; // Enable automatic renewal (default: true)
+  certificateStore?: string; // Directory to store certificates (default: './certs')
+  skipConfiguredCerts?: boolean;
+  renewCheckIntervalHours?: number; // How often to check for renewals (default: 24)
+  routeForwards?: any[];
+}
 import type { IRouteConfig } from './route-types.js';
 import type { TForwardingType } from '../../../forwarding/config/forwarding-types.js';
 
@@ -84,7 +98,22 @@ export interface ISmartProxyOptions {
   useNetworkProxy?: number[]; // Array of ports to forward to NetworkProxy
   networkProxyPort?: number; // Port where NetworkProxy is listening (default: 8443)
 
-  // ACME configuration options for SmartProxy
+  /**
+   * Global ACME configuration options for SmartProxy
+   * 
+   * When set, these options will be used as defaults for all routes
+   * with certificate: 'auto' that don't have their own ACME configuration.
+   * Route-specific ACME settings will override these defaults.
+   * 
+   * Example:
+   * ```ts
+   * acme: {
+   *   email: 'ssl@example.com',
+   *   useProduction: false,
+   *   port: 80
+   * }
+   * ```
+   */
   acme?: IAcmeOptions;
 
   /**

package/ts/proxies/smart-proxy/models/route-types.ts

@@ -1,5 +1,5 @@
 import * as plugins from '../../../plugins.js';
-import type { IAcmeOptions } from '../../../certificate/models/certificate-types.js';
+// Certificate types removed - use local definition
 import type { TForwardingType } from '../../../forwarding/config/forwarding-types.js';
 import type { PortRange } from '../../../proxies/nftables-proxy/models/interfaces.js';
 

package/ts/proxies/smart-proxy/route-manager.ts

@@ -173,6 +173,13 @@ export class RouteManager extends plugins.EventEmitter {
     return this.portMap.get(port) || [];
   }
   
+  /**
+   * Get all routes
+   */
+  public getAllRoutes(): IRouteConfig[] {
+    return [...this.routes];
+  }
+  
   /**
    * Test if a pattern matches a domain using glob matching
    */

package/ts/proxies/smart-proxy/smart-proxy.ts

@@ -115,21 +115,26 @@ export class SmartProxy extends plugins.EventEmitter {
       networkProxyPort: settingsArg.networkProxyPort || 8443,
     };
     
-    // Set default ACME options if not provided
-    this.settings.acme = this.settings.acme || {};
-    if (Object.keys(this.settings.acme).length === 0) {
+    // Normalize ACME options if provided (support both email and accountEmail)
+    if (this.settings.acme) {
+      // Support both 'email' and 'accountEmail' fields
+      if (this.settings.acme.accountEmail && !this.settings.acme.email) {
+        this.settings.acme.email = this.settings.acme.accountEmail;
+      }
+      
+      // Set reasonable defaults for commonly used fields
       this.settings.acme = {
-        enabled: false,
-        port: 80,
-        accountEmail: 'admin@example.com',
-        useProduction: false,
-        renewThresholdDays: 30,
-        autoRenew: true,
-        certificateStore: './certs',
-        skipConfiguredCerts: false,
-        httpsRedirectPort: 443,
-        renewCheckIntervalHours: 24,
-        routeForwards: []
+        enabled: this.settings.acme.enabled !== false, // Enable by default if acme object exists
+        port: this.settings.acme.port || 80,
+        email: this.settings.acme.email,
+        useProduction: this.settings.acme.useProduction || false,
+        renewThresholdDays: this.settings.acme.renewThresholdDays || 30,
+        autoRenew: this.settings.acme.autoRenew !== false, // Enable by default
+        certificateStore: this.settings.acme.certificateStore || './certs',
+        skipConfiguredCerts: this.settings.acme.skipConfiguredCerts || false,
+        renewCheckIntervalHours: this.settings.acme.renewCheckIntervalHours || 24,
+        routeForwards: this.settings.acme.routeForwards || [],
+        ...this.settings.acme // Preserve any additional fields
       };
     }
     
@@ -187,19 +192,55 @@ export class SmartProxy extends plugins.EventEmitter {
       return;
     }
     
-    // Use the first auto route's ACME config as defaults
-    const defaultAcme = autoRoutes[0]?.action.tls?.acme;
+    // Prepare ACME options with priority:
+    // 1. Use top-level ACME config if available
+    // 2. Fall back to first auto route's ACME config
+    // 3. Otherwise use undefined
+    let acmeOptions: { email?: string; useProduction?: boolean; port?: number } | undefined;
+    
+    if (this.settings.acme?.email) {
+      // Use top-level ACME config
+      acmeOptions = {
+        email: this.settings.acme.email,
+        useProduction: this.settings.acme.useProduction || false,
+        port: this.settings.acme.port || 80
+      };
+      console.log(`Using top-level ACME configuration with email: ${acmeOptions.email}`);
+    } else if (autoRoutes.length > 0) {
+      // Check for route-level ACME config
+      const routeWithAcme = autoRoutes.find(r => r.action.tls?.acme?.email);
+      if (routeWithAcme?.action.tls?.acme) {
+        const routeAcme = routeWithAcme.action.tls.acme;
+        acmeOptions = {
+          email: routeAcme.email,
+          useProduction: routeAcme.useProduction || false,
+          port: routeAcme.challengePort || 80
+        };
+        console.log(`Using route-level ACME configuration from route '${routeWithAcme.name}' with email: ${acmeOptions.email}`);
+      }
+    }
+    
+    // Validate we have required configuration
+    if (autoRoutes.length > 0 && !acmeOptions?.email) {
+      throw new Error(
+        'ACME email is required for automatic certificate provisioning. ' +
+        'Please provide email in either:\n' +
+        '1. Top-level "acme" configuration\n' +
+        '2. Individual route\'s "tls.acme" configuration'
+      );
+    }
     
     this.certManager = new SmartCertManager(
       this.settings.routes,
-      './certs', // Certificate directory
-      defaultAcme ? {
-        email: defaultAcme.email,
-        useProduction: defaultAcme.useProduction,
-        port: defaultAcme.challengePort || 80
-      } : undefined
+      this.settings.acme?.certificateStore || './certs',
+      acmeOptions
     );
     
+    // Pass down the global ACME config to the cert manager
+    if (this.settings.acme) {
+      this.certManager.setGlobalAcmeDefaults(this.settings.acme);
+    }
+    
     // Connect with NetworkProxy
     if (this.networkProxyBridge.getNetworkProxy()) {
       this.certManager.setNetworkProxy(this.networkProxyBridge.getNetworkProxy());
@@ -250,9 +291,14 @@ export class SmartProxy extends plugins.EventEmitter {
 
     // Validate the route configuration
     const configWarnings = this.routeManager.validateConfiguration();
-    if (configWarnings.length > 0) {
-      console.log("Route configuration warnings:");
-      for (const warning of configWarnings) {
+    
+    // Also validate ACME configuration
+    const acmeWarnings = this.validateAcmeConfiguration();
+    const allWarnings = [...configWarnings, ...acmeWarnings];
+    
+    if (allWarnings.length > 0) {
+      console.log("Configuration warnings:");
+      for (const warning of allWarnings) {
         console.log(` - ${warning}`);
       }
     }
@@ -664,5 +710,76 @@ export class SmartProxy extends plugins.EventEmitter {
   public async getNfTablesStatus(): Promise<Record<string, any>> {
     return this.nftablesManager.getStatus();
   }
+  
+  /**
+   * Validate ACME configuration
+   */
+  private validateAcmeConfiguration(): string[] {
+    const warnings: string[] = [];
+    
+    // Check for routes with certificate: 'auto'
+    const autoRoutes = this.settings.routes.filter(r => 
+      r.action.tls?.certificate === 'auto'
+    );
+    
+    if (autoRoutes.length === 0) {
+      return warnings;
+    }
+    
+    // Check if we have ACME email configuration
+    const hasTopLevelEmail = this.settings.acme?.email;
+    const routesWithEmail = autoRoutes.filter(r => r.action.tls?.acme?.email);
+    
+    if (!hasTopLevelEmail && routesWithEmail.length === 0) {
+      warnings.push(
+        'Routes with certificate: "auto" require ACME email configuration. ' +
+        'Add email to either top-level "acme" config or individual route\'s "tls.acme" config.'
+      );
+    }
+    
+    // Check for port 80 availability for challenges
+    if (autoRoutes.length > 0) {
+      const challengePort = this.settings.acme?.port || 80;
+      const portsInUse = this.routeManager.getListeningPorts();
+      
+      if (!portsInUse.includes(challengePort)) {
+        warnings.push(
+          `Port ${challengePort} is not configured for any routes but is needed for ACME challenges. ` +
+          `Add a route listening on port ${challengePort} or ensure it's accessible for HTTP-01 challenges.`
+        );
+      }
+    }
+    
+    // Check for mismatched environments
+    if (this.settings.acme?.useProduction) {
+      const stagingRoutes = autoRoutes.filter(r => 
+        r.action.tls?.acme?.useProduction === false
+      );
+      if (stagingRoutes.length > 0) {
+        warnings.push(
+          'Top-level ACME uses production but some routes use staging. ' +
+          'Consider aligning environments to avoid certificate issues.'
+        );
+      }
+    }
+    
+    // Check for wildcard domains with auto certificates
+    for (const route of autoRoutes) {
+      const domains = Array.isArray(route.match.domains) 
+        ? route.match.domains 
+        : [route.match.domains];
+      
+      const wildcardDomains = domains.filter(d => d?.includes('*'));
+      if (wildcardDomains.length > 0) {
+        warnings.push(
+          `Route "${route.name}" has wildcard domain(s) ${wildcardDomains.join(', ')} ` +
+          'with certificate: "auto". Wildcard certificates require DNS-01 challenges, ' +
+          'which are not currently supported. Use static certificates instead.'
+        );
+      }
+    }
+    
+    return warnings;
+  }
 
 }

package/ts/certificate/acme/acme-factory.ts

@@ -1,48 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-import type { IAcmeOptions } from '../models/certificate-types.js';
-import { ensureCertificateDirectory } from '../utils/certificate-helpers.js';
-// We'll need to update this import when we move the Port80Handler
-import { Port80Handler } from '../../http/port80/port80-handler.js';
-
-/**
- * Factory to create a Port80Handler with common setup.
- * Ensures the certificate store directory exists and instantiates the handler.
- * @param options Port80Handler configuration options
- * @returns A new Port80Handler instance
- */
-export function buildPort80Handler(
-  options: IAcmeOptions
-): Port80Handler {
-  if (options.certificateStore) {
-    ensureCertificateDirectory(options.certificateStore);
-    console.log(`Ensured certificate store directory: ${options.certificateStore}`);
-  }
-  return new Port80Handler(options);
-}
-
-/**
- * Creates default ACME options with sensible defaults
- * @param email Account email for ACME provider
- * @param certificateStore Path to store certificates
- * @param useProduction Whether to use production ACME servers
- * @returns Configured ACME options
- */
-export function createDefaultAcmeOptions(
-  email: string,
-  certificateStore: string,
-  useProduction: boolean = false
-): IAcmeOptions {
-  return {
-    accountEmail: email,
-    enabled: true,
-    port: 80,
-    useProduction,
-    httpsRedirectPort: 443,
-    renewThresholdDays: 30,
-    renewCheckIntervalHours: 24,
-    autoRenew: true,
-    certificateStore,
-    skipConfiguredCerts: false
-  };
-}

package/ts/certificate/acme/challenge-handler.ts

@@ -1,110 +0,0 @@
-import * as plugins from '../../plugins.js';
-import type { IAcmeOptions, ICertificateData } from '../models/certificate-types.js';
-import { CertificateEvents } from '../events/certificate-events.js';
-
-/**
- * Manages ACME challenges and certificate validation
- */
-export class AcmeChallengeHandler extends plugins.EventEmitter {
-  private options: IAcmeOptions;
-  private client: any; // ACME client from plugins
-  private pendingChallenges: Map<string, any>;
-
-  /**
-   * Creates a new ACME challenge handler
-   * @param options ACME configuration options
-   */
-  constructor(options: IAcmeOptions) {
-    super();
-    this.options = options;
-    this.pendingChallenges = new Map();
-
-    // Initialize ACME client if needed
-    // This is just a placeholder implementation since we don't use the actual
-    // client directly in this implementation - it's handled by Port80Handler
-    this.client = null;
-    console.log('Created challenge handler with options:',
-      options.accountEmail,
-      options.useProduction ? 'production' : 'staging'
-    );
-  }
-
-  /**
-   * Gets or creates the ACME account key
-   */
-  private getAccountKey(): Buffer {
-    // Implementation details would depend on plugin requirements
-    // This is a simplified version
-    if (!this.options.certificateStore) {
-      throw new Error('Certificate store is required for ACME challenges');
-    }
-    
-    // This is just a placeholder - actual implementation would check for
-    // existing account key and create one if needed
-    return Buffer.from('account-key-placeholder');
-  }
-
-  /**
-   * Validates a domain using HTTP-01 challenge
-   * @param domain Domain to validate
-   * @param challengeToken ACME challenge token
-   * @param keyAuthorization Key authorization for the challenge
-   */
-  public async handleHttpChallenge(
-    domain: string,
-    challengeToken: string,
-    keyAuthorization: string
-  ): Promise<void> {
-    // Store challenge for response
-    this.pendingChallenges.set(challengeToken, keyAuthorization);
-    
-    try {
-      // Wait for challenge validation - this would normally be handled by the ACME client
-      await new Promise(resolve => setTimeout(resolve, 1000));
-      this.emit(CertificateEvents.CERTIFICATE_ISSUED, {
-        domain,
-        success: true
-      });
-    } catch (error) {
-      this.emit(CertificateEvents.CERTIFICATE_FAILED, {
-        domain,
-        error: error instanceof Error ? error.message : String(error),
-        isRenewal: false
-      });
-      throw error;
-    } finally {
-      // Clean up the challenge
-      this.pendingChallenges.delete(challengeToken);
-    }
-  }
-
-  /**
-   * Responds to an HTTP-01 challenge request
-   * @param token Challenge token from the request path
-   * @returns The key authorization if found
-   */
-  public getChallengeResponse(token: string): string | null {
-    return this.pendingChallenges.get(token) || null;
-  }
-
-  /**
-   * Checks if a request path is an ACME challenge
-   * @param path Request path
-   * @returns True if this is an ACME challenge request
-   */
-  public isAcmeChallenge(path: string): boolean {
-    return path.startsWith('/.well-known/acme-challenge/');
-  }
-
-  /**
-   * Extracts the challenge token from an ACME challenge path
-   * @param path Request path
-   * @returns The challenge token if valid
-   */
-  public extractChallengeToken(path: string): string | null {
-    if (!this.isAcmeChallenge(path)) return null;
-    
-    const parts = path.split('/');
-    return parts[parts.length - 1] || null;
-  }
-}

package/ts/certificate/acme/index.ts

@@ -1,3 +0,0 @@
-/**
- * ACME certificate provisioning
- */

package/ts/certificate/events/certificate-events.ts

@@ -1,36 +0,0 @@
-/**
- * Certificate-related events emitted by certificate management components
- */
-export enum CertificateEvents {
-  CERTIFICATE_ISSUED = 'certificate-issued',
-  CERTIFICATE_RENEWED = 'certificate-renewed',
-  CERTIFICATE_FAILED = 'certificate-failed',
-  CERTIFICATE_EXPIRING = 'certificate-expiring',
-  CERTIFICATE_APPLIED = 'certificate-applied',
-  // Events moved from Port80Handler for compatibility
-  MANAGER_STARTED = 'manager-started',
-  MANAGER_STOPPED = 'manager-stopped',
-}
-
-/**
- * Port80Handler-specific events including certificate-related ones
- * @deprecated Use CertificateEvents and HttpEvents instead
- */
-export enum Port80HandlerEvents {
-  CERTIFICATE_ISSUED = 'certificate-issued',
-  CERTIFICATE_RENEWED = 'certificate-renewed',
-  CERTIFICATE_FAILED = 'certificate-failed',
-  CERTIFICATE_EXPIRING = 'certificate-expiring',
-  MANAGER_STARTED = 'manager-started',
-  MANAGER_STOPPED = 'manager-stopped',
-  REQUEST_FORWARDED = 'request-forwarded',
-}
-
-/**
- * Certificate provider events
- */
-export enum CertProvisionerEvents {
-  CERTIFICATE_ISSUED = 'certificate',
-  CERTIFICATE_RENEWED = 'certificate',
-  CERTIFICATE_FAILED = 'certificate-failed'
-}