From 1dfddb9d701fb442fb78b23d12d0b2381b0e2f00 Mon Sep 17 00:00:00 2001 From: Mohammed Al Sahaf Date: Tue, 23 Apr 2024 17:26:32 +0300 Subject: [PATCH] acme_server: add docs of `challenges` and allow/deny policy --- .../caddyfile/directives/acme_server.md | 25 ++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/src/docs/markdown/caddyfile/directives/acme_server.md b/src/docs/markdown/caddyfile/directives/acme_server.md index d30bbc8..a074ab8 100644 --- a/src/docs/markdown/caddyfile/directives/acme_server.md +++ b/src/docs/markdown/caddyfile/directives/acme_server.md @@ -18,9 +18,19 @@ Using ACME server defaults, ACME clients should simply be configured to use `htt ```caddy-d acme_server [] { - ca - lifetime - resolvers + ca + lifetime + resolvers + challenges + allow_wildcard_names + allow { + domains + ip_ranges + } + deny { + domains + ip_ranges + } } ``` @@ -30,6 +40,15 @@ acme_server [] { - **resolvers** are the addresses of DNS resolvers to use when looking up the TXT records for solving ACME DNS challenges. Accepts [network addresses](/docs/conventions#network-addresses) defaulting to UDP and port 53 unless specified. If the host is an IP address, it will be dialed directly to resolve the upstream server. If the hot is not an IP address, the addresses are resolved using the [name resolution convention](https://golang.org/pkg/net/#hdr-Name_Resolution) of the Go standard library. If multiple resolvers are specified, then one is chosen at random. +- **challenges** sets the enabled challenge types. If not set or the directive is used without values, then all challenge types are enabled. Accepted values are: http-01, tls-alpn-01, dns-01. + +- **allow_wildcard_names** enables issuing of certificates with wildcard SAN (Subject Alternative Name) + +- **allow**, **deny** configure the operational policy of the `acme_server`. The policy evaluation follows the criteria described by Step-CA [here](https://smallstep.com/docs/step-ca/policies/#policy-evaluation). + + - **domains** sets the subject domain names to be allowed or denied per the policy evaluation criteria. + + - **ip_ranges** sets the subject IP ranges to be allowed or denied per the policy evaluation criteria. ## Examples