SwiftACMEKit.git · README.md

revision 4224370ed166c5a0edb892a0de67b0b58d698071 · complete file
# SwiftACMEKit

Provider-neutral Swift boundary for explicit ACME certificate lifecycle work.

This repository is currently a governed implementation scaffold. It defines the package boundary, explicit ACME
directory configuration, typed identifiers, replaceable transport/custody/challenge protocols, an HTTP-01 challenge
store, deterministic authorization/order state transitions, and JWK/JWS serialization with an injected signer
boundary, plus an offline in-memory mock order authority. Certificate issuance, SHA-256
thumbprints, real cryptographic signing, persistence, mock-server lifecycle, and Linux evidence are not implemented
yet and are not claimed.

The governing design is [Chapter 96](../Reframe-Refactoring/docs/96-swiftacmekit-is-a-provider-neutral-certificate-automation-boundary.md).
Let's Encrypt staging is a directory configuration, not the identity of the package. No production CA account,
certificate, DNS change, host installation, or secure deployment is created by this scaffold.

The package now includes a real HTTPS `URLSessionACMETransport` and explicit replay-nonce acquisition. It still
supports account registration and order creation with an injected Swift Crypto ES256 signer. It still does not
complete authorizations, generate CSRs, finalize orders, persist production keys, or install certificates; those
remain typed host-custody and lifecycle gates.