ol.clave.automation.impl.config

Merge global config with per-domain overrides.

Returns the resolved configuration for a specific domain by merging the global config with any per-domain overrides from config-fn.

If config-fn is nil or returns nil, returns the global config unchanged.

Select issuers based on the issuer-selection policy.

Returns the issuers in the appropriate order based on :issuer-selection: - :in-order (default) - return issuers in original order - :shuffle - return issuers in random order

Let’s Encrypt production directory URL.

Returns the default configuration for the automation layer.

Default values: - Issuer: Let’s Encrypt production - Key type: P256 (ECDSA) - OCSP: enabled, must-staple disabled - ARI: enabled - Key reuse: disabled - Cache capacity: unlimited

Extract issuer key from directory URL.

Returns a unique identifier for the issuer based on the URL’s host and path.

Generate storage key for a certificate PEM file.

Format: certificates/{issuer-key}/{domain}/{domain}.crt

Generate storage key for a private key PEM file.

Format: certificates/{issuer-key}/{domain}/{domain}.key

Generate storage key for certificate metadata EDN file.

Format: certificates/{issuer-key}/{domain}/{domain}.edn

Generate storage prefix for listing certificates under an issuer.

Format: certificates/{issuer-key}

Generate storage key for an account private key PEM file.

Format: accounts/{issuer-key}/account.key

Generate storage key for an account public key PEM file.

Generate storage key for account registration EDN.

Format: accounts/{issuer-key}/registration.edn

Contains the account KID (URL) returned by the CA after registration, allowing subsequent operations to skip the newAccount call.

Generate storage key for an OCSP staple file.

Format: certificates/{issuer-key}/{domain}/{domain}.ocsp

The OCSP staple is stored as raw DER-encoded bytes.

Generate storage key for archiving a compromised private key.

Format: keys/{domain}.compromised.{timestamp}

Compromised keys are archived for audit purposes and never reused.

Generate storage key for ARI (ACME Renewal Information) data.

Format: certificates/{issuer-key}/{domain}/{domain}.ari.edn

The ARI data is stored as EDN containing suggested-window, selected-time, and retry-after.

Generate storage key for a challenge token (distributed solving).

Format: challenge_tokens/{issuer-key}/{identifier}.edn

Used to store challenge data so any instance in a cluster can serve the challenge response for HTTP-01 or TLS-ALPN-01 validation.

Select a certificate chain based on preference.

Preferences: - :any (default) - return first chain offered - :shortest - return chain with fewest certificates - {:root "Root CA Name"} - return chain with matching root name

Returns nil if chains is empty. Falls back to first chain if root name not found.