{"action":"created","issue":{"url":"https://api.github.com/repos/ericchiang/letsencrypt/issues/11","labels_url":"https://api.github.com/repos/ericchiang/letsencrypt/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/ericchiang/letsencrypt/issues/11/comments","events_url":"https://api.github.com/repos/ericchiang/letsencrypt/issues/11/events","html_url":"https://github.com/ericchiang/letsencrypt/issues/11","id":119799345,"number":11,"title":"Renewing Certificates requires certificate url","user":{"login":"cristiangraz","id":169986,"avatar_url":"https://avatars.githubusercontent.com/u/169986?v=3","gravatar_id":"","url":"https://api.github.com/users/cristiangraz","html_url":"https://github.com/cristiangraz","followers_url":"https://api.github.com/users/cristiangraz/followers","following_url":"https://api.github.com/users/cristiangraz/following{/other_user}","gists_url":"https://api.github.com/users/cristiangraz/gists{/gist_id}","starred_url":"https://api.github.com/users/cristiangraz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristiangraz/subscriptions","organizations_url":"https://api.github.com/users/cristiangraz/orgs","repos_url":"https://api.github.com/users/cristiangraz/repos","events_url":"https://api.github.com/users/cristiangraz/events{/privacy}","received_events_url":"https://api.github.com/users/cristiangraz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-01T20:19:46Z","updated_at":"2015-12-01T22:34:35Z","closed_at":null,"body":"Do you have any examples for renewing certificates? From what I can tell, you need the certificate URL returned when requesting the certificate. The library doesn't currently return that. \r\n\r\nI'd be helpful to have the Location and Content-Location headers returned from calling NewCertificate. I'd like to store those. What do you think about changing the method signature to:\r\n\r\n```\r\nNewCertificate(accountKey interface{}, csr *x509.CertificateRequest) (*x509.Certificate, Location string, ContentLocation string, error) {\r\n```\r\nor\r\n```\r\nNewCertificate(accountKey interface{}, csr *x509.CertificateRequest) (*x509.Certificate, http.Header, error) {\r\n```\r\n\r\nI'm having trouble getting boot2docker to actually forward requests to my host machine so I can verify challenges and get to that step, so haven't been able to verify (otherwise I'd submit a PR)."},"comment":{"url":"https://api.github.com/repos/ericchiang/letsencrypt/issues/comments/161118036","html_url":"https://github.com/ericchiang/letsencrypt/issues/11#issuecomment-161118036","issue_url":"https://api.github.com/repos/ericchiang/letsencrypt/issues/11","id":161118036,"user":{"login":"cristiangraz","id":169986,"avatar_url":"https://avatars.githubusercontent.com/u/169986?v=3","gravatar_id":"","url":"https://api.github.com/users/cristiangraz","html_url":"https://github.com/cristiangraz","followers_url":"https://api.github.com/users/cristiangraz/followers","following_url":"https://api.github.com/users/cristiangraz/following{/other_user}","gists_url":"https://api.github.com/users/cristiangraz/gists{/gist_id}","starred_url":"https://api.github.com/users/cristiangraz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristiangraz/subscriptions","organizations_url":"https://api.github.com/users/cristiangraz/orgs","repos_url":"https://api.github.com/users/cristiangraz/repos","events_url":"https://api.github.com/users/cristiangraz/events{/privacy}","received_events_url":"https://api.github.com/users/cristiangraz/received_events","type":"User","site_admin":false},"created_at":"2015-12-01T22:34:35Z","updated_at":"2015-12-01T22:34:35Z","body":"Thanks, Eric. From what I understand of section 6.6 (page 32), ```Content-Location``` is the URL to the current certificate. Any future requests to that URL will always return the exact same certificate. ```Location``` is the URL to hit if you want a new certificate (and how you would be able to handle renewals).\r\n\r\nI also found a potential bug. I'm going to list here as it's relevant to the conversation. If you look in section 6.6 of the spec on page 31:\r\n\r\n```\r\n If the CA decides to issue a certificate, then the server creates a\r\n   new certificate resource and returns a URI for it in the Location\r\n   header field of a 201 (Created) response.\r\n\r\n   HTTP/1.1 201 Created\r\n   Location: https://example.com/acme/cert/asdf\r\n\r\n   If the certificate is available at the time of the response, it is\r\n   provided in the body of the response.  If the CA has not yet issued\r\n   the certificate, the body of this response will be empty.  The client\r\n   should then send a GET request to the certificate URI to poll for the\r\n   certificate.  As long as the certificate is unavailable, the server\r\n   MUST provide a 202 (Accepted) response and include a Retry-After\r\n   header to indicate when the server believes the certificate will be\r\n   issued (as in the example above).\r\n```\r\n\r\nRight now, NewCertificate always assumes a certificate is immediately available in the response body, when there's a chance a Retry-After header will be sent and some polling may be required to actually obtain the certificate.\r\n\r\nThat's why I was thinking it may be beneficial for NewCertificate to return the URLs or headers. If NewCertificate isn't able to return a certificate immediately, but no error was thrown, the user can handle polling the URL until the certificate is ready. Or we can even add in a convenience function in the library. In this case the headers may be helpful since the user would need Location, Content-Location, and Retry-After headers after the call to NewCertificate.\r\n\r\nLego handles this by sleeping for the Retry-After period and trying again once. Since the Retry-After period could be long, I don't particularly like this approach since users using this library are piecing together their own functionality. Here is the relevant code however: https://github.com/xenolf/lego/blob/master/acme/client.go#L575-L614\r\n\r\nStill trying to get boulder to verify challenges on my mac, but if I can get that working I'm happy to work on this and submit a PR once we come up with how this should work."}}