Pre-generate DH params

The program now outputs a combined PEM certificate.

A new option allows DH-param generation to be disabled.

1 files changed, 32 insertions, 20 deletions

diff --git a/README.md b/README.md
index 9db3b7b..b2d5422 100644
--- a/README.md
+++ b/README.md
@@ -1,31 +1,35 @@
-# Let's Encrypt ACME protocol
+# `acme-certify` -- A `Let's Encrypt!` ACME client
 
 ```
 Let's Encrypt! ACME client
 
 Usage: acme-certify --key FILE --domain DOMAIN --challenge-dir DIR
                     [--domain-dir DIR] [--email ADDRESS] [--terms URL]
-                    [--staging]
+                    [--skip-dhparams] [--staging] [--skip-provision-check]
   This program will generate a signed TLS certificate using the ACME protocol
   and the free Let's Encrypt! CA.
 
 Available options:
   -h,--help                Show this help text
-  --key FILE               filename of your private RSA key
-  --domain DOMAIN          the domain name(s) to certify; specify more than once
+  --key FILE               Filename of your private RSA key
+  --domain DOMAIN          The domain name(s) to certify; specify more than once
                            for a multi-domain certificate
-  --challenge-dir DIR      output directory for ACME challenges
-  --domain-dir DIR         directory in which to domain certificates and keys
+  --challenge-dir DIR      Output directory for ACME challenges
+  --domain-dir DIR         Directory in which to domain certificates and keys
                            are stored; the default is to use the (first) domain
                            name as a directory name
-  --email ADDRESS          an email address with which to register an account
-  --terms URL              the terms param of the registration request
-  --staging                use staging servers instead of live servers
+  --email ADDRESS          An email address with which to register an account
+  --terms URL              The terms param of the registration request
+  --skip-dhparams          Don't generate DH params for combined cert
+  --staging                Use staging servers instead of live servers
                            (generated certificates will not be trusted!)
+  --skip-provision-check   Don't test whether HTTP provisioning works before
+                           making ACME requests; only useful for testing.
 ```
 
-This program can be used to obtain a certificate from
-[Let's Encrypt](https://letsencrypt.org/) using their ACME protocol.
+This program can be used to obtain a certificate from the
+[Let's Encrypt](https://letsencrypt.org/) certificate authority, using their
+ACME protocol.
 
 ## Rate Limits
 
@@ -63,27 +67,35 @@ openssl genrsa 4096 > ${DOMAIN}/rsa.key
 
 ## Receive certificate
 
-The signed certificate will be saved by this program in
-``./${DOMAIN}/cert.der``. You can copy that file to the place your TLS
-server is configured to read it.
+The signed certificate will be saved by this program in `./${DOMAIN}/cert.pem`.
+A combined certificate, containing the issuer certificate, the private key, and
+(possibly) DH parameters, will be saved in `./${DOMAIN}/cert.combined.pem`. You
+can copy that file to the place your TLS server is configured to read it.
 
 You can also view the certificate like so:
 
 ```
-openssl x509 -inform der -in ${DOMAIN}/cert.der  -noout -text | less
+openssl x509 -in ${DOMAIN}/cert.pem -noout -text | less
 ```
 
 ## Create a certificate for HAProxy
 
 Vo Minh Thu, the original author of this program, suggests to include explicit
 DH key exchange parameters to prevent the [Logjam attack](https://weakdh.org/).
+This is now automatically performed by default.
+
+Note: generating DH params is CPU-intensive and takes a long time. For that
+reason, it is done once per domain, and the result is saved in
+`${DOMAIN}/dhparams.pem`.
+
+You can also disable DH generation it with `--skip-dhparams`.
+
+The certificate is generated by this program equivalently to this:
 
 ```
-> openssl x509 -inform der -in ${DOMAIN}/cert.der \
-    -out ${DOMAIN}/cert.pem
-> openssl dhparam -out ${DOMAIN}/dhparams.pem 2048
-> cat ${DOMAIN}/cert.pem \
+openssl dhparam -out ${DOMAIN}/dhparams.pem 2048
+cat ${DOMAIN}/cert.pem \
     lets-encrypt-x1-cross-signed.pem \
     ${DOMAIN}/rsa.key \
-    ${DOMAIN}/dhparams.pem > aaa.reesd.com-combined.pem
+    ${DOMAIN}/dhparams.pem > ${DOMAIN}/cert.combined.pem
 ```