Project Atlas AetherDev project hub
Atlas project production

CertManager

Automate certificate issuance and renewal via ACME with hooks for DNS/web validation and post-deploy workflows. Read dehydrated config and domains.txt for target certificates. Perform ACME challenges (HTTP-01 or DNS-01) and issue/renew certs as needed. Run hook scripts for DNS integration or post-renew deployment steps.

Internal-only entry. Do not publish externally without review.
Type
System
Lifecycle
Maintenance
Last touched
2023-07-12
Visibility
Internal

Purpose

Automate certificate issuance and renewal via ACME with hooks for DNS/web validation and post-deploy workflows.

Current state

Last touched: 2023-07-12. The repo still appears to underpin the monthly Fortinet certificate update path, but the live `startle.sh` runbook and rollback steps are not yet documented in Atlas.

Next step

Document the certificate source, monthly Fortinet update flow, rollback procedure, and expiry alerting expectations.

Interfaces

Inputs
  • config file, domains.txt, hook scripts
Outputs
  • Certificate files, account key, renewal logs
  • .txt

Reality to Action trace

Reality Ingestion

Contributes in this stage.

Canonical Storage

Not in scope.

Automation Engines

Contributes in this stage.

Human Interfaces

Contributes in this stage.

Operational Adoption

Contributes in this stage.

Core workflow

TBD. Document the 5-10 steps that define the core workflow.

Artifacts

  • `config` and `domains.txt` file format used by dehydrated

Operational notes

Constraints and scars

  • Depends on DNS/web challenge configuration and provider TTL behavior; rate limits apply for production ACME endpoints.

Reliability posture

Failure modes and safe behavior: Challenge failures abort issuance; existing certs remain unchanged. Idempotency / retries / batching behavior: Cron runs renew only when needed; no built-in retries.

Observability

  • Logs: stdout/stderr; hook scripts can add additional logging
  • Metrics/health checks: None documented
  • Logs: stdout/stderr from dehydrated; hook scripts can emit additional logs.

Security and privacy

Protect account keys and private keys; restrict access to cert and account directories.

Dependencies

Upstream
  • ACME servers (e.g., Let's Encrypt), DNS/web servers for challenges

Ownership

Owners

Josh Barton

Users

Josh Barton (owner)

CertManager

Architecture & Major Components

  • High-level diagram (text):

    • Config + domains -> ACME challenge -> cert issuance -> hooks -> output files

  • Entry points: CertManager/dehydrated

  • Top-level folders: accounts, certs, docs, hooks

  • Key abstractions: dehydrated CLI, hooks for DNS/HTTP integration

Setup / Build / Run

  • Build system(s): None (bash script).
  • Provide config and domains.txt, then run dehydrated via cron with optional hooks.

Registry Alignment

  • Mapped registry entry: INT-078.
  • The registry clarifies that this project is still operationally relevant because the production automation host runs startle.sh monthly to update Fortinet SSL certificates.
  • Validation gaps still open: exact certificate source, firewall update method, rollback steps, and change-approval process for certificate rotation.