-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
26 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,5 @@ | ||
# CertJunkie | ||
|
||
This project is inspired by [acme-dns](https://github.com/joohoi/acme-dns). While acme-dns is awesome to use with other acme clients, it lacks of capabilities of shared certs and anonymous usage. | ||
|
||
I want to have a simple http server to create, challenge and receive my (lets encrypt) certs from an central point. | ||
|
@@ -7,6 +8,7 @@ As it is intended to be used within an private and closed context, optional auth | |
## Usage | ||
|
||
``` | ||
server | ||
--dns.domain string The NS domain name of this server (default "ns.local") | ||
--dns.listen string Bind on this port to run the DNS server on (tcp and udp) (default ":53") | ||
--dns.zone string The zone we are using to provide the txt records for challenge (default "acme.local") | ||
|
@@ -22,27 +24,43 @@ As it is intended to be used within an private and closed context, optional auth | |
For combatible dns provdider look at https://github.com/xenolf/lego/tree/master/providers/dns | ||
|
||
### Docker | ||
|
||
[Image DockerHub](https://hub.docker.com/r/project0de/certjunkie) | ||
|
||
```bash | ||
docker run -ti -p 80:80 -p 53:53 -p 53:53/udp \ | ||
-v $(pwd)/certjunkie:/storage project0de/certjunkie \ | ||
--storage.local /storage --email [email protected] --dns.zone certjunkie.domain.com --dns.domain thisserver.domain.com | ||
server --storage.local /storage --email [email protected] --dns.zone certjunkie.domain.com --dns.domain thisserver.domain.com | ||
``` | ||
|
||
### Client | ||
|
||
certjunkie has a built in client to write certificate easy to file. | ||
|
||
```bash | ||
certjunkie client --address "http://localhost:8080" --domain "my.domain.de" \ | ||
--file.cert my.domain.de.crt \ | ||
--file.key my.domain.de.key \ | ||
--file.ca my.domain.de.ca \ | ||
--file.bundle my.domain.de.bundle | ||
``` | ||
|
||
### Client example with curl | ||
|
||
```bash | ||
curl http://localhost:8080/cert/my.domain.de/cert -Fo my.domain.de.crt && \ | ||
curl http://localhost:8080/cert/my.domain.de/key -Fo my.domain.de.key && \ | ||
curl http://localhost:8080/cert/my.domain.de/ca -Fo my.domain.de.ca | ||
``` | ||
|
||
## `dnscname` DNS redirect with CNAME | ||
|
||
This is actually `$challengeDomain.$dnsDomain.`. | ||
Ensure the NS record is set to this server | ||
|
||
### Example | ||
Asume starting with `certjunkie --dns.domain certjunkiens.example.com --dns.zone certjunkie.example.com --email [email protected]` | ||
|
||
Asume starting with `certjunkie server --dns.domain certjunkiens.example.com --dns.zone certjunkie.example.com --email [email protected]` | ||
|
||
1. Delegate a subdomain to the server running certbot on your remote hosted DNS `example.com`: | ||
``` | ||
|
@@ -60,6 +78,7 @@ _acme-challenge.service.cloud.yourdomain.com CNAME service.cloud.yourdomain.com | |
``` | ||
|
||
## API | ||
|
||
* `domain`: Get an cert which matches this domain. | ||
|
||
### GET /cert/{domain} | ||
|
@@ -68,18 +87,23 @@ Get JSON of an cert with CA and key | |
If the cert does not exist (or is not valid anymore) it will request a new one (sync). | ||
|
||
#### Optional query parameters | ||
|
||
* `san`: Comma separated list of subject alternative names the cert must have. | ||
* `onlycn`: Get only a cert which matches the CommonName | ||
* `valid`: How long needs the cert to be valid in days before requesting a new one. Defaults to 30 | ||
|
||
### GET /cert/{domain}/cert | ||
|
||
Retrieve only the certificate pem encoded. | ||
|
||
### GET /cert/{domain}/ca | ||
|
||
Retrieve only the Issuer Certificate (CA) pem encoded. | ||
|
||
### GET /cert/{domain}/bundle | ||
|
||
Retrieve bundled cert with ca pem encoded. | ||
|
||
### GET /cert/{domain}/key | ||
|
||
Retrieve the private key pem encoded. |