CertLord

TLS certificate lifecycle automation.

Version: 1.3.0. See the release notes.

The optional AWS/CloudFront renewal job is experimental and disabled by default. It requires separate SDK installation and job configuration. Verification so far covers a controlled provider. Live AWS permissions and edge propagation still require qualification.

CertLord automates TLS certificate issuance, renewal and deployment. It supports ACME through Certbot and importing existing PEM certificates, stores certificates in Vault and deploys them through Auton. Optional destination TLS verification checks the certificate actually served before acknowledgement. StatusCake/Updown adapters are optional; expiry observations are exposed for an external supervision system. Independent TLS checks also observe configured endpoints without issuing or deploying certificates. They expose the actual served fingerprint, failures and freshness through the API, CLI/TUI and metrics. It uses DWho, HTTPdis and Sonicprobe.

Redis stores temporary ACME HTTP-01 challenge responses and tracks pending work, retries and deployment leases. Vault stores certificate material. Use the Docker Compose installation to run the services together, or provision them separately for the Debian installation.

Docker installation

Use the Compose guide for initialization, persistent Vault storage, API access and deployment configuration. The application image is decryptus/certlord:1.3.0.

Command line and terminal interface

Use ordinary commands in scripts, or explicitly open the read-only terminal browser with certlord tui. View the illustrated guide.

Real client capture with synthetic demonstration data; this is not deployment evidence.

Names and installation

• Python distribution and package: certlord
• Command and system service: certlord
• Default configuration: /etc/certlord/certlord.yml
• Service user and group: certlord

Requires Python 3.11+ on POSIX; CI validates Python 3.11 and 3.12. Newer interpreters are not yet validated. Install the Python package with python -m pip install .. System configuration and external services must also be provisioned. The Debian 12 package includes an isolated Python environment and the service account; follow the installation guide before enabling the service. Repository: https://github.com/decryptus/certlord. Validate configuration, recovery and credentials in an isolated environment before deploying your service.

See MIGRATION.md before updating an existing installation.

Project documentation

• CLI and TUI screenshots
• Evaluate your installation
• Certificate UUIDs, HTTP API, CLI and TUI
• ACME HTTP Connector integration
• Debian 12 installation and isolated dependencies
• External certificate import and replacement
• Independent TLS endpoints: web, proxy, load balancer and CDN
• Operations and recovery
• Operation correlation and optional Auton receipts
• Coding conventions and contributions

Guide: Certificate observations and supervision.

Post-deployment TLS verification checks configured destinations before acknowledgement.

Named deployment destinations track each server's certificate fingerprint and result, retain partial success through restart, and support explicit retries of one failed destination.

Operations and recovery: health, queues, retries and first-version limits.

See configuration validation for YAML schema coverage and compatibility.

Documentation

• Users: installation, configuration, operation and API usage in this README and the user guide.
• Contributors: architecture, tests and development.

Textual terminal interface

See the Textual guide for installation, navigation and operation confirmations.