certmate-cli

The CertMate SSL certificate lifecycle from your terminal — built on certmate-sdk.

pip install certmate-cli
export CERTMATE_URL=http://localhost:8000
export CERTMATE_TOKEN=...

certmate cert create app.example.com --dns cloudflare --wait
certmate cert ls
certmate cert info app.example.com
certmate cert renew app.example.com --force
certmate cert create app.example.com --dns cloudflare --dry-run
certmate audit verify

Pulling certificates onto a host

cert download fetches one file at a time, so a target server can pull exactly what it deploys instead of the certificate manager pushing to it:

certmate cert download app.example.com --file fullchain -o /etc/ssl/certs/app.pem
certmate cert download app.example.com --file privkey   -o /etc/ssl/private/app.key

Files are created 0600, with the mode set at creation rather than after the write, so the key is never briefly world-readable.

This is worth preferring over pushing when the manager would otherwise need credentials on every target host. Give each host an API key scoped to its own domain and run the pull on a timer: the host needs no inbound access, and the manager holds no credentials for it. cert, chain and fullchain are readable by a viewer-role key; privkey, combined and pfx need operator.

--file privkey --key-format pkcs1 serves the legacy BEGIN RSA PRIVATE KEY form for stacks that reject certbot's PKCS#8. --bundle zip or --bundle json fetch the whole certificate instead, and -o - writes to stdout.

Connection comes from --url/--token or CERTMATE_URL/CERTMATE_TOKEN. Prefer the CERTMATE_TOKEN environment variable over --token: command-line arguments are visible to other local processes (ps) and shell history.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

certmate_cli-0.1.4.tar.gz (9.4 kB view details)

Uploaded Aug 8, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

certmate_cli-0.1.4-py3-none-any.whl (9.4 kB view details)

Uploaded Aug 8, 2026 Python 3

File details

Details for the file certmate_cli-0.1.4.tar.gz.

File metadata

Download URL: certmate_cli-0.1.4.tar.gz
Upload date: Aug 8, 2026
Size: 9.4 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for certmate_cli-0.1.4.tar.gz
Algorithm	Hash digest
SHA256	`a35831bc8d5113d7424beef9d13eff91386df6034c66eb0b3ed8006970c3b42e`
MD5	`2fc9be679ac62c34e46d1671f988a332`
BLAKE2b-256	`7c4c24eb38573027f9ce9ea21d65946953f9e04264eaff16137a0d8cbddf7d80`

See more details on using hashes here.

Provenance

The following attestation bundles were made for certmate_cli-0.1.4.tar.gz:

Publisher: publish-clients.yml on fabriziosalmi/certmate

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: certmate_cli-0.1.4.tar.gz
- Subject digest: a35831bc8d5113d7424beef9d13eff91386df6034c66eb0b3ed8006970c3b42e
- Sigstore transparency entry: 2382382140
- Sigstore integration time: Aug 8, 2026
Source repository:
- Permalink: fabriziosalmi/certmate@3f9017f948e3be98868c55e94556d54c0154c936
- Branch / Tag: refs/tags/clients-v0.1.4
- Owner: https://github.com/fabriziosalmi
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish-clients.yml@3f9017f948e3be98868c55e94556d54c0154c936
- Trigger Event: push