• Uses acme4j internally for strong RFC compliance.
• Exclusively uses the DNS-01 ACME challenge type for ease of integration with infrastructure without having to set up insecure web servers.
• A small, easily auditable codebase with a heavy use of modularity for correctness.
• Exposes a service provider API for integrating with new DNS APIs.
• Exposes a service provider API for implementing new types of certificate outputs.
• Supports Vultr DNS.
• Supports writing certificates to looseleaf servers.
• An extensive automated test suite with high coverage.
• A small footprint; the server is designed to run in tiny 16-32mb JVM heap configurations.
• Platform independence. No platform-dependent code is included in any form, and installations can largely be carried between platforms without changes.
• OSGi-ready
• JPMS-ready
• ISC license

• Podman / Docker
• Maven Central

$ docker pull docker.io/io7m/certusine:0.0.2

$ podman pull docker.io/io7m/certusine:0.0.2

$ podman run --read-only --volume /x/y/z:/certusine/etc:Z -i -t docker.io/io7m/certusine:0.0.2 certusine
info: Usage: certusine [options] [command] [command options]
...

$ gpg --verify com.io7m.certusine.cmdline-0.0.2-distribution.zip.asc
gpg: assuming signed data in 'com.io7m.certusine.cmdline-0.0.2-distribution.zip.asc'
gpg: Signature made Tue 28 Jun 2022 15:01:56 GMT
gpg:                using RSA key 3CCE59428B30462D10459909C5607DA146E128B8
gpg:                issuer "contact@io7m.com"
gpg: using pgp trust model
gpg: Good signature from "io7m.com (2022 maven-rsa-key) <contact@io7m.com>" [unknown]

$ unzip com.io7m.certusine.cmdline-0.0.2-distribution.zip
$ export CERTUSINE_HOME=$(realpath certusine)
$ ./certusine/bin/certusine
info: Usage: certusine [options] [command] [command options]
...

• %schema
• Options
• Accounts
• Outputs
• DNSConfigurators
• Domains

"Options": {
  "DNSWaitTime": "PT5M",
  "CertificateStore": "store.db",
  "CertificateExpirationThreshold": "PT72H"
}

"Accounts": [
  {
    "Name": "main",
    "PublicKeyPath": "example.pub",
    "PrivateKeyPath": "example.pri",
    "AcmeURI": "https://acme-staging-v02.api.letsencrypt.org/directory"
  }
]

"Outputs": [
  {
    "Type": "directory",
    "Name": "main-output",
    "Parameters": [
      {
        "Name": "path",
        "Value": "/tmp"
      }
    ]
  }
]

"DNSConfigurators": [
  {
    "Type": "vultr",
    "Name": "vultr-dns",
    "Parameters": [
      {
        "Name": "api-key",
        "Value": "25DDk6MT+2JI5KBABMysYLPFEOge+MZE3/GiBgrR+CU="
      },
      {
        "Name": "domain",
        "Value": "example.com"
      }
    ]
  }
]

"Domains": [
  {
    "Name": "example.com",
    "Account": "main",
    "Certificates": [
      {
        "Name": "www",
        "PublicKeyPath": "www.pub",
        "PrivateKeyPath": "www.pri",
        "Hosts": [
          "www.example.com"
        ]
      }
    ],
    "Outputs": [
      "main-output"
    ],
    "DNSConfigurator": "vultr-dns"
  }
]

{
  "%Schema": "https://www.io7m.com/software/certusine/config-1.json",

  "Options": {
    "DNSWaitTime": "PT5M",
    "CertificateStore": "store.db",
    "CertificateExpirationThreshold": "PT72H"
  },

  "Accounts": [
    {
      "Name": "main",
      "PublicKeyPath": "account.pub",
      "PrivateKeyPath": "account.pri",
      "AcmeURI": "https://acme-staging-v02.api.letsencrypt.org/directory"
    }
  ],

  "Outputs": [
    {
      "Type": "directory",
      "Name": "main-output",
      "Parameters": [
        {
          "Name": "path",
          "Value": "/tmp"
        }
      ]
    }
  ],

  "DNSConfigurators": [
    {
      "Type": "vultr",
      "Name": "vultr-dns",
      "Parameters": [
        {
          "Name": "api-key",
          "Value": "25DDk6MT+2JI5KBABMysYLPFEOge+MZE3/GiBgrR+CU="
        },
        {
          "Name": "domain",
          "Value": "example.com"
        }
      ]
    }
  ],

  "Domains": [
    {
      "Name": "example.com",
      "Account": "main",
      "Certificates": [
        {
          "Name": "www",
          "PublicKeyPath": "www.pub",
          "PrivateKeyPath": "www.pri",
          "Hosts": [
            "www.example.com"
          ]
        }
      ],
      "Outputs": [
        "main-output"
      ],
      "DNSConfigurator": "vultr-dns"
    }
  ]
}

{
  "$id": "https://www.io7m.com/software/certusine/config-1.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",

  "$defs": {
    "SchemaIdentifier": {
      "type": "string",
      "const": "https://www.io7m.com/software/certusine/config-1.json"
    },

    "Parameter": {
      "type": "object",
      "properties": {
        "Name": {
          "type": "string"
        },
        "Value": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "Name",
        "Value"
      ]
    },

    "Output": {
      "type": "object",
      "properties": {
        "Type": {
          "type": "string"
        },
        "Name": {
          "type": "string"
        },
        "Parameters": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Parameter"
          }
        }
      },
      "additionalProperties": false,
      "required": [
        "Type",
        "Name",
        "Parameters"
      ]
    },

    "DNSConfigurator": {
      "type": "object",
      "properties": {
        "Type": {
          "type": "string"
        },
        "Name": {
          "type": "string"
        },
        "Parameters": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Parameter"
          }
        }
      },
      "additionalProperties": false,
      "required": [
        "Type",
        "Name",
        "Parameters"
      ]
    },

    "Account": {
      "type": "object",
      "properties": {
        "Name": {
          "type": "string"
        },
        "PublicKeyPath": {
          "type": "string"
        },
        "PrivateKeyPath": {
          "type": "string"
        },
        "AcmeURI": {
          "type": "string",
          "format": "uri"
        }
      },
      "additionalProperties": false,
      "required": [
        "Name",
        "PublicKeyPath",
        "PrivateKeyPath",
        "AcmeURI"
      ]
    },

    "Certificate": {
      "type": "object",
      "properties": {
        "Name": {
          "type": "string",
          "pattern": "[a-z0-9]([a-z0-9\\._-]*)"
        },
        "Hosts": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "PublicKeyPath": {
          "type": "string"
        },
        "PrivateKeyPath": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "Name",
        "Hosts",
        "PublicKeyPath",
        "PrivateKeyPath"
      ]
    },

    "Domain": {
      "type": "object",
      "properties": {
        "Name": {
          "type": "string"
        },
        "Account": {
          "type": "string"
        },
        "Certificates": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Certificate"
          }
        },
        "Outputs": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "DNSConfigurator": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "Account",
        "Certificates",
        "DNSConfigurator",
        "Name",
        "Outputs"
      ]
    },

    "Options": {
      "type": "object",
      "properties": {
        "DNSWaitTime": {
          "type": "string"
        },
        "CertificateStore": {
          "type": "string"
        },
        "CertificateExpirationThreshold": {
          "type": "string"
        }
      },
      "additionalProperties": false,
      "required": [
        "CertificateStore"
      ]
    },

    "Configuration": {
      "type": "object",
      "properties": {
        "%Schema": {
          "$ref": "#/$defs/SchemaIdentifier"
        },
        "Accounts": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Account"
          }
        },
        "Outputs": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Output"
          }
        },
        "DNSConfigurators": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/DNSConfigurator"
          }
        },
        "Domains": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Domain"
          }
        },
        "Options": {
          "$ref": "#/$defs/Options"
        }
      },
      "additionalProperties": false,
      "required": [
        "%Schema",
        "Outputs",
        "DNSConfigurators",
        "Domains",
        "Options"
      ]
    }
  },

  "$ref": "#/$defs/Configuration"
}

{
  "Type": "directory",
  "Name": "an-example-output",
  "Parameters": [
    {
      "Name": "path",
      "Value": "/tmp"
    }
  ]
}

{
  "Type": "etcd",
  "Name": "an-example-etcd-output",
  "Parameters": [
    {
      "Name": "endpoint",
      "Value": "http://etcd.example.com:2379/"
    },
    {
      "Name": "username",
      "Value": "grouch"
    },
    {
      "Name": "password",
      "Value": "12345678"
    }
  ]
}

{
  "Type": "looseleaf",
  "Name": "an-example-looseleaf-output",
  "Parameters": [
    {
      "Name": "endpoint",
      "Value": "http://looseleaf.example.com:20000/"
    },
    {
      "Name": "username",
      "Value": "grouch"
    },
    {
      "Name": "password",
      "Value": "12345678"
    }
  ]
}

info: Usage: certusine [options] [command] [command options]

  Options:
    --verbose
      Set the minimum logging verbosity level.
      Default: info
      Possible Values: [trace, debug, info, warn, error]

  Use the "help" command to examine specific commands:

    $ certusine help help.

  Command-line arguments can be placed one per line into a file, and the file
  can be referenced using the @ symbol:

    $ echo help > file.txt
    $ echo help >> file.txt
    $ certusine @file.txt

  Commands:
    check-configuration          Check configuration file.
    generate-keypair             Generate keypairs.
    help                         Show detailed help messages for commands.
    renew                        Renew certificates.
    show-certificate-outputs     Show supported certificate outputs.
    show-dns-configurators       Show supported DNS configurators.
    version                      Show the package version.

  Documentation:
    https://www.io7m.com/software/certusine/documentation/

$ certusine check-configuration --file config.json

$ (cat <<EOF
check-configuration
--file
config.json
EOF
) > args.txt

$ certusine @args.txt