Metadata-Version: 2.4
Name: certmate-cli
Version: 0.1.4
Summary: CertMate command-line interface — the SSL certificate lifecycle from your terminal
Project-URL: Homepage, https://github.com/fabriziosalmi/certmate
Project-URL: Source, https://github.com/fabriziosalmi/certmate/tree/main/clients/certmate-cli
Author-email: Fabrizio Salmi <fabrizio.salmi@gmail.com>
License: MIT
Keywords: acme,certmate,cli,letsencrypt,tls
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: System :: Systems Administration
Classifier: Topic :: Utilities
Requires-Python: >=3.9
Requires-Dist: certmate-sdk>=0.1.3
Requires-Dist: rich>=13
Requires-Dist: typer>=0.9
Description-Content-Type: text/markdown

# certmate-cli

The [CertMate](https://github.com/fabriziosalmi/certmate) SSL certificate
lifecycle from your terminal — built on `certmate-sdk`.

```bash
pip install certmate-cli
export CERTMATE_URL=http://localhost:8000
export CERTMATE_TOKEN=...

certmate cert create app.example.com --dns cloudflare --wait
certmate cert ls
certmate cert info app.example.com
certmate cert renew app.example.com --force
certmate cert create app.example.com --dns cloudflare --dry-run
certmate audit verify
```

## Pulling certificates onto a host

`cert download` fetches one file at a time, so a target server can pull
exactly what it deploys instead of the certificate manager pushing to it:

```bash
certmate cert download app.example.com --file fullchain -o /etc/ssl/certs/app.pem
certmate cert download app.example.com --file privkey   -o /etc/ssl/private/app.key
```

Files are created **0600**, with the mode set at creation rather than after
the write, so the key is never briefly world-readable.

This is worth preferring over pushing when the manager would otherwise need
credentials on every target host. Give each host an API key scoped to its own
domain and run the pull on a timer: the host needs no inbound access, and the
manager holds no credentials for it. `cert`, `chain` and `fullchain` are
readable by a viewer-role key; `privkey`, `combined` and `pfx` need operator.

`--file privkey --key-format pkcs1` serves the legacy
`BEGIN RSA PRIVATE KEY` form for stacks that reject certbot's PKCS#8.
`--bundle zip` or `--bundle json` fetch the whole certificate instead, and
`-o -` writes to stdout.

Connection comes from `--url`/`--token` or `CERTMATE_URL`/`CERTMATE_TOKEN`.
Prefer the `CERTMATE_TOKEN` environment variable over `--token`: command-line
arguments are visible to other local processes (`ps`) and shell history.
