Koalephant Certificate Manager

Shell tools to enable requesting and renewing TLS certificates via ACME-protocol supporting Certificate Authorities (currently only LetsEncrypt).

The primary focus is to support multi-server HAProxy based environments, where certificates need to be post-processed (joined, OCSP data fetched) and copied to peer servers.

Tools

• k-cert-request: Requests a new certificate, or expands an existing one (if one is found with a subset of the host names specified) via certbot
• k-cert-manage: Handle new certificates after issuance - copy, combine and fetch OCSP data, apply changes (reload HAProxy) and triggers the 'sync' functionality of k-cert-sync
• k-cert-sync: Synchronises certificates, keys and OCSP data from one machine to registered peers, and triggers the 'apply changes' functionality of k-cert-manage

Dependencies

• Koalephant Shell Script Library
• Certbot

Testing

A Vagrant multi-machine configuration is included, to allow easier development and testing of the 'manage' and 'sync' capabilities.