dehydrator
Please note that dehydrator is under development and not available
for download yet. It is in production use though, and I will
make it available eventually.
dehydrator is a multi-function PHP script to obtain, perform custom
hook script actions, and distribute via SSH/rsync, SSL/TLS certificates
obtained from the LetsEncrypt Certificate Authority operated by the
Electronic Frontier Foundation, using the dehydrated
ACME client and DNS-01 protocol.
Concept and Theory of operation:
Originally, I tried to use Certbot
as my LetsEncrypt ACME client, but ran into issues with Python
dependencies, and then other problems with using ACME HTTP protocol.
This led me to discover dehydrated,
an ACME client written as a POSIX shell script, dependent only upon core
userland tools, and which supports ACME DNS-01 protocol. After I
began using dehydrated, I found myself having to write a hook to
call multiple hostname hooks per-certificate, doing a lot of hand-editing
of dehydrated command-lines, a lot of manual distribution, and a
lot of manual restarting of dependent services. I also wanted to know what
certificates had expired.
My solution to this problem is dehydrator. which I refer to as
a meta-client for dehydrated. dehydrator
does the following things:
- Functions as a wrapper around dehydrated, assembling certificate
requests, making CA requests using dehydrated.
- Runs as a hook script for all certificate requests made via dehydrated,
selecting and running other hook scripts as appropriate.
- Optionally runs hook scripts per-certificate.
- Optionally runs PHP functions named for specific hook events at the
end of processing each hook event.
- Distributes certificates using ssh/rsync, optionally runs a command on
the remote associated with the certificate, and optionally reloads
dependent services on the destination system.
- Enforces security policy on the dehydrator host and
optionally on the remote certificates.
- Monitors certificates on local and remote systems for expiration.
- Imports dehydrated and certbot certificates from
other local and remote locations. Converts imported certbot certificates
into dehydrated certificates (naming conventions).
- Gathers and reports errors.
- Shows status of all configured certificates.
- Performs a self-check to ensure it has all the information it needs
for each certificate.
Hook Scripts:
Dehydrator supports an array of hook scripts.
- DNS hook scripts: First and foremost, dehydrator runs hook scripts,
which are necessary to support the ACME DNS protocol for obtaining
certificates. The hookscripts run are associated with the DNS names
included in the certificate. DNS hookscripts support only the deploy_challenge
and clean_challenge hooks.
- Certificate hook scripts: Each certificate can have a specific
hookscript associated with it.
- Global hook scripts: Each hook can have a global script associated
with it.
- dehydrator hook script: A carefully written PHP script can
integrate into dehydrator. Its code will be loaded just before
hooks are processed, executing any global-level code, and for each hook
call, a function named after the hook will be executed.
Documentation:
- Installing and configuring dehydrator
- Installing
- Configuration
- Command-line configuratopn
- Configuration files
- Data: Defining hostnames, certificate names, destinations, services,
and commands
- Certificates
- Hosts
- Destinations
- Services
- Commands (run on destination hosts)
- Running dehydrator
- Checking system integrity
- Creating and updating certificates
- Distributing certificates
- Revoking certificates
- Showing dehydrator status
- Logging
- State
- Normal use of state in dehydrator
- Stateless dehydrator
Support:
You can ask
for help with Dehydrator on the mailing list.
License, Documentation:
View the current: README • License
(GPL)
- v1.0 September 18, 2018
- v1.5 February 10, 2025
Requirements, Download(s):
Requires PHP-CLI 7.4 or greater. It needs to have PCRE,
POSIX, and OpenSSL compiled in or loaded as an extension. Virtually
all PHP installations meet this requirement. You also need
sha512sum, dehydrated and its dependencies: Bash, awk, sed, grep, mktemp,
openssl, and cURL. Virtually all Linux installations meet this
requirement with the possible exception of cURL, which is generally
available without pulling your hair out. Distribution of
certificates requires SSH and rsync on both source and destination
systems, as well as find and sha512sum on the destination. Again,
virtually all Linux distributions will meet this requirement, with the
possible exception of rsync, which you may need to install. It will
be in your distribution's packages.
Mailing List
Mailing list
| Archives
Home