dehydrator

Concept and Theory of operation:

Originally, I tried to use Certbot as my LetsEncrypt ACME client, but ran into issues with Python dependencies, and then other problems with using ACME HTTP protocol.  This led me to discover dehydrated, an ACME client written as a POSIX shell script, dependent only upon core userland tools, and which supports ACME DNS-01 protocol.  After I began using dehydrated, I found myself having to write a hook to call multiple hostname hooks per-certificate, doing a lot of hand-editing of dehydrated command-lines, a lot of manual distribution, and a lot of manual restarting of dependent services. I also wanted to know what certificates had expired.

My solution to this problem is dehydrator. which I refer to as a meta-client for dehydrated.  dehydrator does the following things:

1. Functions as a wrapper around dehydrated, assembling certificate requests, making CA requests using dehydrated.
2. Runs as a hook script for all certificate requests made via dehydrated, selecting and running other hook scripts as appropriate.
3. Optionally runs commands for any specific dehydrated hook event.
4. Optionally runs PHP functions named for specific hook events at the end of processing each hook event.
5. Distributes certificates using ssh/rsync, optionally runs a command on the remote associated with the certificate, and optionally reloads dependent services on the destination system.
6. Enforces security policy on the dehydrator host and optionally on the remote certificates.
7. Gathers and reports errors.
8. Shows status of all configured certificates.
9. Performs a self-check to ensure it has all the information it needs for each certificate.

Hook Scripts:

Dehydrator supports an array of hook scripts.

• DNS hook scripts: First and foremost, dehydrator runs hook scripts, which are necessary to support the ACME DNS protocol for obtaining certificates. The hookscripts run are associated with the DNS names included in the certificate. DNS hookscripts support only the deploy_challenge and clean_challenge hooks.
• Certificate hook scripts: Each certificate can have a specific hookscript associated with it.
• Global hook scripts: Each hook can have a global script associated with it.
• dehydrator hook script: A carefully written PHP script can integrate into dehydrator. Its code will be loaded just before hooks are processed, executing any global-level code, and for each book call, a function named after the hook will be executed. 
  

Documentation:

• Installing and configuring dehydrator
• Installing
• Configuration
• Command-line configuratopn
• Configuration files
• Data: Defining hostnames, certificate names, destinations, services, and commands
• Certificates
• Hosts
• Destinations
• Services
• Commands (run on destination hosts)
• Running dehydrator
• Checking system integrity
• Creating and updating certificates
• Distributing certificates
• Revoking certificates
• Showing dehydrator status
• Logging
• State
• Normal use of state in dehydrator
• Stateless dehydrator

Support:

You can ask for help with Dehydrator on the mailing list.

License, Documentation:

View the current: README • License (GPL)

Version history:

• v1.0 September 18, 2018
• v2.0 June X, 2019

Requirements, Download(s):

Requires PHP-CLI 5.6 or greater.   It needs to have PRCE and OpenSSL compiled in or loaded as an extension.  Virtually all PHP installations meet this requirement.  You also need dehydrated and its dependencies, Bash, awk, sed, grep, mktemp, and cURL.  Virtually all Linux installations meet this requirement with the possible exception of cURL, which is generally available without pulling your hair out.  Distribution of certificates requires SSH and rsync on both source and destination systems, as well as find on the destination.  Again, virtually all Linux distributions will meet this requirement, with the possible exception of rsync, which you may need to install.  It will be in your distribution's packages.

• Download dehydrator v.1.0 (tar.gz) (zip)
• Git Repository

Mailing List

Mailing list | Archives