lokeshsg/cert-automator repository overview

⁠CertAutomator

The Centralized "Vault" that Solves the Pain of Certificate Renewals.

CertAutomator is a powerful, secure, and user-friendly web application designed to eliminate the manual "pain" of SSL certificate management. It provides a single point of upload for your certificates and automatically distributes them to a wide range of services across your network.

⁠Key Features

⁠Secure by Design

• Dual-Envelope Encryption: Credentials, configs, and Private Keys (privkey.enc) are encrypted on disk with a 256-bit Master Vault Key (MVK), wrapped in dual password and recovery envelopes.
• Zero-Data-Loss Recovery: Reset forgotten Master Passwords using your 32-character Emergency Recovery Key without wiping service targets, configs, or SSL private keys.
• Hardened Sessions: Built-in CSRF protection, HttpOnly cookies, strict session cookie hardening, and non-root execution (UID 1000).

⁠Intelligent Automation

• Zero-Touch Startup: Automatically verifies the health of all local and remote certificates immediately upon launch.
• Nightly Health Checks: Runs a global verification engine every night at 12:30 AM to catch expiring certificates before they cause outages.
• UTC-Aware Accuracy: Precision expiration tracking synced to global UTC time.

⁠Broad Integration Support

CertAutomator speaks the language of your favorite local and enterprise services:

• API Drivers: Proxmox, TrueNAS (SCALE/CORE), OPNsense, Portainer.
• SSH/SCP Tunneling: Syncthing, Wazuh, Heimdall, Generic Linux.
• Advanced Conversion: Aruba ClearPass (PEM to PFX auto-conversion).
• Extensible: Generic Webhooks and custom handler support.

⁠What's New in v1.2.1?

• Zero-Loss Password Reset: Introduced Dual-Envelope Cryptography allowing Master Passwords to be reset via /api/recover using a 32-character Emergency Recovery Key without losing vault configurations or SSL keys.
• Automatic Legacy Vault Migration: Upgrades legacy single-password auth.json configurations to Dual-Envelope mode transparently on first login.
• Vulnerability Remediation: Updated core PyPI packages (urllib3>=2.7.0, cryptography>=47.0.0, setuptools>=75.0.0) and base image dependencies to remediate published CVEs.
• Infinite Redirect Loop Fix: Resolved 302 FOUND redirection bug on /login and /setup endpoints.
• Security Patch: Emergency Recovery Key is no longer written to log files in plaintext. It is shown exclusively in the browser UI (one-time) and never stored server-side.

⁠What's New in v1.2.0?

• Native ACME Integration: Automated certificate issuance and renewal via Let's Encrypt/ZeroSSL using DNS-01 (Cloudflare).
• Nginx Proxy Manager Sources: Intelligent "Pull" integration with zero-restart logic and serial-number verification.
• Enterprise Security Hardening: Forced network timeouts across all handlers to prevent DoS, and infrastructure pivot to Python 3.13.

⁠Quick Start

⁠1. Create a docker-compose.yml

version: '3.8'

services:
  cert-automator:
    image: lokeshsg/cert-automator:latest
    container_name: cert-automator
    restart: unless-stopped
    ports:
      - "5050:5050"
    volumes:
      - ./config.yaml:/app/config.yaml
      - ./auth.json:/app/auth.json
      - ./certs:/certs
      - ./backup:/backup
      - ./logs:/app/logs
    environment:
      - FLASK_SECRET=GenerateASecretStringHere

⁠2. Initialize & Launch

# Create persistent storage files
touch config.yaml auth.json
mkdir -p certs backup logs

# Fire it up
docker compose up -d

⁠3. Setup

Visit http://[server-ip]:5050 to set your administrator credentials and initialize your encrypted vault!

⁠How it Works

1. Upload: You upload a certificate pack (Cert + Key + optional Chain) once.
2. Assign: You map that certificate to your services (e.g., "Proxmox Cluster").
3. Automate: CertAutomator handles the transmission, format conversion, and service restarts for you.
4. Monitor: The dashboard shows you two statuses: Local Pack (is the file ready?) and Deployed (is the service actually using it?).

⁠Community & Support

CertAutomator is built for the community. If you encounter issues or want to suggest a new handler, please check the logs or reach out on GitHub⁠!

Built for privacy and automation.