leet-ssl-cert

Automate TLS certificate lifecycle for domains that terminate SSL at a cloud load balancer:

issue -> store -> upload -> bind -> renew

This is the TypeScript/npm implementation of the original Python leet-ssl-cert CLI. It preserves the YAML config shape, command names, provider identifiers, local state layout, and line-oriented command output.

Supported Providers

| Cloud | DNS | Deployers | | --- | --- | --- | | Alibaba Cloud | Aliyun DNS | CLB, ALB | | AWS | Route 53 | ACM, ELB/ALB | | GCP | Cloud DNS | HTTPS Proxy, SSL Proxy | | GCP | GoDaddy DNS | GCP Load Balancer |

Requirements

• Node.js 20+
• DNS control for the target domain
• Cloud credentials for the selected provider

Install

npm install -g leet-ssl-cert

Provider SDKs are loaded only when used. Install the SDKs for your provider in the same project or global environment:

# AWS
npm install @aws-sdk/client-route-53 @aws-sdk/client-acm @aws-sdk/client-elastic-load-balancing-v2 @aws-sdk/client-elastic-load-balancing

# GCP
npm install @google-cloud/dns @google-cloud/compute google-auth-library

# Alibaba Cloud
npm install @alicloud/alidns20150109 @alicloud/slb20140515 @alicloud/alb20200616 @alicloud/cas20200407 @alicloud/openapi-client

GoDaddy DNS support uses fetch and does not need an extra SDK.

Quick Start

leet-ssl-cert init aws
leet-ssl-cert issue
leet-ssl-cert deploy
leet-ssl-cert run
leet-ssl-cert cron

The same command surface works through npx:

npx leet-ssl-cert --config ./leet-ssl-cert.yaml run
npx leet-ssl-cert run --config ./leet-ssl-cert.yaml

Commands

| Command | What it does | | --- | --- | | init <provider> | Generate a config file interactively for deployment cloud aliyun, aws, or gcp | | issue | Obtain or renew certificates via ACME DNS-01 | | deploy | Upload certs and bind them to configured load balancers | | run | issue + deploy in one step | | check | Report local certificate status | | revoke | Revoke a certificate through ACME | | cron | Print a cron line for unattended renewal |

Configuration

The CLI looks for config in this order:

1. --config /path/to/config.yaml
2. ./leet-ssl-cert.yaml
3. ~/.leet-ssl-cert/config.yaml

Environment variables in ${VAR_NAME} form are resolved at load time. Startup also loads ./.env and ~/.leet-ssl-cert/.env as defaults unless LEET_SSL_CERT_DISABLE_DOTENV is truthy.

See config/example.yaml for a complete example.

Local State

Files are stored under ~/.leet-ssl-cert/ by default:

~/.leet-ssl-cert/
  account.key
  certs/
    my-site/
      my-site.key
      my-site.pem
      my-site.meta.json

Development

npm install
npm run check
npm test
npm run build