AutoSSL

AutoSSL is a distributed SSL/TLS certificate manager built with Node.js. It automates Let's Encrypt certificate issuance via the ACME protocol and uses Cloudflare R2 as the centralized storage.

✨ Features

• ACME Integration: Automated DNS-01 challenge verification via Cloudflare DNS.
• Centralized Storage: Stores all privkey.pem and fullchain.pem in Cloudflare R2.
• Auto-Discovery: The Issuer daemon scans the R2 bucket to detect and renew certificates automatically.
• Smart Renewal: Supports both single domains and wildcard domains (e.g., *.example.com) by analyzing existing certificates.
• Self-Daemonizing: Built-in background process management (no pm2 or systemd required).

🛠 Prerequisites

1. Node.js (v18+ recommended).
2. Cloudflare Account:
   • API Token: Must have Zone:DNS:Edit and Account:Workers R2 Storage:Edit permissions.
   • Account ID & R2 Bucket Name.

🚀 Installation

npm install -g autossl

🔧 Usage

1. The Issuer (Master Node)

First Time Setup (Manual Issue): If your bucket is empty, issue your first certificate manually to populate R2:

autossl issue \
  --domain "*.example.com" \
  --email [email protected] \
  --token <CF_TOKEN> \
  --accountId <CF_ACCOUNT_ID> \
  --bucket <BUCKET_NAME>

💡 If -b (bucket) is omitted, it defaults to autossl-certificates.

Start Daemon:

autossl start-issuer \
  --email [email protected] \
  --token <CF_TOKEN> \
  --accountId <CF_ACCOUNT_ID> \
  --bucket <BUCKET_NAME> \
  --renew-days 7 \
  -D  # Run in background

Domain Handling Logic:

• *.example.com → stored in folder example.com
• api.example.com → stored in folder api.example.com Two files are uploaded per domain:
• privkey.pem: RSA/ECC private key
• fullchain.pem: End-entity + intermediate CA certificates

2. Sync All Certificates from R2

autossl start-syncer \
  --accountId <CF_ACCOUNT_ID> \
  --token <CF_TOKEN> \
  --bucket <BUCKET_NAME> \
  --output /etc/nginx/ssl \
  --interval 60 \
  -D  # Run in background

• Performs an immediate sync on startup
• Then syncs automatically every day at midnight UTC

This recursively downloads all objects in the bucket, recreating the exact folder structure locally:

./certs/
├── example.com/
│   ├── privkey.pem
│   └── fullchain.pem
└── api.example.com/
    ├── privkey.pem
    └── fullchain.pem

3. Management

Check Status: View running daemons, their PIDs, and log file paths.

autossl status

Stop Services:

autossl stop        # Stop all services
autossl stop issuer # Stop issuer only

📜 License

MIT License Copyright (c) 2025-present, reruin [email protected]