certops

CLI for managing and auto-renewing SSL certificates from the CertOps platform.

Install

npm install -g certops

Requirements

• Node.js 18+
• A CertOps API key (co_...) from your dashboard

Quick start

# Set your API key
export CERTOPS_API_KEY='co_...'

# List certificates
certops list

# Download a certificate (interactive picker)
sudo certops download

# Download a specific domain
sudo certops download '*.example.com'

# Download by ID
sudo certops download --id <cert-id>

Commands

certops list

Lists all certificates in your organisation with status and expiry.

certops download [certName]

Downloads a certificate to /etc/certops/certs/<domain>/ in certbot-compatible format:

/etc/certops/certs/<domain>/
├── fullchain.pem   # cert + chain
├── cert.pem        # leaf cert only
├── chain.pem       # intermediate chain
└── privkey.pem     # private key (chmod 600)

Requires root (sudo).

Options:

• -i, --id <id> — download by certificate ID

certops service install

Installs and configures a systemd background service that monitors certificates and auto-renews them before expiry.

sudo -E certops service install

certops service <status|start|stop|uninstall|check>

Manage the background renewal service.

certops service status
sudo certops service start
sudo certops service stop
sudo certops service check        # run one renewal cycle now
sudo certops service uninstall
journalctl -u certops -f          # follow logs

Auto-renewal service

The service polls your CertOps account, checks local expiry state, and re-downloads certificates approaching expiry. Hook scripts in /etc/certops/hooks/ run after each download.

Hook environment variables:

| Variable | Value | |----------|-------| | CERTOPS_CERT_NAME | Certificate name | | CERTOPS_DOMAIN | Domain (certName from API) | | CERTOPS_FULLCHAIN_PATH | Path to fullchain.pem | | CERTOPS_CERT_PATH | Path to cert.pem | | CERTOPS_CHAIN_PATH | Path to chain.pem | | CERTOPS_KEY_PATH | Path to privkey.pem |

Example hook (/etc/certops/hooks/example.com.sh):

#!/usr/bin/env bash
systemctl reload nginx

File layout

/etc/certops/
  config.json          # service configuration
  state.json           # local expiry cache
  hooks/
    global.sh          # runs after every download
    example.com.sh     # runs after example.com downloads
  certs/
    example.com/
      fullchain.pem
      cert.pem
      chain.pem
      privkey.pem

Configuration (/etc/certops/config.json)

| Field | Default | Description | |-------|---------|-------------| | renewalThresholdDays | 5 | Days before expiry to trigger renewal | | checkIntervalHours | 12 | How often the daemon checks | | watchDomains | [] | Domains to watch (empty = all active) | | maxDownloadRetries | 3 | Per-cert retry count on failure | | apiUrl | ssl-manager.dcom.at | Custom API base URL |

Update

npm install -g certops@latest