certpusher/README.md

CertPusher

Automated SSL certificate distribution tool for deploying certificates to multiple remote servers via SSH/SCP.

Features

• Multi-server deployment: Deploy certificates to unlimited number of servers
• Smart certificate comparison: Checks if remote certificate needs updating via HTTPS
• Flexible SSH authentication: Global or per-host SSH key configuration
• Post-deployment commands: Execute commands after certificate upload (reload services, etc.)
• Comprehensive logging: Debug-level logging with timestamped log files
• Safe execution: Compares certificates before uploading to avoid unnecessary restarts

Installation

git clone https://github.com/yourusername/certpusher.git cd certpusher pip install -r requirements.txt

Configuration

1. Copy the example configuration:

cp config.ini.example config.ini

2. Edit config.ini with your server details:

Global Section

• source_cert_path: Path to the SSL certificate to distribute
• default_ssh_key: Default SSH private key path

Host Sections

Each host requires:

• hostname: IP address or hostname
• port: SSH port (default: 22)
• username: SSH username
• remote_cert_path: Destination path for the certificate
• post_upload_command: Command to run after upload (optional)
• check_url: HTTPS URL to check current certificate (optional)
• ssh_key_path: Override default SSH key (optional)

Usage

python certpusher.py config.ini

SSH Key Setup

Generate SSH key for authentication:

ssh-keygen -t ed25519 -f ~/.ssh/certpusher_key

ssh-copy-id -i ~/.ssh/certpusher_key.pub user@remote-host

2025-10-26 22:00:00 - CertPusher - INFO - ============================================================

2025-10-26 22:00:00 - CertPusher - INFO - CertPusher - SSL Certificate Distribution Tool

2025-10-26 22:00:00 - CertPusher - INFO - ============================================================

2025-10-26 22:00:01 - CertPusher - INFO - Processing host: webserver1

2025-10-26 22:00:02 - CertPusher - INFO - ✓ Successfully processed webserver1

Security Considerations

• Store SSH private keys securely with proper permissions (chmod 600)
• Use dedicated SSH keys for certificate deployment
• Limit SSH key access with authorized_keys restrictions
• Consider using SSH certificates for enhanced security
• Rotate SSH keys regularly

License

MIT License