UsCert-Manager

UsCert-Manager is a TLS certificate manager for obtaining, renewing, and deploying certificates across multiple servers and services.

It provides a central place to manage certificates and automates the work needed to keep them valid. This is especially useful for infrastructure where the same certificate needs to reach several machines or services.

Certificate management

UsCert-Manager keeps track of certificates and their expiration dates. It can obtain certificates from supported certificate authorities and renew them before they expire.

The service can manage multiple certificates and domains from a single configuration. This removes the need to maintain separate certificate renewal scripts on every server.

Remote deployment

After obtaining or renewing a certificate, UsCert-Manager can deploy it to remote systems over SSH.

A certificate can have multiple deployment targets. Each target defines where the certificate files should go and which actions should run after the deployment.

This makes it possible to update certificates across several servers from one central service.

Service reloads

Updating certificate files is often only part of the process. Services also need to reload the new certificate before they start using it.

UsCert-Manager can run commands after a successful deployment. These commands can reload services such as web servers, reverse proxies, or other applications that use TLS certificates.

The deployment and reload steps therefore happen as part of the same certificate update process.

Monitoring

The service keeps track of certificate status and expiration dates. It can send notifications when certificates approach their expiration date or when a renewal or deployment fails.

This provides an additional safety net for certificates that should remain valid without requiring regular manual checks.

Configuration

UsCert-Manager uses a YAML configuration file to define certificate authorities, domains, deployment targets, and related settings.

The configuration keeps certificate management separate from the individual servers that use the certificates. Adding another server or deployment target only requires a change to the central configuration.

Deployment

The application is designed to run as a central service on Linux. It can run directly on the host or inside a Docker container.

The project focuses on one common infrastructure task: keep TLS certificates valid and make sure renewed certificates reach every service that needs them.