Certificates

The certs namespace manages local TLS certificates and the local Certificate Authority that signs them — the same machinery behind the certs CLI command. Certificates are global, so this namespace hangs directly off the SDK client.

The local Certificate Authority

Locally-issued certificates are signed by a local CA that must be trusted by your system keychain.

// Is the CA configured and trusted?
const status = await denvig.certs.ca.status()
console.log(status.initialized, status.trusted, status.path)

// Generate the CA if missing and install it to the keychain
const { created, path } = await denvig.certs.ca.configure()

// Remove the CA from the keychain
await denvig.certs.ca.remove()

Listing certificates

const certs = await denvig.certs.list()

for (const cert of certs) {
  console.log(cert.name, cert.domains, cert.status, cert.expires)
}

// Filter to those valid for a domain
const matching = await denvig.certs.list({ domain: 'api.local' })

Each certificate reports its status (valid, expired, or untrusted), whether it was signedByLocalCa, and whether the local CA is currently caTrusted.

Issuing a certificate

Issue a certificate for a domain, signed by the local CA:

const result = await denvig.certs.create({
  domain: 'hello.denvig.me',  // or a wildcard like '*.denvig.me'
  force: false,               // overwrite an existing cert for the domain
})

console.log(result.privkey, result.fullchain)

Importing an existing certificate

Import a key/certificate pair into the managed certs:

const imported = await denvig.certs.import({
  keyPath: './certs/privkey.pem',
  certPath: './certs/fullchain.pem',
  name: 'my-cert', // optional — defaults to the detected domain
})

Looking up and removing

// Resolve by domain or directory name
const location = await denvig.certs.retrieve({ domain: 'api.local' })
console.log(location?.path, location?.files)

// Remove by domain or directory name
const removed = await denvig.certs.remove({ name: 'my-cert' })