<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Certificate Lifecycle Management — API Reference

## Python SSL Certificate Probe

```python
import ssl
import socket

context = ssl.create_default_context()
with socket.create_connection(("example.com", 443), timeout=10) as sock:
    with context.wrap_socket(sock, server_hostname="example.com") as ssock:
        cert = ssock.getpeercert()
        print(cert["notAfter"], cert["subject"])
```

## Let's Encrypt ACME API

```python
import requests

ACME_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory"

# Get directory endpoints
directory = requests.get(ACME_DIRECTORY).json()
# Keys: newNonce, newAccount, newOrder, revokeCert

# Create order (simplified — requires JWS signing)
order = {
    "identifiers": [{"type": "dns", "value": "app.corp.com"}],
}
```

## Certificate Transparency Log Query

```python
# Query crt.sh for certificates issued to a domain
resp = requests.get("https://crt.sh/", params={
    "q": "%.corp.com",
    "output": "json",
})
certs = resp.json()  # Returns issuer, not_before, not_after, serial
```

## Certbot CLI Reference

```bash
# Obtain certificate with DNS challenge
certbot certonly --dns-cloudflare -d app.corp.com --non-interactive

# Renew all certificates
certbot renew --deploy-hook "systemctl reload nginx"

# Revoke certificate
certbot revoke --cert-path /etc/letsencrypt/live/app.corp.com/cert.pem
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All certificates healthy |
| 1 | Certificates approaching expiration (warning) |
| 2 | Certificates expired or renewal failed |
