<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Certificate Lifecycle Management

## certbot

### Synopsis

```bash
certbot certonly --standalone -d <domain> [options]
certbot renew [--cert-name <domain>] [--dry-run]
certbot revoke --cert-path <path> [--reason <reason>]
```

### Key Options

| Option | Description |
|---|---|
| `--standalone` | Use built-in HTTP server for validation |
| `--webroot -w /var/www` | Use existing webroot for validation |
| `--deploy-hook <cmd>` | Run command after successful renewal |
| `--dry-run` | Test renewal without issuing |
| `--non-interactive` | No prompts; fail on missing input |

## openssl req

### Synopsis

```bash
openssl req -new -newkey <type> -keyout <key> -out <csr> [options]
```

### Key Options

| Option | Description |
|---|---|
| `-x509` | Self-signed cert instead of CSR |
| `-newkey rsa:4096` | RSA key generation |
| `-newkey ec -pkeyopt ec_paramgen_curve:P-256` | ECDSA key |
| `-days <n>` | Validity period |
| `-nodes` | No passphrase on key |
| `-subj "/CN=..."` | Subject DN on command line |
| `-addext "subjectAltName=..."` | SAN extension |

## openssl ca — Revocation

### Synopsis

```bash
openssl ca -revoke <cert> -keyfile <ca-key> -cert <ca-cert>
openssl ca -gencrl -keyfile <ca-key> -cert <ca-cert> -out <crl>
```

## Agent Script

```bash
node agent.js generate internal.example.com --key-type ec --days 90
node agent.js bulk-check /etc/ssl/certs
node agent.js renew example.com
node agent.js revoke /path/to/cert.pem --reason keyCompromise
```
