🔒 The HTTPS Headache / HTTPS 的痛点

In a distributed system, you often have multiple servers (Nginx, Xray, Mail) that need the same wildcard certificate.
在分布式系统中，你经常有多个服务器（Nginx, Xray, Mail）需要使用同一个通配符证书。

Standard Certbot logic works great for one server, but syncing that certificate to 10 other nodes securely? That’s messy. rsync with loose SSH keys? Manual copying?
标准的 Certbot 逻辑对于单台服务器很完美，但要安全地将该证书同步到其他 10 个节点？那就很麻烦了。使用 SSH key 运行 rsync？手动复制？

Enter CertDeliver.
CertDeliver 为此而生。

🛠️ How It Works / 工作原理

CertDeliver is a secure client-server system designed to sync Let’s Encrypt certificates automatically.
CertDeliver 是一个安全的客户端-服务器系统，旨在自动同步 Let’s Encrypt 证书。

The Flow / 工作流

sequenceDiagram
    participant S as Server (Certbot)
    participant H as Hook Script
    participant C as Client (Node)
    
    S->>S: Renew Certs (Certbot)
    S->>H: Trigger Hook
    H->>H: Package Certs (Zip + Encrypt)
    loop Every 6 Hours
        C->>S: Poll for updates (Token Auth)
        S->>C: Return Package
        C->>C: Unpack & Verify
        C->>C: Reload Nginx/Xray
    end

Security First / 安全至上

  • Token Auth: Uses constant-time string comparison (secrets.compare_digest) to prevent timing attacks.
  • IP Whitelist: DNS-based verification ensures only your known nodes can fetch certificates.
  • Minimal Privileges: The client runs as a standard user, only needing permission to write to the cert directory and reload services (sudo access restricted to specific commands).

🚀 Quick Start / 快速开始

1. Server Side (Central Authority)

Deploy with Docker Compose. This container will act as the source of truth.

git clone https://github.com/yuanweize/CertDeliver.git
cd CertDeliver/docker
cp ../.env.example .env

# Edit .env
# CERTDELIVER_TOKEN=your_super_secret_token_here
# ALLOWED_DOMAINS=node1.example.com,node2.example.com

docker compose up -d

2. Client Side (The Nodes)

Install the client on your edge nodes (VPS, Raspberry Pi, etc.).

pip install git+https://github.com/yuanweize/CertDeliver.git

# Configure Env
export CERTDELIVER_CLIENT_TOKEN="your_super_secret_token_here"
export CERTDELIVER_CLIENT_SERVER_URL="https://cert.your-domain.com"
export CERTDELIVER_CLIENT_POST_UPDATE_COMMAND="systemctl reload nginx"

# Run once to test
certdeliver-client

3. Automation (Cron)

Add this to your crontab to check for updates every 6 hours:

0 */6 * * * /usr/local/bin/certdeliver-client >> /var/log/certdeliver.log 2>&1

Set it in crontab, and never worry about expired certs on your slave nodes again.
将其设置在 crontab 中，再也不用担心从节点的证书过期了。

👉 GitHub Repo: CertDeliver