Deployment API

[gjarassier]

Hello,
Many thanks for this fantastic application!
I’ve come across a feature that could be quite useful.
Would it be possible to perform a "push" via an API call or a bash command to deploy a certificate to another application?
To elaborate:
The goal would be to send a POST request to a firewall that doesn't support SSH—only API calls.

Anyway, keep up the great work!

Thanks,
Geoffrey

[NeySlim]

Hi Geoffrey,

Thanks for the kind words and for the idea.

UCM can't do this directly today. Deploy targets push files over SFTP, with an optional reload command over SSH. Webhooks do send a signed JSON POST on certificate.issued and certificate.renewed, but they carry the certificate metadata only (no PEM, no key) in a fixed format that a firewall API won't accept.

In the meantime, a small relay of your own can bridge the gap: point a webhook at it, have it fetch the certificate and its key from the UCM REST API with an API key, then call your firewall.

Two options to look at later:

1. A generic HTTP deploy target: URL, method, headers and a body template with variables (certificate, key, chain, CN...), going through the same retry queue as the existing deploy targets. Sending the private key would require HTTPS with certificate validation and an explicit opt-in on the target.
2. Ready-made connectors for common firewalls (FortiGate, OPNsense, pfSense, PAN-OS...), where you would only fill in the address and the API token.

No timeline yet. Which firewall are you using? Knowing what its API expects would help shape either option.

[gjarassier]

Hi ! I found a workaround with a script, i sharing on this post soon ! Thx, Le lun. 2 nov. 2026 à 10:16, NeySlim ***@***.***> a écrit :

…

Hi Geoffrey, Thanks for the kind words and for the idea. UCM can't do this directly today. Deploy targets push files over SFTP, with an optional reload command over SSH. Webhooks do send a signed JSON POST on certificate.issued and certificate.renewed, but they carry the certificate metadata only (no PEM, no key) in a fixed format that a firewall API won't accept. In the meantime, a small relay of your own can bridge the gap: point a webhook at it, have it fetch the certificate and its key from the UCM REST API with an API key, then call your firewall. Two options to look at later: 1. A generic HTTP deploy target: URL, method, headers and a body template with variables (certificate, key, chain, CN...), going through the same retry queue as the existing deploy targets. Sending the private key would require HTTPS with certificate validation and an explicit opt-in on the target. 2. Ready-made connectors for common firewalls (FortiGate, OPNsense, pfSense, PAN-OS...), where you would only fill in the address and the API token. No timeline yet. Which firewall are you using? Knowing what its API expects would help shape either option. — Reply to this email directly, view it on GitHub <#428?email_source=notifications&email_token=ADG72YNBKKCPAWGSKLDWYXL5XBGF7A5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOJTGQ3TCMRUUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-19347124>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADG72YKPKVSVVXZYG6MPP6L5XBGF7AVCNFSNUABJKJSXA33TNF2G64TZHMYTCMRXGE4TKOBVGY5UI2LTMN2XG43JN5XDWMJRGE4TMMRWHGQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/ADG72YJ3GNVETDYC5TYERAT5XBGF7A5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOJTGQ3TCMRUUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVJTG633UMVZF62LPOM> and Android <https://github.com/notifications/mobile/android/ADG72YN247PD2GLCNQWKTT35XBGF7A5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOJTGQ3TCMRUUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVZTG633UMVZF6YLOMRZG62LE>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.*** .com>

[NeySlim]

Hi Geoffrey,

Option 1 is out in v2.252: a deploy target can now be an HTTP API instead of an SSH host, for firewalls and appliances without SSH.

• URL and method (POST, PUT or PATCH)
• request headers for the API credential, stored encrypted
• a body template rendered from the certificate ({{cert_pem|json}}, {{fullchain_pem}}, {{cn}}, {{serial}}...)
• the same delivery queue and retries as SSH targets
• the private key is sent only with an explicit opt-in on the target, over verified HTTPS, with an optional pasted trust anchor for an appliance using its own certificate

It was tested against a real OPNsense 26.7: a single POST to /api/trust/cert/add with Basic auth imports the certificate and its key. Note that add creates a new certificate object on each renewal.

Ready-made connectors per firewall (option 2) are not planned: each vendor API needs its own update-in-place and reload logic, while the generic target already covers the push.

Docs: https://github.com/NeySlim/ultimate-ca-manager/wiki/Deploy-Hooks#http-targets-since-v2252

If you try it with your firewall, or share your workaround script, feedback here is welcome.

[gjarassier]

Hii !

Thx i check it soon !
I use a personnal script on localhost for push the cert to my PaloAlto.