Skip to content
automate certificate, TLSA, DKIM and many more
Python Shell
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
examples
modules
.gitignore
.gitmodules
README.md
__init__.py
__main__.py
cdmconfighandler.py
cdmcore.py
cdmstatehandler.py
requirements.txt

README.md

Crypto Domain Manager

Automate all your cryptographic needs!

Goals

  • Zero downtime
  • Automatic certificate renewal
  • Spam protection
  • Updated DNS records

Configure once and always stay up to date.

Use cases

  • Renew letsencrypt certicates
  • Derive all kinds of data from the signature
  • Ensure everything is secure

External Service APIs

Linux Services

  • DKIM signatures:
    • rspamd
  • Reload systemd services:
    • apache2
    • postfix
    • dovecot
    • rspamd

Managed DNS Records

No downtime strategy

Updating keys, certifcates and other needs 3 steps to prevent gaps in availabillity:

  1. Prepare: Create certificates, keys etc. and publish corresponding records to DNS.
  2. Rollover: Apply new certificates and keys, because now negative cache TTL on DNS is reached.
  3. Cleanup: Delete all no more needed stuff from disk and DNS.

Needed Plugins and Dependencies

  • dnsuptools: to interface with DNS API -- updating DNS entries
  • dehydrated: to get new certificate (included with cryptdomainmgr)
  • rspamd: to create (and use) DKIM keys

Installation

These libraries are needed for pycurl used by dnsuptools for automatic ip retrieving:

apt install -y libcurl4-openssl-dev libssl-dev

This comman is used by dehydrated to communicate with letsencrypt for certificate renewal:

apt install -y curl

For DKIM we need rspamd:

apt install -y lsb-release wget # optional
CODENAME=`lsb_release -c -s`
wget -O- https://rspamd.com/apt-stable/gpg.key | apt-key add -
echo "deb [arch=amd64] http://rspamd.com/apt-stable/ $CODENAME main" > /etc/apt/sources.list.d/rspamd.list
echo "deb-src [arch=amd64] http://rspamd.com/apt-stable/ $CODENAME main" >> /etc/apt/sources.list.d/rspamd.list
apt update
apt install -y rspamd

Now install the cryptdomainmgr. This pulls all need dependencies.

python2 -m pip install cryptdomainmgr

Feel free to try python3, but inwx client doesn't support it.

python3 -m pip install cryptdomainmgr

Documentation

We need help here!

For now please look at:

hints:

  • Multiple Configfiles with priority allowed
  • Specify content of config file content as argument

Next goals

  • improve documentation
  • website
  • automated tests
  • nsupdate for DNS updates

Long term goals:

  • ARC key renewal
  • WPIA integration
  • DNSSEC key renewal
  • TXT record (may collide with SPF and other TXT based records)
  • multi server support for one domain: TLSA delete by timeout
  • constrain minimum renewal/phase time interval
  • validations - ensure signatures are used correctly
  • run as service
  • PowerDNS support

Contributions

If you like the project feel free to give me a star. Please let us know if you use this project.

All kind of contributions are welcome.

You can’t perform that action at this time.