decouple certs from ssl

[ddollar]

• Adds convox certs create <pub> <key> [--chain <chain>]
• Adds convox certs to list certificates associated with the account
• Adds convox certs delete <id> to delete a certificate
• Adds convox certs generate <domain> to generate an ACM certificate
• SSL update is now convox ssl update <process:port> <certificate>

See Also

• https://github.com/convox/site/pull/130

Release Playbook

• Rebase against master
• Release branch ()
• Pass CI ()
• Code review
• Merge into master
• Release master ()
• Pass CI ()
• Update staging rack
• Edit Rack release record and/or update docs
• Publish release
• Release CLI

[mattmanning]

👍 This is fantastic. Decoupling cert management is totally the right thing to do at this stage and I'm excited we can avoid uploading the same cert multiple times now.

What do you think about convox ssl update <process:port> --generate to create and update an ACM cert? Not suggesting we take away the convox certs generate command, just as a shorthand command to do both.

[ddollar]

ACM cert generation is a two-step process that involves receiving an email and clicking a link. The ACM cert isn't valid until you do that.

$ convox ssl update web:443 acm-6a4a10d62b4a -a sinatra
Updating certificate... ERROR: acm-6a4a10d62b4a is still pending validation

[ddollar]

certificate updates