This page defines the domain vocabulary and technical entities used throughout the Certimate codebase. It serves as a conceptual reference for engineers to understand how real-world SSL management concepts map to specific code structures and data models.
The following diagram illustrates the relationship between the natural language domain concepts and the corresponding code entities within the Certimate architecture.
Diagram: Domain to Code Mapping
Sources: internal/domain/access.go9-16 ui/src/domain/workflow.ts7-23 internal/domain/provider.go3 internal/domain/certificate.go18-39
An Access represents a set of credentials used to authenticate with a third-party service. It is the bridge between Certimate and external APIs (e.g., Aliyun, AWS, Cloudflare).
Access struct. It contains a Provider string and a Config map containing sensitive keys like apiKey, secretKey, or token. internal/domain/access.go9-16AccessProviderType in Go and ACCESS_PROVIDERS in TypeScript. Certimate supports over 100 providers including cloud platforms, DNS services, and server panels. internal/domain/provider.go15-141 ui/src/domain/provider.ts17-141ACCESS_USAGES:
dns: For managing DNS-01 challenge records during issuance. ui/src/domain/provider.ts146hosting: For deploying certificates to servers or cloud services. ui/src/domain/provider.ts147ca: For connecting to ACME-compatible Certificate Authorities. ui/src/domain/provider.ts148notification: For sending alerts via channels like Telegram, Email, or Webhooks. ui/src/domain/provider.ts149Sources: internal/domain/access.go9-16 internal/domain/provider.go15-141 ui/src/domain/provider.ts17-156
A Workflow is a directed graph (orchestrated via a visual editor) that defines the certificate lifecycle automation.
workflow collection. It contains graphDraft (unsaved changes) and graphContent (published version). internal/domain/workflow.go15 ui/src/domain/workflow.ts7-23scheduled (CRON) or manual. ui/src/domain/workflow.ts29-32 ui/src/domain/workflow.ts67-70bizApply): Requests a certificate via ACME. Supports domain or ip identifiers. It handles skip logic based on skipBeforeExpiryDays. ui/src/domain/workflow.ts94-119 internal/domain/workflow.go108bizDeploy): Pushes certificates to a target (e.g., aliyun, aws, ssh). ui/src/domain/workflow.ts157-163 internal/domain/workflow.go111condition, branchBlock, tryCatch, and delay. ui/src/domain/workflow.ts37-45 internal/domain/workflow.go102-107Sources: internal/domain/workflow.go15-113 ui/src/domain/workflow.ts7-169 ui/src/domain/workflow.ts190-270
A WorkflowRun is a single execution instance of a Workflow.
Sources: internal/domain/workflow_run.go7-19 internal/domain/workflow_output.go7-14 ui/src/domain/workflow.ts163
Certimate uses the ACME (Automated Certificate Management Environment) protocol to communicate with CAs.
| Term | Description | Code Reference |
|---|---|---|
| ACME Account | A registered identity with a CA. | internal/domain/acme_account.go |
| DNS-01 | Verification by creating a TXT record in the domain's DNS. | challengeType: "dns-01" ui/src/domain/workflow.ts123 |
| HTTP-01 | Verification by placing a file on a web server. | challengeType: "http-01" ui/src/i18n/resources/zh/nls.workflow.nodes.json134 |
| EAB | External Account Binding, used for CAs like ZeroSSL or Google Trust Services. | AccessConfigForACMEExternalAccountBinding internal/domain/access.go35-38 |
Sources: internal/domain/access.go35-38 ui/src/domain/workflow.ts94-128
auto (new key), reuse (use existing), or custom. ui/src/domain/workflow.ts106-108 internal/domain/workflow.go164-168disableARI in the bizApply node config. ui/src/domain/workflow.ts117 internal/domain/workflow.go175Certificate to a Provider using specific configurations like AccessConfigForAliyun. internal/domain/access.go68-72Sources: internal/domain/access.go68-72 internal/domain/workflow.go146-178 ui/src/domain/workflow.ts117
The following diagram shows how data flows through the system from configuration to execution.
Diagram: Execution Data Flow
Sources: internal/domain/access.go9-16 internal/domain/workflow_run.go7-19 internal/domain/workflow_output.go7-14 internal/domain/certificate.go18-39
| Term | Technical Context |
|---|---|
| Collection | A PocketBase table (e.g., access, workflow). internal/domain/access.go7 internal/domain/workflow.go15 |
| Trigger | The mechanism starting a workflow: manual or scheduled (CRON). ui/src/domain/workflow.ts29-32 internal/domain/workflow.go81-84 |
| Challenge | The ACME verification method: dns-01 or http-01. ui/src/domain/workflow.ts123 internal/domain/workflow.go155 |
| Identifier | The subject of a certificate: domain (FQDN) or ip (IPv4/v6). ui/src/domain/workflow.ts95-96 internal/domain/workflow.go152-153 |
| EAB | External Account Binding, required by some CAs to link ACME requests to a paid account. internal/domain/access.go35-38 |
| ARI | Asynchronous Renewal Info, helps determine renewal timing. ui/src/domain/workflow.ts117 |
Sources: internal/domain/access.go7-38 internal/domain/workflow.go15-155 ui/src/domain/workflow.ts29-123