Certimate integrates with a wide variety of cloud services and CDN providers. While many major providers (like Alibaba Cloud or AWS) are handled via official Go SDKs, many others lack official Go clients or have specialized requirements. The pkg/sdk3rd layer provides custom-built SDK clients to bridge these gaps.
The pkg/sdk3rd directory contains lightweight, purpose-built SDKs for providers including:
These SDKs typically implement the necessary API calls for certificate management, such as uploading PEM-encoded certificates and updating domain HTTPS configurations.
Sources: pkg/sdk3rd/ctyun/ao/types.go1-14 pkg/sdk3rd/huaweicloud/obs/client.go1-21 pkg/sdk3rd/volcengine/tos/client.go1-21 pkg/sdk3rd/linode/client.go1-15 pkg/sdk3rd/cloudflare/client.go1-17
Most custom SDKs in Certimate follow a consistent pattern:
Client struct wrapping an HTTP client (using resty/v2) and credentials pkg/sdk3rd/huaweicloud/obs/client.go19-21sdkResponse interface to standardize error extraction from various JSON/XML formats pkg/sdk3rd/ctyun/ao/types.go9-14The following diagram illustrates how a certificate is updated on HuaweiCloud OBS using the custom SDK client. This involves both a certificate manager (SCM) and the object storage (OBS) client.
HuaweiCloud OBS Deployment Flow
Sources: pkg/core/deployer/providers/huaweicloud-obs/huaweicloud_obs.go79-115 pkg/sdk3rd/huaweicloud/obs/client.go58-67 pkg/sdk3rd/huaweicloud/obs/api_put_bucket_customdomain.go29-47
Because different cloud APIs return status codes and error messages in varying JSON fields (e.g., statusCode as a string vs. number), Certimate uses a flexible sdkResponseBase to normalize these responses.
| Function | Role |
|---|---|
GetStatusCode() | Parses json.RawMessage into a string regardless of source JSON type (float64, string, or json.Number) pkg/sdk3rd/ctyun/ao/types.go24-45 |
GetErrorMessage() | Retrieves the human-readable error string from the API response base pkg/sdk3rd/ctyun/ao/types.go63-69 |
doRequestWithResult() | Standardized wrapper that handles request execution and XML/JSON unmarshaling into a response struct pkg/sdk3rd/huaweicloud/obs/client.go136-156 |
Custom clients for HuaweiCloud OBS, Volcengine TOS, and Alibaba Cloud OSS implement manual request signing and payload handling.
signer struct and a resty.PreRequestHook to inject authentication headers pkg/sdk3rd/huaweicloud/obs/client.go53-67 pkg/sdk3rd/volcengine/tos/client.go53-67 pkg/sdk3rd/alibabacloud/oss/client.go55-69Content-MD5 header pkg/sdk3rd/huaweicloud/obs/client.go104-111 pkg/sdk3rd/volcengine/tos/client.go104-112Sources: pkg/sdk3rd/huaweicloud/obs/client.go77-115 pkg/sdk3rd/volcengine/tos/client.go77-115 pkg/sdk3rd/alibabacloud/oss/client.go82-125
This diagram maps system names to the specific Go structs and SDK clients used for certificate management and deployment targets.
Entity Mapping: DigitalOcean and Ksyun
Sources: pkg/core/certmgr/providers/digitalocean-certificate/digitalocean_certificate.go31-35 pkg/sdk3rd/ksyun/zz-shared-common/client.go17-61 pkg/sdk3rd/ksyun/zz-shared-common/signer.go19-23
The CTCC Cloud implementation is subdivided into specialized packages sharing a common response base.
| Package | Purpose | Key API Operations |
|---|---|---|
ctyun/ao | AccessOne (Advanced Optimization) | GetDomainConfig, ModifyDomainConfig pkg/sdk3rd/ctyun/ao/api_get_domain_config.go1-10 |
ctyun/cdn | Content Delivery Network | Standard CDN domain and certificate management pkg/sdk3rd/ctyun/cdn/client.go1-10 |
ctyun/lvdn | Live Video Delivery Network | Live streaming domain HTTPS configuration pkg/sdk3rd/ctyun/lvdn/api_query_domain_list.go1-10 |
ctyun/elb | Elastic Load Balance | Load balancer certificate management pkg/sdk3rd/ctyun/elb/client.go1-10 |
Sources: pkg/sdk3rd/ctyun/ao/types.go9-14 pkg/sdk3rd/ctyun/lvdn/client.go1-15
Certimate provides a custom implementation for DigitalOcean certificate management to handle specific lifecycle needs like fingerprint matching.
ListCertificates and iterates through pages to compare SHA1 fingerprints, DNS names, and expiration dates before uploading pkg/core/certmgr/providers/digitalocean-certificate/digitalocean_certificate.go77-131CreateCertificate with custom type to upload the leaf certificate and certificate chain separately pkg/core/certmgr/providers/digitalocean-certificate/digitalocean_certificate.go135-151The Ksyun SDK uses a shared common client logic for multiple services (CDN, SLB, KCM).
NewRequest method automatically converts parameter structs into a map of strings, handling nested types via JSON marshaling pkg/sdk3rd/ksyun/zz-shared-common/client.go69-99While Cloudflare has official SDKs, Certimate uses a simplified custom client for specific certificate operations to keep the binary footprint small.
Authorization header pkg/sdk3rd/cloudflare/client.go25-36sdkResponse flow pkg/sdk3rd/cloudflare/client.go90-97Sources: pkg/core/certmgr/providers/digitalocean-certificate/digitalocean_certificate.go64-152 pkg/sdk3rd/ksyun/zz-shared-common/signer.go1-126 pkg/sdk3rd/cloudflare/client.go1-101
Refresh this wiki