The Certimate backend relies on a suite of internal tools and utility packages to handle low-level operations such as multi-process communication, remote server interaction via SSH/FTP, object storage via S3, SMTP messaging, and cryptographic transformations. These utilities provide a consistent abstraction layer used by the Workflow Engine and Deployment Providers.
The mproc package provides a secure Inter-Process Communication (IPC) mechanism. It is primarily used to isolate sensitive ACME operations or provider-specific logic into separate child processes to prevent memory leaks or crashes in the main process from affecting the entire application.
The system uses a Sender-Receiver pattern. Data is exchanged via temporary files and encrypted using AES-256-CBC to ensure that sensitive credentials passed to sub-commands are not visible in the process tree or as plain text on disk.
TIn to JSON, encrypts it internal/tools/mproc/sender.go52-56 and writes it to a temporary file. It then executes the current binary with the intercmd argument internal/tools/mproc/sender.go85-95 It pipes the child's stdout and stderr back to the parent's logger internal/tools/mproc/sender.go96-152ReceiverHandler function internal/tools/mproc/receiver.go65-68"This diagram shows how mproc.Sender and mproc.Receiver bridge the parent and child process."
Sources: internal/tools/mproc/sender.go1-206 internal/tools/mproc/receiver.go1-100
The SSH utility provides a wrapper around golang.org/x/crypto/ssh to support complex connection scenarios.
none, password, and key (private key with optional passphrase) pkg/core/certifier/challengers/http01/ssh/ssh.go18-30JumpServers configurations pkg/core/certifier/challengers/http01/ssh/ssh.go56-67HTTP-01 challenger to place validation tokens on remote web servers pkg/core/certifier/challengers/http01/ssh/ssh.go43-75The FTP utility provides a client for remote file transfers.
HTTPProvider uses the FTP client to create the .well-known/acme-challenge directory pkg/core/certifier/challengers/http01/ftp/internal/lego.go67-69 and upload the keyAuth token pkg/core/certifier/challengers/http01/ftp/internal/lego.go73-75Sources: pkg/core/certifier/challengers/http01/ssh/ssh.go1-76 internal/tools/ftp/client.go1-30 pkg/core/certifier/challengers/http01/ftp/internal/lego.go52-80
The S3 utility is a wrapper around the MinIO Go SDK, providing a simplified interface for object storage.
https and strips the scheme for the MinIO client internal/tools/s3/client.go105-121xtls.NewInsecureConfig() internal/tools/s3/client.go91-95The SMTP utility wraps github.com/wneessen/go-mail to provide a robust notification channel.
QUIT command handling for smtp.qq.com internal/tools/smtp/client.go109email.Notifier to send templated alerts with support for both Plain Text and HTML formats pkg/core/notifier/providers/email/email.go71-110Sources: internal/tools/s3/client.go1-122 internal/tools/smtp/client.go1-113 pkg/core/notifier/providers/email/email.go71-110
The pkg/utils/cert/x509 package provides advanced parsing for certificate metadata beyond the standard library.
GetSubjectCommonName extracts the CN or falls back to the first SAN pkg/utils/cert/x509/x509.go43-56GetSubjectAltNames parses the Subject Alternative Name extension manually to preserve the original order of DNS names, IPs, and URIs pkg/utils/cert/x509/x509.go65-103The pkg/utils/wait package provides standardized delay and polling logic used during deployments to wait for remote service propagation.
DelayWithContext provides a context-aware sleep pkg/utils/wait/delay.go11-13xloop.ForRangeAllWithContext is frequently used in deployers (e.g., Baota Panel) to iterate through sites with a fixed delay between operations to avoid rate limiting pkg/core/deployer/providers/baotapanel/baotapanel.go98-106Sources: pkg/utils/cert/x509/x509.go1-158 pkg/utils/wait/delay.go1-15 pkg/core/deployer/providers/baotapanel/baotapanel.go98-106
The pkg/utils/filepath package provides cross-platform path manipulation that attempts to preserve the original path separators (Windows \ vs Unix /) rather than forcing the host OS separator pkg/utils/filepath/path.go20-30 This is critical when Certimate runs on one OS but manages files on a different remote OS via SSH/FTP.
The pkg/utils/tls package provides standard configurations for secure and compatible connections.
NewCompatibleConfig enables all available cipher suites and sets the minimum version to TLS 1.0 to maximize compatibility with older infrastructure pkg/utils/tls/config.go11-24NewInsecureConfig wraps the compatible config with InsecureSkipVerify: true pkg/utils/tls/config.go30-34Sources: pkg/utils/filepath/path.go1-63 pkg/utils/tls/config.go1-35
Certimate integrates with numerous cloud and infrastructure providers. These integrations follow a standard pattern using utility helpers:
"Association between provider services and their Go implementation structs."
| Provider Service | Code Entity | Role |
|---|---|---|
| S3 Challenger | s3.ChallengerConfig | Configuration for HTTP-01 via S3. pkg/core/certifier/challengers/http01/s3/s3.go10 |
| SSH Challenger | ssh.ChallengerConfig | Configuration for HTTP-01 via SSH. pkg/core/certifier/challengers/http01/ssh/ssh.go32 |
| Local Challenger | local.ChallengerConfig | Local webroot HTTP-01 configuration. pkg/core/certifier/challengers/http01/local/local.go11 |
| Email Notifier | email.Notifier | Sends notifications via SMTP client. pkg/core/notifier/providers/email/email.go45 |
| Baota Panel | baotapanel.Deployer | Deploys certificates using btpanelsdk. pkg/core/deployer/providers/baotapanel/baotapanel.go37 |
| 1Panel | onepanel.Deployer | Manages 1Panel certificates via onepanelsdk. pkg/core/deployer/providers/1panel/1panel.go52 |
"Mapping the ACME obtain request to internal provider registries and challengers."
Sources: pkg/core/certifier/challengers/http01/s3/s3.go31-51 internal/tools/mproc/sender.go18-21 pkg/core/certifier/challengers/http01/local/local.go16-31 pkg/core/deployer/providers/baotapanel/baotapanel.go72-113
Refresh this wiki