feat: M17 OpenSSL/Custom CA issuer connector + M16b CLI tool with bulk import

M17: Script-based issuer connector delegating sign/revoke/CRL to user-provided scripts. Compatible with any CA tooling (OpenSSL, cfssl, custom PKI). Configurable timeout, environment variable passthrough. 14 tests including timeout enforcement. M16b: certctl-cli wraps all 76 REST API endpoints for terminal workflows. Supports certs/agents/jobs list/get/renew/revoke/cancel, bulk PEM import with progress reporting, server health status, table and JSON output formats. Zero external dependencies (stdlib only). 14 tests with mock HTTP server. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-07 13:41:30 +00:00 · 2026-03-23 18:12:40 -04:00
parent 9b0ff37973
commit df1aaa37f8
10 changed files with 2213 additions and 1 deletions
@@ -0,0 +1,609 @@
+package cli
+
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"text/tabwriter"
+	"time"
+)
+
+// Client is the CLI HTTP client that communicates with the certctl server.
+type Client struct {
+	baseURL   string
+	apiKey    string
+	format    string
+	httpClient *http.Client
+}
+
+// NewClient creates a new CLI client.
+func NewClient(baseURL, apiKey, format string) *Client {
+	return &Client{
+		baseURL: baseURL,
+		apiKey:  apiKey,
+		format:  format,
+		httpClient: &http.Client{
+			Timeout: 30 * time.Second,
+		},
+	}
+}
+
+// do performs an HTTP request and returns the parsed JSON response.
+func (c *Client) do(method, path string, query url.Values, body interface{}) (json.RawMessage, error) {
+	u, err := url.JoinPath(c.baseURL, path)
+	if err != nil {
+		return nil, fmt.Errorf("invalid URL: %w", err)
+	}
+
+	if query != nil && len(query) > 0 {
+		u = u + "?" + query.Encode()
+	}
+
+	var bodyReader io.Reader
+	if body != nil {
+		data, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshaling request body: %w", err)
+		}
+		bodyReader = bytes.NewReader(data)
+	}
+
+	req, err := http.NewRequest(method, u, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("creating request: %w", err)
+	}
+
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Accept", "application/json")
+
+	if c.apiKey != "" {
+		req.Header.Set("Authorization", "Bearer "+c.apiKey)
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("reading response: %w", err)
+	}
+
+	// 204 No Content — return empty JSON object
+	if resp.StatusCode == 204 {
+		return json.RawMessage(`{"status":"deleted"}`), nil
+	}
+
+	if resp.StatusCode >= 400 {
+		return nil, fmt.Errorf("API error (HTTP %d): %s", resp.StatusCode, string(respBody))
+	}
+
+	return json.RawMessage(respBody), nil
+}
+
+// ListCertificates lists all managed certificates with optional filters.
+func (c *Client) ListCertificates(args []string) error {
+	fs := flag.NewFlagSet("certs list", flag.ContinueOnError)
+	status := fs.String("status", "", "Filter by status")
+	page := fs.Int("page", 1, "Page number")
+	perPage := fs.Int("per-page", 50, "Items per page")
+	fs.Parse(args)
+
+	query := url.Values{}
+	if *status != "" {
+		query.Set("status", *status)
+	}
+	query.Set("page", fmt.Sprintf("%d", *page))
+	query.Set("per_page", fmt.Sprintf("%d", *perPage))
+
+	resp, err := c.do("GET", "/api/v1/certificates", query, nil)
+	if err != nil {
+		return err
+	}
+
+	var result struct {
+		Data  []map[string]interface{} `json:"data"`
+		Total int                      `json:"total"`
+	}
+	if err := json.Unmarshal(resp, &result); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(result)
+	}
+
+	return c.outputCertificatesTable(result.Data, result.Total)
+}
+
+// GetCertificate retrieves a single certificate by ID.
+func (c *Client) GetCertificate(id string) error {
+	resp, err := c.do("GET", fmt.Sprintf("/api/v1/certificates/%s", id), nil, nil)
+	if err != nil {
+		return err
+	}
+
+	var cert map[string]interface{}
+	if err := json.Unmarshal(resp, &cert); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(cert)
+	}
+
+	return c.outputCertificateDetail(cert)
+}
+
+// RenewCertificate triggers renewal for a certificate.
+func (c *Client) RenewCertificate(id string) error {
+	body := map[string]interface{}{
+		"force": false,
+	}
+
+	resp, err := c.do("POST", fmt.Sprintf("/api/v1/certificates/%s/renew", id), nil, body)
+	if err != nil {
+		return err
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(resp, &result); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(result)
+	}
+
+	fmt.Printf("Renewal triggered for certificate %s\n", id)
+	if jobID, ok := result["job_id"]; ok {
+		fmt.Printf("Job ID: %v\n", jobID)
+	}
+	return nil
+}
+
+// RevokeCertificate revokes a certificate.
+func (c *Client) RevokeCertificate(id, reason string) error {
+	body := map[string]interface{}{
+		"reason": reason,
+	}
+
+	resp, err := c.do("POST", fmt.Sprintf("/api/v1/certificates/%s/revoke", id), nil, body)
+	if err != nil {
+		return err
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(resp, &result); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(result)
+	}
+
+	fmt.Printf("Certificate %s revoked with reason: %s\n", id, reason)
+	return nil
+}
+
+// ListAgents lists all agents.
+func (c *Client) ListAgents(args []string) error {
+	fs := flag.NewFlagSet("agents list", flag.ContinueOnError)
+	status := fs.String("status", "", "Filter by status")
+	page := fs.Int("page", 1, "Page number")
+	perPage := fs.Int("per-page", 50, "Items per page")
+	fs.Parse(args)
+
+	query := url.Values{}
+	if *status != "" {
+		query.Set("status", *status)
+	}
+	query.Set("page", fmt.Sprintf("%d", *page))
+	query.Set("per_page", fmt.Sprintf("%d", *perPage))
+
+	resp, err := c.do("GET", "/api/v1/agents", query, nil)
+	if err != nil {
+		return err
+	}
+
+	var result struct {
+		Data  []map[string]interface{} `json:"data"`
+		Total int                      `json:"total"`
+	}
+	if err := json.Unmarshal(resp, &result); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(result)
+	}
+
+	return c.outputAgentsTable(result.Data, result.Total)
+}
+
+// GetAgent retrieves a single agent by ID.
+func (c *Client) GetAgent(id string) error {
+	resp, err := c.do("GET", fmt.Sprintf("/api/v1/agents/%s", id), nil, nil)
+	if err != nil {
+		return err
+	}
+
+	var agent map[string]interface{}
+	if err := json.Unmarshal(resp, &agent); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(agent)
+	}
+
+	return c.outputAgentDetail(agent)
+}
+
+// ListJobs lists all jobs.
+func (c *Client) ListJobs(args []string) error {
+	fs := flag.NewFlagSet("jobs list", flag.ContinueOnError)
+	status := fs.String("status", "", "Filter by status")
+	jobType := fs.String("type", "", "Filter by type")
+	page := fs.Int("page", 1, "Page number")
+	perPage := fs.Int("per-page", 50, "Items per page")
+	fs.Parse(args)
+
+	query := url.Values{}
+	if *status != "" {
+		query.Set("status", *status)
+	}
+	if *jobType != "" {
+		query.Set("type", *jobType)
+	}
+	query.Set("page", fmt.Sprintf("%d", *page))
+	query.Set("per_page", fmt.Sprintf("%d", *perPage))
+
+	resp, err := c.do("GET", "/api/v1/jobs", query, nil)
+	if err != nil {
+		return err
+	}
+
+	var result struct {
+		Data  []map[string]interface{} `json:"data"`
+		Total int                      `json:"total"`
+	}
+	if err := json.Unmarshal(resp, &result); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(result)
+	}
+
+	return c.outputJobsTable(result.Data, result.Total)
+}
+
+// GetJob retrieves a single job by ID.
+func (c *Client) GetJob(id string) error {
+	resp, err := c.do("GET", fmt.Sprintf("/api/v1/jobs/%s", id), nil, nil)
+	if err != nil {
+		return err
+	}
+
+	var job map[string]interface{}
+	if err := json.Unmarshal(resp, &job); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(job)
+	}
+
+	return c.outputJobDetail(job)
+}
+
+// CancelJob cancels a pending job.
+func (c *Client) CancelJob(id string) error {
+	body := map[string]interface{}{}
+
+	resp, err := c.do("POST", fmt.Sprintf("/api/v1/jobs/%s/cancel", id), nil, body)
+	if err != nil {
+		return err
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(resp, &result); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(result)
+	}
+
+	fmt.Printf("Job %s cancelled\n", id)
+	return nil
+}
+
+// GetStatus retrieves server health and summary stats.
+func (c *Client) GetStatus() error {
+	resp, err := c.do("GET", "/api/v1/health", nil, nil)
+	if err != nil {
+		return err
+	}
+
+	var health map[string]interface{}
+	if err := json.Unmarshal(resp, &health); err != nil {
+		return fmt.Errorf("parsing response: %w", err)
+	}
+
+	if c.format == "json" {
+		return c.outputJSON(health)
+	}
+
+	fmt.Printf("Server Status: %v\n", health["status"])
+	if ts, ok := health["timestamp"]; ok {
+		fmt.Printf("Timestamp: %v\n", ts)
+	}
+
+	// Try to fetch summary stats
+	statsResp, err := c.do("GET", "/api/v1/stats/summary", nil, nil)
+	if err == nil {
+		var stats map[string]interface{}
+		if err := json.Unmarshal(statsResp, &stats); err == nil {
+			fmt.Println("\nSummary Stats:")
+			if data, ok := stats["data"].(map[string]interface{}); ok {
+				for k, v := range data {
+					fmt.Printf("  %s: %v\n", k, v)
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+// ImportCertificates bulk imports certificates from PEM files.
+func (c *Client) ImportCertificates(files []string) error {
+	var imported, failed int
+
+	for _, filePath := range files {
+		data, err := os.ReadFile(filePath)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "failed to read %s: %v\n", filePath, err)
+			failed++
+			continue
+		}
+
+		certs, err := parsePEMCertificates(data)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "failed to parse %s: %v\n", filePath, err)
+			failed++
+			continue
+		}
+
+		for i, cert := range certs {
+			total := len(certs)
+			fmt.Printf("Importing %d/%d certificates from %s...\r", i+1, total, filepath.Base(filePath))
+
+			req := map[string]interface{}{
+				"common_name": cert.Subject.CommonName,
+				"sans":        cert.DNSNames,
+				"issuer_id":   "iss-local",
+				"environment": "imported",
+				"status":      "Active",
+			}
+
+			if cert.SerialNumber != nil {
+				req["serial_number"] = fmt.Sprintf("%x", cert.SerialNumber)
+			}
+
+			_, err := c.do("POST", "/api/v1/certificates", nil, req)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "failed to import cert %s: %v\n", cert.Subject.CommonName, err)
+				failed++
+				continue
+			}
+			imported++
+		}
+		fmt.Printf("Importing %d/%d certificates from %s... done\n", len(certs), len(certs), filepath.Base(filePath))
+	}
+
+	fmt.Printf("\nImport Summary:\n")
+	fmt.Printf("  Successfully imported: %d\n", imported)
+	fmt.Printf("  Failed: %d\n", failed)
+
+	return nil
+}
+
+// Output formatting functions
+
+func (c *Client) outputJSON(data interface{}) error {
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	return enc.Encode(data)
+}
+
+func (c *Client) outputCertificatesTable(certs []map[string]interface{}, total int) error {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+	fmt.Fprintln(w, "ID\tCOMMON NAME\tSTATUS\tEXPIRES\tISSUER")
+
+	for _, cert := range certs {
+		id := getString(cert, "id")
+		cn := getString(cert, "common_name")
+		status := getString(cert, "status")
+		issuer := getString(cert, "issuer_id")
+
+		expiresStr := ""
+		if expires, ok := cert["expires_at"].(string); ok {
+			if t, err := time.Parse(time.RFC3339, expires); err == nil {
+				expiresStr = t.Format("2006-01-02")
+			}
+		}
+
+		fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", id, cn, status, expiresStr, issuer)
+	}
+
+	w.Flush()
+	fmt.Printf("\nTotal: %d\n", total)
+	return nil
+}
+
+func (c *Client) outputCertificateDetail(cert map[string]interface{}) error {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+
+	fmt.Fprintf(w, "ID:\t%v\n", getString(cert, "id"))
+	fmt.Fprintf(w, "Name:\t%v\n", getString(cert, "name"))
+	fmt.Fprintf(w, "Common Name:\t%v\n", getString(cert, "common_name"))
+	fmt.Fprintf(w, "Status:\t%v\n", getString(cert, "status"))
+	fmt.Fprintf(w, "Issuer ID:\t%v\n", getString(cert, "issuer_id"))
+	fmt.Fprintf(w, "Owner ID:\t%v\n", getString(cert, "owner_id"))
+
+	if expires, ok := cert["expires_at"].(string); ok {
+		if t, err := time.Parse(time.RFC3339, expires); err == nil {
+			fmt.Fprintf(w, "Expires At:\t%s\n", t.Format("2006-01-02 15:04:05 MST"))
+		}
+	}
+
+	if sans, ok := cert["sans"].([]interface{}); ok && len(sans) > 0 {
+		fmt.Fprintf(w, "SANs:\t%v\n", sans)
+	}
+
+	w.Flush()
+	return nil
+}
+
+func (c *Client) outputAgentsTable(agents []map[string]interface{}, total int) error {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+	fmt.Fprintln(w, "ID\tHOSTNAME\tSTATUS\tOS\tARCHITECTURE\tIP ADDRESS")
+
+	for _, agent := range agents {
+		id := getString(agent, "id")
+		hostname := getString(agent, "hostname")
+		status := getString(agent, "status")
+		os := getString(agent, "os")
+		arch := getString(agent, "architecture")
+		ip := getString(agent, "ip_address")
+
+		fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\n", id, hostname, status, os, arch, ip)
+	}
+
+	w.Flush()
+	fmt.Printf("\nTotal: %d\n", total)
+	return nil
+}
+
+func (c *Client) outputAgentDetail(agent map[string]interface{}) error {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+
+	fmt.Fprintf(w, "ID:\t%v\n", getString(agent, "id"))
+	fmt.Fprintf(w, "Name:\t%v\n", getString(agent, "name"))
+	fmt.Fprintf(w, "Hostname:\t%v\n", getString(agent, "hostname"))
+	fmt.Fprintf(w, "Status:\t%v\n", getString(agent, "status"))
+	fmt.Fprintf(w, "OS:\t%v\n", getString(agent, "os"))
+	fmt.Fprintf(w, "Architecture:\t%v\n", getString(agent, "architecture"))
+	fmt.Fprintf(w, "IP Address:\t%v\n", getString(agent, "ip_address"))
+	fmt.Fprintf(w, "Version:\t%v\n", getString(agent, "version"))
+
+	if lastHB, ok := agent["last_heartbeat_at"].(string); ok && lastHB != "" {
+		if t, err := time.Parse(time.RFC3339, lastHB); err == nil {
+			fmt.Fprintf(w, "Last Heartbeat:\t%s\n", t.Format("2006-01-02 15:04:05 MST"))
+		}
+	}
+
+	w.Flush()
+	return nil
+}
+
+func (c *Client) outputJobsTable(jobs []map[string]interface{}, total int) error {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+	fmt.Fprintln(w, "ID\tTYPE\tCERTIFICATE\tSTATUS\tATTEMPTS")
+
+	for _, job := range jobs {
+		id := getString(job, "id")
+		jobType := getString(job, "type")
+		certID := getString(job, "certificate_id")
+		status := getString(job, "status")
+		attempts := getInt(job, "attempts")
+
+		fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%d\n", id, jobType, certID, status, attempts)
+	}
+
+	w.Flush()
+	fmt.Printf("\nTotal: %d\n", total)
+	return nil
+}
+
+func (c *Client) outputJobDetail(job map[string]interface{}) error {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+
+	fmt.Fprintf(w, "ID:\t%v\n", getString(job, "id"))
+	fmt.Fprintf(w, "Type:\t%v\n", getString(job, "type"))
+	fmt.Fprintf(w, "Certificate ID:\t%v\n", getString(job, "certificate_id"))
+	fmt.Fprintf(w, "Status:\t%v\n", getString(job, "status"))
+	fmt.Fprintf(w, "Attempts:\t%d\n", getInt(job, "attempts"))
+	fmt.Fprintf(w, "Max Attempts:\t%d\n", getInt(job, "max_attempts"))
+
+	if lastErr, ok := job["last_error"].(string); ok && lastErr != "" {
+		fmt.Fprintf(w, "Last Error:\t%s\n", lastErr)
+	}
+
+	w.Flush()
+	return nil
+}
+
+// Helper functions
+
+func getString(m map[string]interface{}, key string) string {
+	if v, ok := m[key].(string); ok {
+		return v
+	}
+	return ""
+}
+
+func getInt(m map[string]interface{}, key string) int {
+	switch v := m[key].(type) {
+	case float64:
+		return int(v)
+	case int:
+		return v
+	}
+	return 0
+}
+
+// parsePEMCertificates parses PEM-encoded certificates from data.
+func parsePEMCertificates(data []byte) ([]*x509.Certificate, error) {
+	var certs []*x509.Certificate
+
+	for len(data) > 0 {
+		block, rest := pem.Decode(data)
+		if block == nil {
+			break
+		}
+		data = rest
+
+		if block.Type != "CERTIFICATE" {
+			continue
+		}
+
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, err
+		}
+
+		certs = append(certs, cert)
+	}
+
+	if len(certs) == 0 {
+		return nil, fmt.Errorf("no certificates found in PEM data")
+	}
+
+	return certs, nil
+}
@@ -0,0 +1,374 @@
+package cli
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/json"
+	"encoding/pem"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestClient_ListCertificates(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "GET" || r.URL.Path != "/api/v1/certificates" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"data": []map[string]interface{}{
+				{
+					"id":          "mc-1",
+					"common_name": "example.com",
+					"status":      "Active",
+					"expires_at":  "2025-12-31T00:00:00Z",
+					"issuer_id":   "iss-local",
+				},
+			},
+			"total": 1,
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "table")
+	err := client.ListCertificates([]string{})
+	if err != nil {
+		t.Fatalf("ListCertificates failed: %v", err)
+	}
+}
+
+func TestClient_GetCertificate(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "GET" || r.URL.Path != "/api/v1/certificates/mc-1" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"id":          "mc-1",
+			"common_name": "example.com",
+			"status":      "Active",
+			"expires_at":  "2025-12-31T00:00:00Z",
+			"issuer_id":   "iss-local",
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "json")
+	err := client.GetCertificate("mc-1")
+	if err != nil {
+		t.Fatalf("GetCertificate failed: %v", err)
+	}
+}
+
+func TestClient_RenewCertificate(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" || r.URL.Path != "/api/v1/certificates/mc-1/renew" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"job_id": "job-123",
+			"status": "Pending",
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "table")
+	err := client.RenewCertificate("mc-1")
+	if err != nil {
+		t.Fatalf("RenewCertificate failed: %v", err)
+	}
+}
+
+func TestClient_RevokeCertificate(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" || r.URL.Path != "/api/v1/certificates/mc-1/revoke" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"status": "revoked",
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "table")
+	err := client.RevokeCertificate("mc-1", "cessationOfOperation")
+	if err != nil {
+		t.Fatalf("RevokeCertificate failed: %v", err)
+	}
+}
+
+func TestClient_ListAgents(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "GET" || r.URL.Path != "/api/v1/agents" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"data": []map[string]interface{}{
+				{
+					"id":           "ag-1",
+					"hostname":     "agent1.example.com",
+					"status":       "Online",
+					"os":           "linux",
+					"architecture": "amd64",
+					"ip_address":   "192.168.1.1",
+				},
+			},
+			"total": 1,
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "table")
+	err := client.ListAgents([]string{})
+	if err != nil {
+		t.Fatalf("ListAgents failed: %v", err)
+	}
+}
+
+func TestClient_GetAgent(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "GET" || r.URL.Path != "/api/v1/agents/ag-1" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"id":           "ag-1",
+			"hostname":     "agent1.example.com",
+			"status":       "Online",
+			"os":           "linux",
+			"architecture": "amd64",
+			"ip_address":   "192.168.1.1",
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "json")
+	err := client.GetAgent("ag-1")
+	if err != nil {
+		t.Fatalf("GetAgent failed: %v", err)
+	}
+}
+
+func TestClient_ListJobs(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "GET" || r.URL.Path != "/api/v1/jobs" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"data": []map[string]interface{}{
+				{
+					"id":             "job-1",
+					"type":           "Renewal",
+					"certificate_id": "mc-1",
+					"status":         "Completed",
+					"attempts":       1,
+					"max_attempts":   3,
+				},
+			},
+			"total": 1,
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "table")
+	err := client.ListJobs([]string{})
+	if err != nil {
+		t.Fatalf("ListJobs failed: %v", err)
+	}
+}
+
+func TestClient_GetJob(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "GET" || r.URL.Path != "/api/v1/jobs/job-1" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"id":             "job-1",
+			"type":           "Renewal",
+			"certificate_id": "mc-1",
+			"status":         "Completed",
+			"attempts":       1,
+			"max_attempts":   3,
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "json")
+	err := client.GetJob("job-1")
+	if err != nil {
+		t.Fatalf("GetJob failed: %v", err)
+	}
+}
+
+func TestClient_CancelJob(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" || r.URL.Path != "/api/v1/jobs/job-1/cancel" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "table")
+	err := client.CancelJob("job-1")
+	if err != nil {
+		t.Fatalf("CancelJob failed: %v", err)
+	}
+}
+
+func TestClient_GetStatus(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "GET" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+
+		if r.URL.Path == "/api/v1/health" {
+			json.NewEncoder(w).Encode(map[string]interface{}{
+				"status":    "healthy",
+				"timestamp": time.Now().Format(time.RFC3339),
+			})
+		} else if r.URL.Path == "/api/v1/stats/summary" {
+			json.NewEncoder(w).Encode(map[string]interface{}{
+				"data": map[string]interface{}{
+					"total_certificates": 10,
+					"total_agents":       5,
+				},
+			})
+		}
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "table")
+	err := client.GetStatus()
+	if err != nil {
+		t.Fatalf("GetStatus failed: %v", err)
+	}
+}
+
+func TestParsePEMCertificates(t *testing.T) {
+	// Generate a self-signed test certificate
+	cert := generateTestCert()
+
+	// Encode it to PEM
+	pemBlock := &pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: cert.Raw,
+	}
+	pemData := pem.EncodeToMemory(pemBlock)
+
+	// Parse it back
+	certs, err := parsePEMCertificates(pemData)
+	if err != nil {
+		t.Fatalf("parsePEMCertificates failed: %v", err)
+	}
+
+	if len(certs) != 1 {
+		t.Fatalf("expected 1 certificate, got %d", len(certs))
+	}
+
+	if certs[0].Subject.CommonName != "test.example.com" {
+		t.Fatalf("expected CommonName 'test.example.com', got %s", certs[0].Subject.CommonName)
+	}
+}
+
+func TestParsePEMCertificates_Multiple(t *testing.T) {
+	// Generate two test certificates
+	cert1 := generateTestCert()
+	cert2 := generateTestCert()
+
+	// Encode both to PEM
+	block1 := &pem.Block{Type: "CERTIFICATE", Bytes: cert1.Raw}
+	block2 := &pem.Block{Type: "CERTIFICATE", Bytes: cert2.Raw}
+
+	pemData := append(pem.EncodeToMemory(block1), pem.EncodeToMemory(block2)...)
+
+	// Parse them back
+	certs, err := parsePEMCertificates(pemData)
+	if err != nil {
+		t.Fatalf("parsePEMCertificates failed: %v", err)
+	}
+
+	if len(certs) != 2 {
+		t.Fatalf("expected 2 certificates, got %d", len(certs))
+	}
+}
+
+func TestParsePEMCertificates_NoCertificates(t *testing.T) {
+	pemData := []byte("no certificates here")
+
+	_, err := parsePEMCertificates(pemData)
+	if err == nil {
+		t.Fatal("expected error for empty PEM data")
+	}
+}
+
+func TestClient_AuthHeader(t *testing.T) {
+	var authHeader string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		authHeader = r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{"data": []interface{}{}})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "testkey123", "json")
+	client.do("GET", "/api/v1/certificates", nil, nil)
+
+	if authHeader != "Bearer testkey123" {
+		t.Fatalf("expected 'Bearer testkey123', got '%s'", authHeader)
+	}
+}
+
+// Helper function to generate a test certificate
+func generateTestCert() *x509.Certificate {
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject: pkix.Name{
+			CommonName: "test.example.com",
+		},
+		NotBefore:             now,
+		NotAfter:              now.Add(365 * 24 * time.Hour),
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+		DNSNames:              []string{"test.example.com", "*.test.example.com"},
+	}
+
+	privateKey, _ := rsa.GenerateKey(rand.Reader, 2048)
+	certBytes, _ := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
+	cert, _ := x509.ParseCertificate(certBytes)
+
+	return cert
+}