fix(config): add RetryInterval to TestValidate_ValidConfig + TestValidate_AuthTypeNone fixtures (I-001 follow-up)

Problem:
  TestValidate_ValidConfig and TestValidate_AuthTypeNone construct a
  SchedulerConfig without RetryInterval, so Validate() fails the
  'retry interval must be at least 1 second' check at config.go:1086
  with 'retry interval must be at least 1 second'. Both tests expect
  success, so they fail whenever run.

Root cause (re-derived from source, not inherited from memory):
  git log -S 'retry interval must be at least' --source --all shows
  the validation was introduced in 0200c7f (I-001, RetryFailedJobs
  scheduler wiring). git log -- internal/config/config_test.go shows
  the test file was last touched in 7382e5f, which predates 0200c7f.
  I-001 added a new Validate() rule without updating the two positive
  test fixtures — a gap in I-001's verification pass.

  This is NOT C-001 fallout. The config_test.go file was untouched by
  the C-001 closure commits 91642e2 and 4696116. The failure surfaced
  during the full test suite run after C-001 landed because no one
  had run 'go test ./internal/config/...' since I-001.

Scope:
  - internal/config/config_test.go (2 fixtures: TestValidate_ValidConfig,
    TestValidate_AuthTypeNone).

Implementation:
  Added 'RetryInterval: 5 * time.Minute' to both SchedulerConfig
  literals. 5 minutes matches the I-001 default at config.go:818:

    RetryInterval: getEnvDuration("CERTCTL_SCHEDULER_RETRY_INTERVAL", 5*time.Minute)

  The other two TestValidate_* tests (InvalidAuthType, APIKeyAuth_
  MissingSecret) are unaffected because they expect Validate() to
  error at the auth-type check (line 1052) or auth-secret check
  (line 1057), both of which fire before the RetryInterval check at
  line 1086.

Verification:
  - go test -count=1 -run 'TestValidate_' ./internal/config/...: PASS
  - go test -short -count=1 ./...: all packages PASS
  - go vet ./...: exit 0

Residual:
  None. This is a pure test-fixture fix — production code is unchanged.

Commit:
  0200c7f (I-001) should have included this edit. Attributed here for
  traceability.

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version: '1.25.9'
 
       - name: Go Build
         run: |
@@ -45,11 +45,11 @@ jobs:
         run: govulncheck ./...
 
       - name: Race Detection
-        run: go test -race ./internal/service/... ./internal/api/handler/... ./internal/api/middleware/... ./internal/scheduler/... ./internal/connector/... ./internal/domain/... ./internal/validation/... -count=1 -timeout 300s
+        run: go test -race ./internal/service/... ./internal/api/handler/... ./internal/api/middleware/... ./internal/scheduler/... ./internal/connector/... ./internal/crypto/... ./internal/domain/... ./internal/validation/... ./internal/tlsprobe/... -count=1 -timeout 300s
 
       - name: Go Test with Coverage
         run: |
-          go test ./internal/service/... ./internal/api/handler/... ./internal/api/middleware/... ./internal/integration/... ./internal/connector/issuer/... ./internal/connector/target/... ./internal/connector/notifier/... ./internal/mcp/... ./internal/cli/... ./internal/domain/... ./internal/validation/... -count=1 -cover -coverprofile=coverage.out
+          go test ./internal/service/... ./internal/api/handler/... ./internal/api/middleware/... ./internal/integration/... ./internal/connector/issuer/... ./internal/connector/target/... ./internal/connector/notifier/... ./internal/connector/discovery/... ./internal/crypto/... ./internal/mcp/... ./internal/cli/... ./internal/domain/... ./internal/validation/... ./internal/tlsprobe/... -count=1 -cover -coverprofile=coverage.out
 
       - name: Check Coverage Thresholds
         run: |
@@ -73,6 +73,13 @@ jobs:
           MIDDLEWARE_COV=$(go tool cover -func=coverage.out | grep 'internal/api/middleware' | awk '{print $NF}' | sed 's/%//' | awk '{sum+=$1; n++} END {if(n>0) printf "%.1f", sum/n; else print "0"}')
           echo "Middleware layer coverage: ${MIDDLEWARE_COV}%"
 
+          # Check crypto package coverage (target: 85%+)
+          # M-8 rationale: encryption primitives are a security-critical gate.
+          # v2 format, key-derivation, fallback, and fail-closed sentinel paths
+          # all need exhaustive coverage to avoid silent regressions (CWE-916 / CWE-329).
+          CRYPTO_COV=$(go tool cover -func=coverage.out | grep 'internal/crypto' | awk '{print $NF}' | sed 's/%//' | awk '{sum+=$1; n++} END {if(n>0) printf "%.1f", sum/n; else print "0"}')
+          echo "Crypto package coverage: ${CRYPTO_COV}%"
+
           # Fail if thresholds not met
           if [ "$(echo "$SERVICE_COV < 55" | bc -l)" -eq 1 ]; then
             echo "::error::Service layer coverage ${SERVICE_COV}% is below 55% threshold"
@@ -90,6 +97,10 @@ jobs:
             echo "::error::Middleware layer coverage ${MIDDLEWARE_COV}% is below 30% threshold"
             exit 1
           fi
+          if [ "$(echo "$CRYPTO_COV < 85" | bc -l)" -eq 1 ]; then
+            echo "::error::Crypto package coverage ${CRYPTO_COV}% is below 85% threshold"
+            exit 1
+          fi
           echo "Coverage thresholds passed!"
 
       - name: Upload Coverage Report
@@ -125,3 +136,20 @@ jobs:
       - name: Build Frontend
         working-directory: web
         run: npx vite build
+
+  helm-lint:
+    name: Helm Chart Validation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: '3.13.0'
+
+      - name: Lint Helm Chart
+        run: helm lint deploy/helm/certctl/
+
+      - name: Template Helm Chart
+        run: helm template certctl deploy/helm/certctl/ > /dev/null

.github/workflows/release.yml

@@ -7,14 +7,208 @@ on:
 
 env:
   REGISTRY: ghcr.io
+  # Keep in lock-step with .github/workflows/ci.yml (M-3).
+  GO_VERSION: '1.25.9'
+  IMAGE_NAMESPACE: shankar0123
 
 jobs:
-  build-and-push:
+  # ----------------------------------------------------------------------
+  # build-binaries (M-3): matrix build every (binary × OS × arch) tuple.
+  # For each tuple we produce: the binary, a SPDX-JSON SBOM, a keyless
+  # Cosign signature + certificate bundle, and a single-line sha256sum
+  # file. All artefacts are uploaded to a workflow-scoped artifact; the
+  # aggregate-checksums job fans them back in for release upload.
+  # ----------------------------------------------------------------------
+  build-binaries:
+    name: Build ${{ matrix.binary }} (${{ matrix.os }}/${{ matrix.arch }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # Cosign keyless OIDC identity token
+    strategy:
+      fail-fast: false
+      matrix:
+        binary: [agent, server, cli, mcp-server]
+        os: [linux, darwin]
+        arch: [amd64, arm64]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+
+      - name: Build binary
+        id: build
+        env:
+          GOOS: ${{ matrix.os }}
+          GOARCH: ${{ matrix.arch }}
+          CGO_ENABLED: '0'
+          VERSION: ${{ steps.version.outputs.VERSION }}
+        run: |
+          set -euo pipefail
+          OUTPUT_NAME="certctl-${{ matrix.binary }}-${{ matrix.os }}-${{ matrix.arch }}"
+          mkdir -p dist
+          go build \
+            -trimpath \
+            -ldflags="-w -s -X main.Version=${VERSION}" \
+            -o "dist/${OUTPUT_NAME}" \
+            "./cmd/${{ matrix.binary }}"
+          ls -lh "dist/${OUTPUT_NAME}"
+          echo "output_name=${OUTPUT_NAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Generate SBOM (SPDX-JSON)
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+        with:
+          file: dist/${{ steps.build.outputs.output_name }}
+          format: spdx-json
+          output-file: dist/${{ steps.build.outputs.output_name }}.sbom.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003  # v4.1.1
+
+      - name: Keyless-sign binary with Cosign
+        env:
+          OUTPUT_NAME: ${{ steps.build.outputs.output_name }}
+        run: |
+          set -euo pipefail
+          # Cosign v3.0 (shipped by cosign-installer@v4.1.1 default
+          # cosign-release=v3.0.5) removed --output-signature/--output-certificate
+          # on sign-blob. The replacement is --bundle, which emits a unified
+          # Sigstore bundle (signature + cert chain + Rekor inclusion proof) as
+          # a single .sigstore.json artefact. M-11.
+          cosign sign-blob \
+            --yes \
+            --bundle "dist/${OUTPUT_NAME}.sigstore.json" \
+            "dist/${OUTPUT_NAME}"
+
+      - name: Compute SHA-256 sidecar
+        env:
+          OUTPUT_NAME: ${{ steps.build.outputs.output_name }}
+        run: |
+          set -euo pipefail
+          cd dist
+          sha256sum "${OUTPUT_NAME}" > "${OUTPUT_NAME}.sha256"
+          cat "${OUTPUT_NAME}.sha256"
+
+      - name: Upload build artefacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: binary-${{ steps.build.outputs.output_name }}
+          path: |
+            dist/${{ steps.build.outputs.output_name }}
+            dist/${{ steps.build.outputs.output_name }}.sigstore.json
+            dist/${{ steps.build.outputs.output_name }}.sbom.spdx.json
+            dist/${{ steps.build.outputs.output_name }}.sha256
+          if-no-files-found: error
+          retention-days: 7
+
+  # ----------------------------------------------------------------------
+  # aggregate-checksums (M-3): fan in every matrix artefact, produce a
+  # single checksums.txt (sha256sum format, compatible with `sha256sum
+  # -c`), sign it with Cosign, upload everything to the GitHub Release,
+  # and emit a base64-encoded hash manifest for the SLSA generator.
+  # ----------------------------------------------------------------------
+  aggregate-checksums:
+    name: Aggregate checksums & sign
+    runs-on: ubuntu-latest
+    needs: [build-binaries]
+    permissions:
+      contents: write
+      id-token: write  # Cosign keyless OIDC identity token
+    outputs:
+      hashes: ${{ steps.hashes.outputs.hashes }}
+    steps:
+      - name: Download binary artefacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: binary-*
+          path: artifacts
+          merge-multiple: true
+
+      - name: Aggregate SHA-256 sums
+        id: hashes
+        run: |
+          set -euo pipefail
+          cd artifacts
+          : > checksums.txt
+          for f in certctl-*; do
+            case "$f" in
+              *.sigstore.json|*.sbom.spdx.json|*.sha256|checksums.txt)
+                continue ;;
+            esac
+            sha256sum "$f" >> checksums.txt
+          done
+          echo "=== checksums.txt ==="
+          cat checksums.txt
+          # base64 hashes (single line, no wrapping) for SLSA generator.
+          HASHES=$(base64 -w0 < checksums.txt)
+          echo "hashes=${HASHES}" >> "$GITHUB_OUTPUT"
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003  # v4.1.1
+
+      - name: Keyless-sign checksums.txt
+        run: |
+          set -euo pipefail
+          cd artifacts
+          # Cosign v3.0 --bundle replaces the removed v2 flag pair
+          # --output-signature / --output-certificate. See M-11.
+          cosign sign-blob \
+            --yes \
+            --bundle checksums.txt.sigstore.json \
+            checksums.txt
+
+      - name: Upload artefacts to GitHub Release
+        uses: softprops/action-gh-release@v2
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          files: |
+            artifacts/certctl-*
+            artifacts/checksums.txt
+            artifacts/checksums.txt.sigstore.json
+
+  # ----------------------------------------------------------------------
+  # provenance-binaries (M-3): SLSA Level 3 provenance for every binary.
+  # The SLSA generic generator reusable workflow runs in a hermetic
+  # workflow run, producing multiple.intoto.jsonl from the base64 hash
+  # manifest and uploading it as a release asset.
+  # ----------------------------------------------------------------------
+  provenance-binaries:
+    name: SLSA provenance (binaries)
+    needs: [aggregate-checksums]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      base64-subjects: "${{ needs.aggregate-checksums.outputs.hashes }}"
+      upload-assets: true
+      provenance-name: multiple.intoto.jsonl
+
+  # ----------------------------------------------------------------------
+  # build-and-push-docker: push container images to GHCR with native
+  # SLSA L3 provenance (mode=max) and SBOM attestations emitted by
+  # docker/build-push-action@v6, plus a keyless Cosign signature on the
+  # image digest for identity-bound verification. The M-4 proxy-propagation
+  # build-args block is retained verbatim — M-3 only adds supply-chain
+  # steps; it never touches M-4 wiring.
+  # ----------------------------------------------------------------------
+  build-and-push-docker:
     name: Build & Push Docker Images
     runs-on: ubuntu-latest
     permissions:
       contents: write
       packages: write
+      id-token: write  # Cosign keyless OIDC identity token
 
     steps:
       - uses: actions/checkout@v4
@@ -28,48 +222,146 @@ jobs:
 
       - name: Extract version from tag
         id: version
-        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003  # v4.1.1
+
       - name: Build and push server image
+        id: server-push
         uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           push: true
           tags: |
-            ${{ env.REGISTRY }}/shankar0123/certctl-server:${{ steps.version.outputs.VERSION }}
-            ${{ env.REGISTRY }}/shankar0123/certctl-server:latest
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/certctl-server:${{ steps.version.outputs.VERSION }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/certctl-server:latest
+          # Proxy propagation (M-4, Issue #9) — forwards runner-level proxy
+          # secrets into the Docker build so self-hosted runners behind
+          # corporate proxies can reach public registries. GitHub-hosted
+          # runners don't need proxies, so the secrets are optional and
+          # resolve to empty strings when unset — byte-identical to the
+          # pre-fix behaviour for the public-runner path.
+          build-args: |
+            HTTP_PROXY=${{ secrets.HTTP_PROXY }}
+            HTTPS_PROXY=${{ secrets.HTTPS_PROXY }}
+            NO_PROXY=${{ secrets.NO_PROXY }}
+          # Supply-chain hardening (M-3): emit native SLSA L3 provenance
+          # and SBOM attestations bound to the image manifest.
+          provenance: mode=max
+          sbom: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Keyless-sign server image with Cosign
+        env:
+          DIGEST: ${{ steps.server-push.outputs.digest }}
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/certctl-server
+        run: |
+          set -euo pipefail
+          cosign sign --yes "${IMAGE}@${DIGEST}"
+
       - name: Build and push agent image
+        id: agent-push
         uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile.agent
           push: true
           tags: |
-            ${{ env.REGISTRY }}/shankar0123/certctl-agent:${{ steps.version.outputs.VERSION }}
-            ${{ env.REGISTRY }}/shankar0123/certctl-agent:latest
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/certctl-agent:${{ steps.version.outputs.VERSION }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/certctl-agent:latest
+          # Proxy propagation (M-4, Issue #9) — see server-image step for
+          # rationale. Empty secrets resolve to empty build args, leaving
+          # the un-proxied code path byte-identical to the pre-fix tree.
+          build-args: |
+            HTTP_PROXY=${{ secrets.HTTP_PROXY }}
+            HTTPS_PROXY=${{ secrets.HTTPS_PROXY }}
+            NO_PROXY=${{ secrets.NO_PROXY }}
+          # Supply-chain hardening (M-3): emit native SLSA L3 provenance
+          # and SBOM attestations bound to the image manifest.
+          provenance: mode=max
+          sbom: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Create GitHub Release
+      - name: Keyless-sign agent image with Cosign
+        env:
+          DIGEST: ${{ steps.agent-push.outputs.digest }}
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/certctl-agent
+        run: |
+          set -euo pipefail
+          cosign sign --yes "${IMAGE}@${DIGEST}"
+
+  # ----------------------------------------------------------------------
+  # create-release: stamp the release body. The actual asset uploads are
+  # handled by aggregate-checksums (binaries, SBOMs, sigs, certs,
+  # checksums.txt + signature) and the SLSA generator (multiple.intoto.jsonl).
+  # ----------------------------------------------------------------------
+  create-release:
+    name: Create Release Notes
+    runs-on: ubuntu-latest
+    needs: [build-binaries, aggregate-checksums, provenance-binaries, build-and-push-docker]
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+
+      - name: Create release with notes
         uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
           body: |
-            ## Docker Images
+            ## Installation
+
+            ### Quick Install (Linux/macOS)
 
             ```bash
-            docker pull shankar0123.docker.scarf.sh/certctl-server:${{ steps.version.outputs.VERSION }}
-            docker pull shankar0123.docker.scarf.sh/certctl-agent:${{ steps.version.outputs.VERSION }}
+            curl -sSL https://raw.githubusercontent.com/shankar0123/certctl/master/install-agent.sh | bash
             ```
 
-            ## Quick Start
+            ### Manual Binary Download
+
+            Download the appropriate binary for your OS and architecture:
+
+            - **Linux x86_64**: `certctl-agent-linux-amd64`
+            - **Linux ARM64**: `certctl-agent-linux-arm64`
+            - **macOS x86_64**: `certctl-agent-darwin-amd64`
+            - **macOS ARM64 (Apple Silicon)**: `certctl-agent-darwin-arm64`
+
+            Then make it executable and start the service:
+
+            ```bash
+            chmod +x certctl-agent-linux-amd64
+            sudo mv certctl-agent-linux-amd64 /usr/local/bin/certctl-agent
+            ```
+
+            ## Docker Images
+
+            Pull pre-built Docker images for server and agent:
+
+            ```bash
+            docker pull ghcr.io/shankar0123/certctl-server:${{ steps.version.outputs.VERSION }}
+            docker pull ghcr.io/shankar0123/certctl-agent:${{ steps.version.outputs.VERSION }}
+            ```
+
+            Or use the latest tag:
+
+            ```bash
+            docker pull ghcr.io/shankar0123/certctl-server:latest
+            docker pull ghcr.io/shankar0123/certctl-agent:latest
+            ```
+
+            ## Docker Compose Quick Start
 
             ```bash
             git clone https://github.com/shankar0123/certctl.git
@@ -77,3 +369,92 @@ jobs:
             cp deploy/.env.example deploy/.env
             docker compose -f deploy/docker-compose.yml up -d
             ```
+
+            ## Server Binaries
+
+            Pre-compiled server binaries are also available for direct installation:
+
+            - **Linux x86_64**: `certctl-server-linux-amd64`
+            - **Linux ARM64**: `certctl-server-linux-arm64`
+            - **macOS x86_64**: `certctl-server-darwin-amd64`
+            - **macOS ARM64 (Apple Silicon)**: `certctl-server-darwin-arm64`
+
+            ## CLI & MCP Server Binaries
+
+            The `certctl-cli` (REST API wrapper) and `certctl-mcp-server` (Model Context
+            Protocol bridge) binaries ship for all four platforms as well:
+
+            - `certctl-cli-{linux,darwin}-{amd64,arm64}`
+            - `certctl-mcp-server-{linux,darwin}-{amd64,arm64}`
+
+            ## Verifying this release
+
+            Every binary, `checksums.txt`, and container image is signed with Cosign
+            keyless OIDC. Each binary ships with a SPDX-JSON SBOM. Binaries are covered
+            by SLSA Level 3 provenance; container images carry native SLSA L3 provenance
+            and SBOM attestations (docker/build-push-action `provenance: mode=max`,
+            `sbom: true`) in addition to a Cosign signature on the digest.
+
+            **1. Verify SHA-256 checksums:**
+
+            ```bash
+            sha256sum -c checksums.txt
+            ```
+
+            **2. Verify the Cosign signature on checksums.txt (keyless OIDC):**
+
+            ```bash
+            cosign verify-blob \
+              --bundle checksums.txt.sigstore.json \
+              --certificate-identity-regexp '^https://github\.com/shankar0123/certctl/\.github/workflows/release\.yml@refs/tags/' \
+              --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+              checksums.txt
+            ```
+
+            Replace `checksums.txt` with any individual binary name to verify that
+            artefact directly (each binary ships with its own `.sigstore.json`
+            bundle, e.g. `cosign verify-blob --bundle certctl-agent-linux-amd64.sigstore.json …`).
+
+            **3. Verify SLSA Level 3 provenance (binaries):**
+
+            ```bash
+            slsa-verifier verify-artifact \
+              --provenance-path multiple.intoto.jsonl \
+              --source-uri github.com/shankar0123/certctl \
+              --source-tag ${{ steps.version.outputs.VERSION }} \
+              certctl-agent-linux-amd64
+            ```
+
+            **4. Verify container image signature and attestations:**
+
+            ```bash
+            IMAGE=ghcr.io/shankar0123/certctl-server:${{ steps.version.outputs.VERSION }}
+            cosign verify \
+              --certificate-identity-regexp '^https://github\.com/shankar0123/certctl/\.github/workflows/release\.yml@refs/tags/' \
+              --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+              "$IMAGE"
+
+            # SBOM attestation (SPDX-JSON) emitted by docker/build-push-action
+            cosign verify-attestation --type spdxjson \
+              --certificate-identity-regexp '^https://github\.com/shankar0123/certctl/' \
+              --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+              "$IMAGE"
+
+            # SLSA provenance attestation (mode=max)
+            cosign verify-attestation --type slsaprovenance \
+              --certificate-identity-regexp '^https://github\.com/shankar0123/certctl/' \
+              --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+              "$IMAGE"
+            ```
+
+            ## Helm Chart
+
+            Deploy certctl to Kubernetes using Helm:
+
+            ```bash
+            helm repo add certctl https://github.com/shankar0123/certctl/tree/master/deploy/helm
+            helm repo update
+            helm install certctl certctl/certctl
+            ```
+
+            See `deploy/helm/certctl/` for values customization.

.gitignore

@@ -43,6 +43,11 @@ vendor/
 tmp/
 temp/
 *.log
+*.bak
+
+# Private keys (agent-generated, never commit)
+cmd/agent/*.key
+cmd/agent/*.pem
 
 # Database
 *.db
@@ -57,12 +62,18 @@ certctl-agent
 certctl-cli
 /server
 /agent
+/cli
 
 # Private strategy docs
-roadmap.md
+strategy.md
 SECURITY_REMEDIATION.md
 
 # OS
 .DS_Store
 Thumbs.db
 mcp-server
+
+# Local Go build/module caches (session-scoped, never committed)
+/.gocache/
+/.gomodcache/
+/.gopath/

.golangci.yml

@@ -6,6 +6,7 @@ run:
 linters:
   default: none
   enable:
+    - contextcheck
     - govet
     - staticcheck
     - unused

CONTRIBUTING.md

@@ -1,162 +0,0 @@
-# Contributing to certctl
-
-## Architecture Conventions
-
-certctl follows a strict **Handler -> Service -> Repository** layering.
-
-**Handlers** define their own service interfaces (dependency inversion). A handler never imports a concrete service type. This means adding a method to a service requires updating the corresponding handler interface and mock.
-
-**Services** contain business logic. Each service should have at most 5-6 direct dependencies. If a service exceeds ~500 lines or ~6 dependencies, decompose it using the facade/delegation pattern (see `CertificateService` -> `RevocationSvc` + `CAOperationsSvc` for the reference implementation).
-
-**Repositories** are PostgreSQL implementations behind interfaces defined in `internal/repository/interfaces.go`. All SQL is hand-written (no ORM). Use `IF NOT EXISTS` for schema, `ON CONFLICT` for idempotent upserts.
-
-**Connectors** implement pluggable interfaces for issuers (`issuer.Connector`), targets (`target.Connector`), and notifiers (`Notifier`). The `IssuerConnectorAdapter` bridges the connector-layer interface with the service-layer interface to maintain dependency inversion.
-
-### When to Split vs. Extend
-
-Split a component when it exceeds ~500 lines, mixes distinct responsibilities (e.g., CRUD + revocation + CRL generation), or has more than 6 dependencies. Use the facade pattern to avoid breaking handler interfaces.
-
-Extend an existing component when the new functionality is tightly coupled to existing state and adding a new file would create unnecessary indirection.
-
-## Middleware Stack Ordering
-
-The HTTP middleware chain is order-sensitive. The current ordering in `cmd/server/main.go`:
-
-1. `RequestID` - assigns a unique request ID
-2. `NewLogging` - structured slog middleware with request ID propagation
-3. `Recovery` - panic recovery (must be early to catch panics in later middleware)
-4. `NewBodyLimit` - request body size limits via `http.MaxBytesReader` (before auth to reject oversized payloads early)
-5. `NewCORS` - CORS preflight handling (deny-by-default)
-6. `NewAuth` - API key / JWT authentication
-7. `NewAuditLog` - records every API call to the audit trail (after auth so actor is available)
-
-When rate limiting is enabled, `NewRateLimiter` is inserted between `NewBodyLimit` and `NewCORS`.
-
-Contributors adding new middleware must respect this ordering. Body-level middleware goes before auth. Auth-dependent middleware goes after auth.
-
-## Test Patterns and Conventions
-
-### Test File Organization
-
-Every package with production code should have corresponding `_test.go` files in the same package (not a `_test` package). Test helpers belong in `testutil_test.go` within the package.
-
-### Mock Naming Convention
-
-Mock types in test files must be **unexported** (lowercase). The convention:
-
-```go
-// Good - unexported, test-only
-type mockCertificateService struct { ... }
-func newMockCertificateService() *mockCertificateService { ... }
-
-// Bad - exported, leaks into package API
-type MockCertificateService struct { ... }
-```
-
-**Known exception:** Handler test files currently use exported Mock types (e.g., `MockCertificateService`). This is a known deviation being tracked for cleanup.
-
-### Service Layer Tests
-
-Service tests use mock repositories defined in `internal/service/testutil_test.go`. The pattern:
-
-```go
-func TestMyService_Method(t *testing.T) {
-    repo := newMockCertificateRepository()
-    auditRepo := newMockAuditRepository()
-    auditService := NewAuditService(auditRepo)
-    svc := NewMyService(repo, auditService)
-
-    // Set up test data
-    repo.AddCert(&domain.ManagedCertificate{...})
-
-    // Exercise
-    err := svc.DoSomething(context.Background(), "cert-1")
-
-    // Verify
-    if err != nil {
-        t.Fatalf("expected no error, got: %v", err)
-    }
-}
-```
-
-### Handler Layer Tests
-
-Handler tests use `httptest.NewRequest` and `httptest.NewRecorder`. Each handler test file defines its own mock service type implementing the handler's service interface:
-
-```go
-type mockFooService struct {
-    err error
-    // fields for capturing calls and returning data
-}
-
-func TestFooHandler_List(t *testing.T) {
-    mock := &mockFooService{}
-    handler := NewFooHandler(mock)
-    // ...
-}
-```
-
-### Repository Integration Tests
-
-Repository tests in `internal/repository/postgres/` use `testcontainers-go` to spin up a real PostgreSQL 16 container. Key patterns:
-
-- `setupTestDB(t)` creates a shared container for the test run
-- `freshSchema(t, db)` creates an isolated PostgreSQL schema per test (`CREATE SCHEMA test_xxx; SET search_path TO test_xxx`)
-- All migrations are run in each schema so tests start with a clean database
-- Tests are skipped in CI short mode (`testing.Short()`) since they require Docker
-- Run locally with: `go test ./internal/repository/postgres/... -v`
-
-### Fuzz Tests
-
-Fuzz tests use Go's native `testing/fuzz` framework. Located in `*_fuzz_test.go` files. Seed corpora include known adversarial inputs (SQL injection, shell metacharacters, etc.). Run with: `go test -fuzz=FuzzValidateShellCommand ./internal/validation/...`
-
-### CI Coverage Thresholds
-
-The CI pipeline enforces per-layer coverage floors:
-
-| Layer | Threshold | Package Pattern |
-|-------|-----------|-----------------|
-| Service | 60% | `internal/service` |
-| Handler | 60% | `internal/api/handler` |
-| Domain | 40% | `internal/domain` |
-| Middleware | 50% | `internal/api/middleware` |
-
-Adding a new package with tests? Ensure it's included in the `go test` command in `.github/workflows/ci.yml`.
-
-### Race Detection
-
-All tests run with `-race` in CI. Never use shared mutable state without synchronization. The scheduler uses `sync/atomic.Bool` guards; follow the same pattern for any concurrent code.
-
-## Adding New Features
-
-1. **Domain model** in `internal/domain/` - types, constants, validation helpers
-2. **Migration** in `migrations/` - `000N_feature.up.sql` and `.down.sql`, idempotent
-3. **Repository interface** in `internal/repository/interfaces.go`, implementation in `internal/repository/postgres/`
-4. **Service** in `internal/service/` with tests
-5. **Handler** in `internal/api/handler/` defining its own service interface, with tests
-6. **Route registration** via `HandlerRegistry` struct in `internal/api/router/router.go`
-7. **Wire** in `cmd/server/main.go`
-8. **OpenAPI spec** update in `api/openapi.yaml`
-9. **GUI page** in `web/src/pages/` with route in `web/src/main.tsx`
-10. **Seed data** in `migrations/seed_demo.sql` for demo mode
-
-Every backend feature ships with its corresponding GUI surface.
-
-## Environment
-
-- **Go 1.25+**, **PostgreSQL 16+**, **Node.js 22+** (frontend)
-- No ORM - raw `database/sql` + `lib/pq`
-- No web framework - `net/http` stdlib routing
-- Minimal dependencies: 5 direct Go dependencies (see `go.mod`)
-- Frontend: Vite + React 18 + TypeScript + TanStack Query + Recharts + Tailwind CSS
-
-## Documentation That Should Exist But Doesn't Yet
-
-The following are recommended future additions:
-
-- **Architecture diagrams** (Mermaid in `docs/architecture.md` covers some, but data flow diagrams for key workflows like renewal and revocation would help)
-- **Threat model** (formal STRIDE analysis for the control plane, agent communication, and key management boundaries)
-- **Testing philosophy guide** (rationale for mock-vs-real testing decisions, when to use testcontainers vs mocks)
-- **Disaster recovery runbook** (PostgreSQL backup/restore, agent re-registration, CA key rotation procedures)
-- **Upgrade guide** (migration steps between major versions, breaking change policy)
-- **API versioning strategy** (how breaking changes will be handled when /api/v2 is needed)

Dockerfile

@@ -3,17 +3,43 @@
 # Stage 1: Build frontend
 FROM node:20-alpine AS frontend
 
+# Proxy propagation (M-4, Issue #9) — defaulted to empty so un-proxied builds
+# behave identically to the pre-fix tree. When `HTTP_PROXY`/`HTTPS_PROXY`/
+# `NO_PROXY` are forwarded via `docker build --build-arg` (or compose
+# `build.args`), they are re-exported as ENV with both upper- and lower-case
+# names because npm/apk/curl read the lowercase variants while Go, Node, and
+# most HTTP libraries read the uppercase ones.
+ARG HTTP_PROXY=
+ARG HTTPS_PROXY=
+ARG NO_PROXY=
+ENV HTTP_PROXY=${HTTP_PROXY} \
+    HTTPS_PROXY=${HTTPS_PROXY} \
+    NO_PROXY=${NO_PROXY} \
+    http_proxy=${HTTP_PROXY} \
+    https_proxy=${HTTPS_PROXY} \
+    no_proxy=${NO_PROXY}
+
 WORKDIR /app/web
 
-COPY web/package.json web/package-lock.json ./
-RUN npm ci
-
 COPY web/ .
-RUN npm run build
+RUN npm ci --include=dev || npm ci --include=dev && \
+    node_modules/.bin/tsc --version && \
+    npm run build
 
 # Stage 2: Build Go binary
 FROM golang:1.25-alpine AS builder
 
+# Proxy propagation (M-4, Issue #9) — see Stage 1 rationale.
+ARG HTTP_PROXY=
+ARG HTTPS_PROXY=
+ARG NO_PROXY=
+ENV HTTP_PROXY=${HTTP_PROXY} \
+    HTTPS_PROXY=${HTTPS_PROXY} \
+    NO_PROXY=${NO_PROXY} \
+    http_proxy=${HTTP_PROXY} \
+    https_proxy=${HTTPS_PROXY} \
+    no_proxy=${NO_PROXY}
+
 RUN apk add --no-cache git ca-certificates tzdata
 
 WORKDIR /app

Dockerfile.agent

@@ -2,6 +2,22 @@
 # Stage 1: Build
 FROM golang:1.25-alpine AS builder
 
+# Proxy propagation (M-4, Issue #9) — defaulted to empty so un-proxied builds
+# behave identically to the pre-fix tree. When `HTTP_PROXY`/`HTTPS_PROXY`/
+# `NO_PROXY` are forwarded via `docker build --build-arg` (or compose
+# `build.args`), they are re-exported as ENV with both upper- and lower-case
+# names because apk and curl read the lowercase variants while Go reads the
+# uppercase ones.
+ARG HTTP_PROXY=
+ARG HTTPS_PROXY=
+ARG NO_PROXY=
+ENV HTTP_PROXY=${HTTP_PROXY} \
+    HTTPS_PROXY=${HTTPS_PROXY} \
+    NO_PROXY=${NO_PROXY} \
+    http_proxy=${HTTP_PROXY} \
+    https_proxy=${HTTPS_PROXY} \
+    no_proxy=${NO_PROXY}
+
 RUN apk add --no-cache git ca-certificates
 
 WORKDIR /app

LICENSE

@@ -6,20 +6,27 @@ Licensor:             Shankar Reddy
 Licensed Work:        certctl
                       The Licensed Work is (c) 2026 Shankar Reddy.
 Additional Use Grant: You may make use of the Licensed Work, provided that
-                      you may not use the Licensed Work for a Certificate
-                      Management Service. A "Certificate Management Service"
-                      is a commercial offering that allows third parties
-                      (other than your employees and contractors acting on
-                      your behalf) to access and/or use the Licensed Work's
-                      certificate lifecycle management functionality as part
-                      of a hosted or managed service.
+                      you may not use the Licensed Work for a Commercial
+                      Certificate Service. A "Commercial Certificate Service"
+                      is any product, service, or offering in which a third
+                      party (other than your employees and contractors
+                      acting on your behalf) accesses, uses, or benefits
+                      from the Licensed Work's certificate management
+                      functionality — including but not limited to lifecycle
+                      management, discovery, monitoring, alerting, renewal
+                      automation, deployment, and revocation — as part of
+                      or in connection with an offering for which
+                      compensation is received. This restriction applies
+                      regardless of whether the Licensed Work is hosted,
+                      managed, embedded, bundled, or integrated with
+                      another product or service.
 
 Change Date:          March 14, 2033
 
 Change License:       Apache License, Version 2.0
 
 For information about alternative licensing arrangements for the Licensed Work,
-please contact: skreddy040@gmail.com
+please contact: certctl@proton.me
 
 Notice
 

README.md

@@ -7,97 +7,130 @@
 
 # certctl — Self-Hosted Certificate Lifecycle Platform
 
-```mermaid
-timeline
-    title TLS Certificate Maximum Lifespan (CA/Browser Forum Ballot SC-081v3)
-    2015 : 5 years
-    2018 : 825 days
-    2020 : 398 days
-    March 2026 : 200 days
-    March 2027 : 100 days
-    March 2029 : 47 days
-```
+[![License](https://img.shields.io/badge/license-BSL%201.1-blue.svg)](LICENSE)
+[![Go Report Card](https://goreportcard.com/badge/github.com/shankar0123/certctl)](https://goreportcard.com/report/github.com/shankar0123/certctl)
+[![GitHub Release](https://img.shields.io/github/v/release/shankar0123/certctl)](https://github.com/shankar0123/certctl/releases)
+[![GitHub Stars](https://img.shields.io/github/stars/shankar0123/certctl?style=flat&logo=github)](https://github.com/shankar0123/certctl/stargazers)
 
 TLS certificate lifespans are shrinking fast. The CA/Browser Forum passed [Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) unanimously in April 2025, setting a phased reduction: **200 days** by March 2026, **100 days** by March 2027, and **47 days** by March 2029. Organizations managing dozens or hundreds of certificates can no longer rely on spreadsheets, calendar reminders, or manual renewal workflows. The math doesn't work — at 47-day lifespans, a team managing 100 certificates is processing 7+ renewals per week, every week, forever.
 
-certctl is a self-hosted platform that automates the entire certificate lifecycle — from issuance through renewal to deployment — with zero human intervention. It works with any certificate authority, deploys to any server, and keeps private keys on your infrastructure where they belong.
+certctl is a self-hosted platform that automates the entire certificate lifecycle — from issuance through renewal to deployment — with zero human intervention. It works with any certificate authority, deploys to any server, and keeps private keys on your infrastructure where they belong. It's free, self-hosted, and covers the same lifecycle that enterprise platforms charge $100K+/year for.
 
-[![License](https://img.shields.io/badge/license-BSL%201.1-blue.svg)](LICENSE)
-[![Go Report Card](https://goreportcard.com/badge/github.com/shankar0123/certctl)](https://goreportcard.com/report/github.com/shankar0123/certctl)
-![Version: v2.0.5](https://img.shields.io/badge/version-v2.0.5-brightgreen)
+```mermaid
+gantt
+    title TLS Certificate Maximum Lifespan — CA/Browser Forum Ballot SC-081v3
+    dateFormat YYYY-MM-DD
+    axisFormat
+    todayMarker off
+    section 2015
+        5 years (1825 days)    :done, 2020-01-01, 1825d
+    section 2018
+        825 days               :done, 2020-01-01, 825d
+    section 2020
+        398 days               :active, 2020-01-01, 398d
+    section 2026
+        200 days               :crit, 2020-01-01, 200d
+    section 2027
+        100 days               :crit, 2020-01-01, 100d
+    section 2029
+        47 days                :crit, 2020-01-01, 47d
+```
+
+> **Actively maintained — shipping weekly.** Found something? [Open a GitHub issue](https://github.com/shankar0123/certctl/issues) — issues get triaged same-day. CI runs the full test suite with race detection, static analysis, and vulnerability scanning on every commit.
+
+**Ready to try it?** Jump to the [Quick Start](#quick-start) — you'll have a running dashboard in under 5 minutes.
 
 ## Documentation
 
 | Guide | Description |
 |-------|-------------|
-| [Why certctl?](docs/why-certctl.md) | Competitive positioning — how certctl compares to open-source and enterprise certificate management platforms |
+| [Why certctl?](docs/why-certctl.md) | How certctl compares to ACME clients, agent-based SaaS, and enterprise platforms |
 | [Concepts](docs/concepts.md) | TLS certificates explained from scratch — for beginners who know nothing about certs |
-| [Quick Start](docs/quickstart.md) | Get running in 5 minutes — dashboard, API, CLI, discovery, stakeholder demo flow |
+| [Quick Start](docs/quickstart.md) | 5-minute setup — dashboard, API, CLI, discovery, stakeholder demo flow |
+| [Docker Compose Environments](deploy/ENVIRONMENTS.md) | Service-by-service walkthrough of all 4 compose files, env var reference |
+| [Deployment Examples](docs/examples.md) | 5 turnkey scenarios (ACME+NGINX, wildcard DNS-01, private CA, step-ca, multi-issuer) with migration guides |
 | [Advanced Demo](docs/demo-advanced.md) | Issue a certificate end-to-end with technical deep-dives |
 | [Architecture](docs/architecture.md) | System design, data flow diagrams, security model |
-| [Feature Inventory](docs/features.md) | Complete reference of all V2 capabilities, API endpoints, and configuration |
-| [Connectors](docs/connectors.md) | Build custom issuer, target, and notifier connectors |
+| [Feature Inventory](docs/features.md) | Complete reference of all capabilities, API endpoints, and configuration |
+| [Connector Reference](docs/connectors.md) | Configuration for all issuer, target, and notifier connectors |
+| [MCP Server](docs/mcp.md) | AI integration via Model Context Protocol — setup, available tools, examples |
+| [OpenAPI 3.1 Spec](docs/openapi.md) | API reference guide with endpoint overview ([raw spec](api/openapi.yaml)) |
 | [Compliance Mapping](docs/compliance.md) | SOC 2 Type II, PCI-DSS 4.0, NIST SP 800-57 alignment guides |
-
-## Why certctl Exists
-
-Certificate lifecycle tooling today falls into two camps: expensive enterprise platforms (Venafi, Keyfactor, Sectigo) that cost six figures and take months to deploy, or single-purpose tools (cert-manager, certbot) that handle one slice of the problem. If you run a mixed infrastructure — some NGINX, some Apache, a few HAProxy nodes, maybe an F5 — and you need to manage certificates from multiple CAs, there's nothing self-hosted that covers the full lifecycle without vendor lock-in.
-
-certctl fills that gap. It's **CA-agnostic** — the issuer connector interface means you can plug in any certificate authority: a self-signed local CA for dev, Let's Encrypt via ACME for public certs, Smallstep step-ca for your private PKI, your enterprise ADCS via sub-CA mode, or any custom CA through a shell script adapter. You're never locked to a single CA vendor, and you can run multiple issuers simultaneously for different certificate types.
-
-It's also **target-agnostic**. Agents deploy certificates to NGINX, Apache, HAProxy, Traefik, and Caddy — all using the same pluggable connector model for any server that accepts cert files. The control plane never initiates outbound connections — agents poll for work, which means certctl works behind firewalls, across network zones, and in air-gapped environments.
-
-For a detailed comparison with CertKit, KeyTalk, and enterprise platforms (Venafi, Keyfactor), see [Why certctl?](docs/why-certctl.md)
-
-## What It Does
-
-certctl gives you a single pane of glass for every TLS certificate in your organization:
-
-- **Web dashboard** — full certificate inventory with status, ownership, expiration heatmaps, and bulk operations
-- **REST API** — 93 endpoints under `/api/v1/` + `/.well-known/est/` for complete automation
-- **Agents** — generate private keys locally, discover existing certs on disk, submit CSRs (private keys never leave your servers)
-- **Network scanner** — discovers certificates on TLS endpoints across CIDR ranges without requiring agents
-- **EST server** (RFC 7030) — device and WiFi certificate enrollment via industry-standard protocol
-- **Approval workflows** — require human sign-off on renewals before deployment
-- **Background scheduler** — watches expiration dates and triggers renewals automatically, handling constant rotation at 47-day lifespans without human involvement
-
-For the full capability breakdown — revocation infrastructure, policy engine, observability, EST enrollment, and more — see the [Feature Inventory](docs/features.md).
+| [Migrate from certbot](docs/migrate-from-certbot.md) | Step-by-step migration from certbot cron jobs to certctl |
+| [Migrate from acme.sh](docs/migrate-from-acmesh.md) | Migration guide for acme.sh users, DNS hook compatibility |
+| [certctl for cert-manager users](docs/certctl-for-cert-manager-users.md) | How certctl complements cert-manager for mixed infrastructure |
+| [Test Environment](docs/test-env.md) | Docker Compose test environment with real CA backends |
+| [Testing Guide](docs/testing-guide.md) | Comprehensive test procedures, smoke tests, and release sign-off checklist |
 
 ## Supported Integrations
 
 ### Certificate Issuers
-| Issuer | Status | Type |
-|--------|--------|------|
-| Local CA (self-signed + sub-CA) | Implemented | `GenericCA` |
-| ACME v2 (Let's Encrypt, Sectigo) | Implemented (HTTP-01 + DNS-01 + DNS-PERSIST-01) | `ACME` |
-| ACME EAB (ZeroSSL, Google Trust) | Implemented (auto-fetch EAB from ZeroSSL) | `ACME` |
-| step-ca | Implemented | `StepCA` |
-| OpenSSL / Custom CA | Implemented | `OpenSSL` |
-| Vault PKI | Future | — |
-| DigiCert | Future | — |
 
-**Note:** ADCS integration is handled via the Local CA's sub-CA mode — certctl operates as a subordinate CA with its signing certificate issued by ADCS. Any CA with a shell-accessible signing interface can be integrated today via the OpenSSL/Custom CA connector.
+| Issuer | Type | Notes |
+|--------|------|-------|
+| Local CA (self-signed + sub-CA) | `GenericCA` | Sub-CA mode chains to enterprise root (ADCS, etc.) |
+| ACME v2 (Let's Encrypt, ZeroSSL, etc.) | `ACME` | HTTP-01, DNS-01, DNS-PERSIST-01 challenges. EAB auto-fetch from ZeroSSL. Profile selection (`tlsserver`, `shortlived`). |
+| step-ca (Smallstep) | `StepCA` | JWK provisioner auth, issuance + renewal + revocation |
+| OpenSSL / Custom CA | `OpenSSL` | Shell script adapter — any CA with a CLI |
+| HashiCorp Vault PKI | `VaultPKI` | Token auth, synchronous issuance, CRL/OCSP delegated to Vault |
+| DigiCert CertCentral | `DigiCert` | Async order model, OV/EV support, PEM bundle parsing |
+| Sectigo SCM | `Sectigo` | 3-header auth, DV/OV/EV, collect-not-ready graceful handling |
+| Google Cloud CAS | `GoogleCAS` | OAuth2 service account, synchronous issuance, CA pool selection |
+| AWS ACM Private CA | `AWSACMPCA` | Synchronous issuance, configurable signing algorithm/template ARN |
+| Entrust Certificate Services | `Entrust` | mTLS client certificate auth, synchronous/approval-pending issuance |
+| GlobalSign Atlas HVCA | `GlobalSign` | mTLS + API key/secret dual auth, serial-based tracking |
+| EJBCA (Keyfactor) | `EJBCA` | Dual auth (mTLS or OAuth2), self-hosted open-source CA |
+
+**Note:** ADCS integration is handled via the Local CA's sub-CA mode — certctl operates as a subordinate CA with its signing certificate issued by ADCS. Any CA with a shell-accessible signing interface can be integrated via the OpenSSL/Custom CA connector.
 
 ### Deployment Targets
-| Target | Status | Type |
-|--------|--------|------|
-| NGINX | Implemented | `NGINX` |
-| Apache httpd | Implemented | `Apache` |
-| HAProxy | Implemented | `HAProxy` |
-| Traefik | Implemented | `Traefik` |
-| Caddy | Implemented | `Caddy` |
-| F5 BIG-IP | Interface only | `F5` |
-| Microsoft IIS | Interface only | `IIS` |
+
+| Target | Type | Notes |
+|--------|------|-------|
+| NGINX | `NGINX` | File write, config validation, reload |
+| Apache httpd | `Apache` | Separate cert/chain/key files, configtest, graceful reload |
+| HAProxy | `HAProxy` | Combined PEM file, validate, reload |
+| Traefik | `Traefik` | File provider deployment, auto-reload via filesystem watch |
+| Caddy | `Caddy` | Dual-mode: admin API hot-reload or file-based |
+| Envoy | `Envoy` | File-based with optional SDS JSON config |
+| Postfix | `Postfix` | Mail server TLS, pairs with S/MIME support |
+| Dovecot | `Dovecot` | Mail server TLS, pairs with S/MIME support |
+| Microsoft IIS | `IIS` | Local PowerShell or remote WinRM, PEM→PFX, SNI support |
+| F5 BIG-IP | `F5` | iControl REST via proxy agent, transaction-based atomic updates |
+| SSH (Agentless) | `SSH` | SFTP cert/key deployment to any Linux/Unix server |
+| Windows Certificate Store | `WinCertStore` | PowerShell Import-PfxCertificate, configurable store/location |
+| Java Keystore | `JavaKeystore` | PEM→PKCS#12→keytool pipeline, JKS and PKCS12 formats |
+| Kubernetes Secrets | `KubernetesSecrets` | `kubernetes.io/tls` Secrets, in-cluster or kubeconfig auth |
+
+### Enrollment Protocols
+
+| Protocol | Standard | Use Case |
+|----------|----------|----------|
+| EST (Enrollment over Secure Transport) | RFC 7030 | Device enrollment, WiFi/802.1X, IoT |
+| SCEP (Simple Certificate Enrollment Protocol) | RFC 8894 | MDM platforms (Jamf, Intune), network devices |
+| ACME v2 | RFC 8555 | Public CA automated issuance (Let's Encrypt, ZeroSSL) |
+| ACME ARI (Renewal Information) | RFC 9773 | CA-directed renewal timing — the CA tells you when to renew |
+
+### Standards & Revocation
+
+| Capability | Standard | Notes |
+|------------|----------|-------|
+| DER-encoded X.509 CRL | RFC 5280 | Per-issuer, signed by issuing CA, 24h validity |
+| Embedded OCSP responder | RFC 6960 | Good/revoked/unknown status per issuer |
+| S/MIME certificates | RFC 8551 | Email protection EKU, adaptive KeyUsage flags |
+| Certificate export | — | PEM (JSON/file) and PKCS#12 formats |
+| ACME DNS-PERSIST-01 | IETF draft | Standing validation record, no per-renewal DNS updates |
 
 ### Notifiers
-| Notifier | Status | Type |
-|----------|--------|------|
-| Email (SMTP) | Implemented | `Email` |
-| Webhooks | Implemented | `Webhook` |
-| Slack | Implemented | `Slack` |
-| Microsoft Teams | Implemented | `Teams` |
-| PagerDuty | Implemented | `PagerDuty` |
-| OpsGenie | Implemented | `OpsGenie` |
+
+| Notifier | Type |
+|----------|------|
+| Email (SMTP) | `Email` |
+| Webhooks | `Webhook` |
+| Slack | `Slack` |
+| Microsoft Teams | `Teams` |
+| PagerDuty | `PagerDuty` |
+| OpsGenie | `OpsGenie` |
 
 All connectors are pluggable — build your own by implementing the [connector interface](docs/connectors.md).
 
@@ -105,41 +138,57 @@ All connectors are pluggable — build your own by implementing the [connector i
 
 <table>
 <tr>
-<td><a href="docs/screenshots/v2-dashboard.png"><img src="docs/screenshots/v2-dashboard.png" width="270" alt="Dashboard"></a><br><b>Dashboard</b><br><sub>Stats, expiration heatmap, renewal trends</sub></td>
-<td><a href="docs/screenshots/v2-certificates.png"><img src="docs/screenshots/v2-certificates.png" width="270" alt="Certificates"></a><br><b>Certificates</b><br><sub>Inventory with status, owner, team filters</sub></td>
-<td><a href="docs/screenshots/v2-agents.png"><img src="docs/screenshots/v2-agents.png" width="270" alt="Agents"></a><br><b>Agents</b><br><sub>Fleet health, OS/arch, IP, version</sub></td>
+<td><a href="docs/screenshots/v2-dashboard.png"><img src="docs/screenshots/v2-dashboard.png" width="400" alt="Dashboard"></a><br><b>Dashboard</b><br><sub>Stats, expiration heatmap, renewal trends, issuance rate</sub></td>
+<td><a href="docs/screenshots/v2-certificates.png"><img src="docs/screenshots/v2-certificates.png" width="400" alt="Certificates"></a><br><b>Certificates</b><br><sub>Inventory with bulk ops, status filters, owner/team columns</sub></td>
 </tr>
 <tr>
-<td><a href="docs/screenshots/v2-fleet.png"><img src="docs/screenshots/v2-fleet.png" width="270" alt="Fleet Overview"></a><br><b>Fleet Overview</b><br><sub>OS distribution, status breakdown</sub></td>
-<td><a href="docs/screenshots/v2-jobs.png"><img src="docs/screenshots/v2-jobs.png" width="270" alt="Jobs"></a><br><b>Jobs</b><br><sub>Issuance, renewal, deployment queue</sub></td>
-<td><a href="docs/screenshots/v2-notifications.png"><img src="docs/screenshots/v2-notifications.png" width="270" alt="Notifications"></a><br><b>Notifications</b><br><sub>Expiration warnings, renewal results</sub></td>
-</tr>
-<tr>
-<td><a href="docs/screenshots/v2-policies.png"><img src="docs/screenshots/v2-policies.png" width="270" alt="Policies"></a><br><b>Policies</b><br><sub>Ownership, lifetime, renewal rules</sub></td>
-<td><a href="docs/screenshots/v2-profiles.png"><img src="docs/screenshots/v2-profiles.png" width="270" alt="Profiles"></a><br><b>Profiles</b><br><sub>Key types, max TTL, crypto constraints</sub></td>
-<td><a href="docs/screenshots/v2-issuers.png"><img src="docs/screenshots/v2-issuers.png" width="270" alt="Issuers"></a><br><b>Issuers</b><br><sub>Local CA, ACME, step-ca connectors</sub></td>
-</tr>
-<tr>
-<td><a href="docs/screenshots/v2-targets.png"><img src="docs/screenshots/v2-targets.png" width="270" alt="Targets"></a><br><b>Targets</b><br><sub>NGINX, Apache, HAProxy, Traefik, Caddy deployment</sub></td>
-<td><a href="docs/screenshots/v2-owners.png"><img src="docs/screenshots/v2-owners.png" width="270" alt="Owners"></a><br><b>Owners</b><br><sub>Cert ownership with team assignment</sub></td>
-<td><a href="docs/screenshots/v2-teams.png"><img src="docs/screenshots/v2-teams.png" width="270" alt="Teams"></a><br><b>Teams</b><br><sub>Org grouping for notification routing</sub></td>
-</tr>
-<tr>
-<td><a href="docs/screenshots/v2-agent-groups.png"><img src="docs/screenshots/v2-agent-groups.png" width="270" alt="Agent Groups"></a><br><b>Agent Groups</b><br><sub>Dynamic grouping by OS, arch, CIDR</sub></td>
-<td><a href="docs/screenshots/v2-audit-trail.png"><img src="docs/screenshots/v2-audit-trail.png" width="270" alt="Audit Trail"></a><br><b>Audit Trail</b><br><sub>Immutable log, CSV/JSON export</sub></td>
-<td><a href="docs/screenshots/v2-short-lived.png"><img src="docs/screenshots/v2-short-lived.png" width="270" alt="Short-Lived"></a><br><b>Short-Lived Creds</b><br><sub>Ephemeral certs with live TTL countdown</sub></td>
+<td><a href="docs/screenshots/v2-issuers.png"><img src="docs/screenshots/v2-issuers.png" width="400" alt="Issuers"></a><br><b>Issuers</b><br><sub>Catalog with 10 CA types, GUI config, test connection</sub></td>
+<td><a href="docs/screenshots/v2-jobs.png"><img src="docs/screenshots/v2-jobs.png" width="400" alt="Jobs"></a><br><b>Jobs</b><br><sub>Issuance, renewal, deployment queue with approval workflow</sub></td>
 </tr>
 </table>
 
+**[See all screenshots →](docs/screenshots/)**
+
+## Why certctl
+
+Certificate lifecycle tooling falls into two camps: enterprise platforms (Venafi, Keyfactor) that cost six figures and take months to deploy, or single-purpose tools (certbot, cert-manager) that handle one slice of the problem. certctl fills the gap — full lifecycle automation, self-hosted, free, CA-agnostic, and target-agnostic. If you're running certbot cron jobs, manually renewing certs, or stitching together scripts across mixed infrastructure, certctl replaces all of that.
+
+Built for **platform engineering and DevOps teams** managing 10–500+ certificates, **security and compliance teams** who need audit trails and policy enforcement for SOC 2, PCI-DSS 4.0, or NIST SP 800-57 ([compliance mapping included](docs/compliance.md)), and **small teams without enterprise budgets** who need Venafi-grade automation for a 50-server environment. For a detailed comparison, see [Why certctl?](docs/why-certctl.md)
+
+**Architecture.** Go 1.25 control plane with handler→service→repository layering, PostgreSQL 16 backend (21 tables), and a pull-only deployment model — the server never initiates outbound connections. Agents poll for work. For network appliances and agentless servers, a proxy agent in the same network zone handles deployment via the target's API (WinRM, iControl REST, SSH/SFTP). Background scheduler runs 7 loops: renewal with ARI integration (1h), job processing (30s), agent health (2m), notifications (1m), short-lived cert expiry (30s), network scanning (6h), certificate digest (24h). See [Architecture Guide](docs/architecture.md) for full system diagrams.
+
+**Security-first.** Agents generate ECDSA P-256 keys locally — private keys never touch the control plane. API key auth enforced by default with SHA-256 hashing and constant-time comparison. CORS deny-by-default. Shell injection prevention on all connector scripts. SSRF protection (reserved IP filtering) on the network scanner. Atomic idempotency guards on scheduler loops. Issuer and target credentials encrypted at rest with AES-256-GCM. Every API call recorded to an immutable audit trail with actor attribution, body hash, and latency tracking. CI runs race detection, 11 linters, and vulnerability scanning on every commit.
+
+**Key design decisions.** TEXT primary keys — human-readable prefixed IDs (`mc-api-prod`, `t-platform`, `o-alice`) so you can identify resources at a glance in logs and queries. Idempotent migrations (`IF NOT EXISTS`, `ON CONFLICT DO NOTHING`) safe for repeated execution. Dynamic configuration via GUI with AES-256-GCM encrypted credential storage and env var backward compatibility. Handlers define their own service interfaces for clean dependency inversion.
+
+## What It Does
+
+**Automated lifecycle.** Certificates renew and deploy themselves. The scheduler monitors expiration, issues through your CA, and deploys to targets — zero human intervention. ACME ARI (RFC 9773) lets the CA direct renewal timing. Ready for 47-day (SC-081v3) and 6-day (Let's Encrypt shortlived) certificate lifetimes.
+
+**Operational dashboard.** 26-page GUI covers the entire lifecycle: certificate inventory with bulk ops, deployment timeline with rollback, discovery triage, network scan management, agent fleet health, short-lived credential countdown, approval workflows, and observability metrics. Configure issuers and targets from the dashboard — no env var editing, no server restarts.
+
+**Private keys stay on your servers.** Agents generate ECDSA P-256 keys locally, submit only the CSR. The control plane never touches private keys. After deployment, agents probe the live TLS endpoint and compare SHA-256 fingerprints to confirm the right certificate is actually being served.
+
+**Discovery.** Agents scan filesystems for existing PEM/DER certificates. The network scanner probes TLS endpoints across CIDR ranges without agents. Cloud discovery finds certificates in AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager. Continuous TLS health monitoring tracks endpoint status (healthy/degraded/down/cert_mismatch) with configurable thresholds and historical probe data. All discovery modes feed into a unified triage workflow — claim, dismiss, or import what you find.
+
+**Policy engine.** Certificate profiles constrain key types, max TTL, and EKUs — with crypto policy enforcement that validates every CSR against profile rules before it reaches the issuer. MaxTTL caps are enforced per issuer connector. Approval workflows pause jobs for human review. Ownership tracking routes notifications to the right team. Agent groups match devices by OS, architecture, IP CIDR, and version.
+
+**Enrollment protocols.** EST server (RFC 7030) for device and WiFi enrollment. SCEP server (RFC 8894) for MDM platforms and network devices. S/MIME issuance with email protection EKU.
+
+**Revocation.** Single and bulk revocation (by profile, owner, agent, or issuer). DER-encoded X.509 CRL per issuer, signed by the issuing CA. Embedded OCSP responder. RFC 5280 reason codes. Short-lived certs (TTL < 1 hour) are exempt — expiry is sufficient revocation.
+
+**Audit and observability.** Immutable append-only audit trail records every lifecycle action, every API call, and every approval decision. Prometheus metrics endpoint. Scheduled certificate digest emails. Continuous endpoint health monitoring with state machine transitions and real-time alerts.
+
+**Notifications.** Slack, Teams, PagerDuty, OpsGenie, SMTP, webhooks. Routed by certificate owner. Daily digest emails with stats and expiring certs.
+
+**Multiple interfaces.** REST API (111 routes), CLI (12 commands), MCP server (80 tools for Claude, Cursor, Windsurf), Helm chart, web dashboard. Certificate export in PEM and PKCS#12.
+
+**First-run onboarding.** Wizard guides you through connecting a CA, deploying an agent, and issuing your first certificate. Or start with the pre-populated demo — 32 certificates, 10 issuers, 180 days of history.
+
+For the complete capability breakdown, see the [Feature Inventory](docs/features.md).
+
 ## Quick Start
 
-### Docker Pull
-
-```bash
-docker pull shankar0123.docker.scarf.sh/certctl-server
-docker pull shankar0123.docker.scarf.sh/certctl-agent
-```
-
 ### Docker Compose (Recommended)
 
 ```bash
@@ -148,247 +197,127 @@ cd certctl
 docker compose -f deploy/docker-compose.yml up -d --build
 ```
 
-Wait ~30 seconds, then open **http://localhost:8443** in your browser.
+Wait ~30 seconds, then open **http://localhost:8443** in your browser. The onboarding wizard walks you through connecting a CA, deploying an agent, and issuing your first certificate.
 
-The dashboard comes pre-loaded with 15 demo certificates, 5 agents, policy rules, audit events, and notifications — a realistic snapshot of a certificate inventory so you can explore immediately.
+**Want a pre-populated demo instead?** Add the demo override to see 32 certificates across 10 issuers, 8 agents, and 180 days of realistic history:
+
+```bash
+docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.demo.yml up -d --build
+```
+
+The `deploy/` directory has four compose files: `docker-compose.yml` (base platform), `docker-compose.demo.yml` (demo data overlay), `docker-compose.dev.yml` (PgAdmin + debug logging), and `docker-compose.test.yml` (standalone integration tests with real CA backends). See the [Docker Compose Environments Guide](deploy/ENVIRONMENTS.md) for a service-by-service walkthrough, or the [Quick Start](docs/quickstart.md#docker-compose-environments) for a summary.
 
-Verify the API:
 ```bash
 curl http://localhost:8443/health
 # {"status":"healthy"}
-
-curl -s http://localhost:8443/api/v1/certificates | jq '.total'
-# 15
 ```
 
-### Manual Build
+### Agent Install (One-Liner)
 
 ```bash
-# Prerequisites: Go 1.25+, PostgreSQL 16+
-go mod download
-make build
-
-# Set up database
-export CERTCTL_DATABASE_URL="postgres://certctl:certctl@localhost:5432/certctl?sslmode=disable"
-export CERTCTL_AUTH_TYPE=none
-make migrate-up
-
-# Start server
-./bin/server
-
-# Start agent (separate terminal)
-export CERTCTL_SERVER_URL=http://localhost:8443
-export CERTCTL_API_KEY=change-me-in-production
-export CERTCTL_AGENT_NAME=local-agent
-export CERTCTL_AGENT_ID=agent-local-01
-./bin/agent --agent-id=agent-local-01
+curl -sSL https://raw.githubusercontent.com/shankar0123/certctl/master/install-agent.sh | bash
 ```
 
-## Architecture
+Detects your OS and architecture, downloads the binary, configures systemd (Linux) or launchd (macOS), and starts the agent. See [install-agent.sh](install-agent.sh) for details.
 
-**Control plane** (Go 1.25 net/http) → **PostgreSQL 16** (21 tables, TEXT primary keys) → **Agents** (key generation, CSR submission, cert deployment). Background scheduler runs 6 loops: renewal checks (1h), job processing (30s), agent health (2m), notifications (1m), short-lived cert expiry (30s), network scanning (6h). See [Architecture Guide](docs/architecture.md) for full system diagrams and data flow.
-
-### Key Design Decisions
-
-- **Private keys isolated from the control plane.** Agents generate ECDSA P-256 keys locally and submit CSRs (public key only). The server signs the CSR and returns the certificate — private keys never touch the control plane. Server-side keygen is available via `CERTCTL_KEYGEN_MODE=server` for demo/development only.
-- **TEXT primary keys, not UUIDs.** IDs are human-readable prefixed strings (`mc-api-prod`, `t-platform`, `o-alice`) so you can identify resource types at a glance in logs and queries.
-- **Handler → Service → Repository layering.** Handlers define their own service interfaces for clean dependency inversion. No global service singletons.
-- **Idempotent migrations.** All schema uses `IF NOT EXISTS` and seed data uses `ON CONFLICT (id) DO NOTHING`, safe for repeated execution.
-
-PostgreSQL 16 with 21 tables covering certificates, versions, policies, issuers, targets, agents, jobs, teams, owners, profiles, agent groups, revocations, discovery, network scans, and audit events. See the [Architecture Guide](docs/architecture.md) for the full schema.
-
-## Configuration
-
-All environment variables use the `CERTCTL_` prefix. Full reference below (39 variables across server, agent, and connector config).
-
-### Server — Core
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `CERTCTL_SERVER_HOST` | `127.0.0.1` | Server bind address |
-| `CERTCTL_SERVER_PORT` | `8080` | Server listen port (1–65535) |
-| `CERTCTL_DATABASE_URL` | `postgres://localhost/certctl` | PostgreSQL connection string (required) |
-| `CERTCTL_DATABASE_MAX_CONNS` | `25` | PostgreSQL connection pool size (min 1) |
-| `CERTCTL_DATABASE_MIGRATIONS_PATH` | `./migrations` | Path to migration SQL files |
-| `CERTCTL_MAX_BODY_SIZE` | `1048576` | Max HTTP request body in bytes (default 1MB) |
-| `CERTCTL_LOG_LEVEL` | `info` | Log verbosity: `debug`, `info`, `warn`, `error` |
-| `CERTCTL_LOG_FORMAT` | `json` | Log format: `json` (structured) or `text` (human-readable) |
-
-### Server — Auth, CORS, Rate Limiting
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `CERTCTL_AUTH_TYPE` | `api-key` | Auth mode: `api-key`, `jwt`, or `none` (demo only) |
-| `CERTCTL_AUTH_SECRET` | — | Required for `api-key` and `jwt` auth types |
-| `CERTCTL_CORS_ORIGINS` | *(empty = deny all)* | Comma-separated allowed origins, or `*` for dev |
-| `CERTCTL_RATE_LIMIT_ENABLED` | `true` | Enable token bucket rate limiting |
-| `CERTCTL_RATE_LIMIT_RPS` | `50` | Requests per second per client |
-| `CERTCTL_RATE_LIMIT_BURST` | `100` | Max burst size |
-| `CERTCTL_KEYGEN_MODE` | `agent` | Key generation: `agent` (production) or `server` (demo only) |
-
-### Server — Scheduler
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `CERTCTL_SCHEDULER_RENEWAL_CHECK_INTERVAL` | `1h` | How often to check expiring certs (min 1m) |
-| `CERTCTL_SCHEDULER_JOB_PROCESSOR_INTERVAL` | `30s` | How often to process pending jobs (min 1s) |
-| `CERTCTL_SCHEDULER_AGENT_HEALTH_CHECK_INTERVAL` | `2m` | Agent heartbeat check frequency (min 1s) |
-| `CERTCTL_SCHEDULER_NOTIFICATION_PROCESS_INTERVAL` | `1m` | Notification send frequency (min 1s) |
-
-### Server — Sub-CA Mode
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `CERTCTL_CA_CERT_PATH` | — | PEM-encoded CA certificate for sub-CA mode |
-| `CERTCTL_CA_KEY_PATH` | — | PEM-encoded CA private key (RSA, ECDSA, PKCS#8) |
-
-### Server — Feature Flags
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `CERTCTL_EST_ENABLED` | `false` | Enable RFC 7030 EST enrollment endpoints |
-| `CERTCTL_EST_ISSUER_ID` | `iss-local` | Which issuer processes EST enrollments |
-| `CERTCTL_EST_PROFILE_ID` | — | Constrain EST to a specific certificate profile |
-| `CERTCTL_NETWORK_SCAN_ENABLED` | `false` | Enable server-side TLS network scanning |
-| `CERTCTL_NETWORK_SCAN_INTERVAL` | `6h` | How often scheduled scans run |
-| `CERTCTL_VERIFY_DEPLOYMENT` | `true` | TLS verification after certificate deployment |
-| `CERTCTL_VERIFY_TIMEOUT` | `10s` | TLS probe timeout |
-| `CERTCTL_VERIFY_DELAY` | `2s` | Delay before verification probe |
-
-### Server — Notification Connectors
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `CERTCTL_SLACK_WEBHOOK_URL` | — | Slack incoming webhook URL (enables Slack) |
-| `CERTCTL_SLACK_CHANNEL` | — | Override default webhook channel |
-| `CERTCTL_SLACK_USERNAME` | `certctl` | Bot display name |
-| `CERTCTL_TEAMS_WEBHOOK_URL` | — | Microsoft Teams webhook URL (enables Teams) |
-| `CERTCTL_PAGERDUTY_ROUTING_KEY` | — | PagerDuty Events API v2 key (enables PagerDuty) |
-| `CERTCTL_PAGERDUTY_SEVERITY` | `warning` | Event severity: `info`, `warning`, `error`, `critical` |
-| `CERTCTL_OPSGENIE_API_KEY` | — | OpsGenie Alert API key (enables OpsGenie) |
-| `CERTCTL_OPSGENIE_PRIORITY` | `P3` | Alert priority: `P1`–`P5` |
-
-### Agent
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `CERTCTL_SERVER_URL` | `http://localhost:8080` | Control plane URL |
-| `CERTCTL_API_KEY` | — | Agent API key for authentication |
-| `CERTCTL_AGENT_ID` | — | Registered agent ID (required) |
-| `CERTCTL_KEY_DIR` | `/var/lib/certctl/keys` | Private key storage directory (0600 perms) |
-| `CERTCTL_DISCOVERY_DIRS` | — | Directories to scan for existing certs (comma-separated) |
-
-Docker Compose overrides for the demo stack are in `deploy/docker-compose.yml`.
-
-## Development
+### Helm Chart (Kubernetes)
 
 ```bash
-# Install dev tools (golangci-lint, migrate CLI, air)
-make install-tools
-
-# Run tests
-make test
-
-# Run tests with race detection (same as CI)
-go test -race ./internal/service/... ./internal/api/handler/... ./internal/api/middleware/... ./internal/scheduler/... ./internal/connector/... ./internal/domain/... ./internal/validation/...
-
-# Run with coverage
-make test-coverage
-
-# Lint (runs golangci-lint with project config)
-make lint
-
-# Vulnerability scan
-govulncheck ./...
-
-# Format
-make fmt
+helm install certctl deploy/helm/certctl/ \
+  --set server.apiKey=your-api-key \
+  --set postgres.password=your-db-password
 ```
 
-### CI Pipeline
+Production-ready chart with Server Deployment, PostgreSQL StatefulSet, Agent DaemonSet, health probes, security contexts (non-root, read-only rootfs), and optional Ingress. See [values.yaml](deploy/helm/certctl/values.yaml) for all configuration options.
 
-Every push and PR runs: `go vet`, `go test -race` (race detection), `golangci-lint` (11 linters including gosec and bodyclose), `govulncheck` (dependency CVE scanning), and per-layer coverage thresholds (service 60%, handler 60%, domain 40%, middleware 50%). Frontend CI runs TypeScript type checking, Vitest tests, and Vite production build. See `.github/workflows/ci.yml` for details.
-
-### Docker Compose
+### Docker Pull
 
 ```bash
-make docker-up          # Start stack (server + postgres + agent)
-make docker-down        # Stop stack
-make docker-logs-server # Server logs
-make docker-logs-agent  # Agent logs
-make docker-clean       # Stop + remove volumes
+docker pull shankar0123.docker.scarf.sh/certctl-server
+docker pull shankar0123.docker.scarf.sh/certctl-agent
 ```
 
-## Security
+## Verifying this release
 
-### Private Key Management
-- **Agent keygen mode (default)**: Agents generate ECDSA P-256 keys locally and store them with 0600 permissions in `CERTCTL_KEY_DIR` (default `/var/lib/certctl/keys`). Only the CSR (public key) is sent to the control plane. Private keys never leave agent infrastructure.
-- **Server keygen mode (demo only)**: Set `CERTCTL_KEYGEN_MODE=server` for development/demo with Local CA. The control plane generates RSA-2048 keys server-side. A log warning is emitted at startup.
+Every `v*` tag publishes signed, attested release artefacts. Binaries
+(`certctl-agent`, `certctl-server`, `certctl-cli`, `certctl-mcp-server` for
+`linux|darwin × amd64|arm64`) ship alongside a `checksums.txt`, per-binary
+SPDX-JSON SBOMs, Cosign signatures, and SLSA Level 3 provenance. Container
+images on `ghcr.io/shankar0123/certctl-{server,agent}` are built with
+`docker/build-push-action` `provenance: mode=max` + `sbom: true` and are
+additionally signed with Cosign at the image digest.
 
-### Authentication
-- Agent-to-server: API key (registered at agent creation)
-- API key and JWT auth types supported; `none` for demo/development
-- Auth type and secret configured via `CERTCTL_AUTH_TYPE` and `CERTCTL_AUTH_SECRET`
+All signatures use Cosign keyless OIDC; the signing identity is the
+release workflow running on a signed tag.
 
-### CORS
-- **Deny-by-default**: Empty `CERTCTL_CORS_ORIGINS` blocks all cross-origin requests. Operators must explicitly list allowed origins (comma-separated) or set `*` for development.
+**1. Verify SHA-256 checksums:**
 
-### Input Validation
-- Shell command injection prevention on all connector scripts (strict character whitelist, no metacharacters)
-- RFC 1123 domain name validation, base64url ACME token validation
-- SSRF protection in network scanner (loopback, link-local, multicast, broadcast ranges filtered)
-
-### Concurrency Safety
-- Scheduler loops protected by `sync/atomic.Bool` idempotency guards — duplicate ticks are skipped
-- Graceful shutdown waits up to 30 seconds for in-flight work before database close
-
-### Audit Trail
-- Immutable append-only log in PostgreSQL (`audit_events` table)
-- Every lifecycle action attributed to an actor with timestamp and resource reference
-- No update or delete operations on audit records
-- Every API call recorded to audit trail with method, path, actor, SHA-256 body hash, response status, and latency
-
-## API Overview
-
-93 endpoints under `/api/v1/` + `/.well-known/est/`, all returning JSON. List endpoints support pagination, sparse field selection (`?fields=`), sort (`?sort=-notAfter`), time-range filters, and cursor-based pagination. Full request/response schemas in the [OpenAPI 3.1 spec](api/openapi.yaml).
-
-### Key Endpoints
-```
-# Certificate lifecycle
-GET    /api/v1/certificates              List (filter, sort, cursor, sparse fields)
-POST   /api/v1/certificates/{id}/renew   Trigger renewal → 202 Accepted
-POST   /api/v1/certificates/{id}/revoke  Revoke with RFC 5280 reason code
-GET    /api/v1/crl/{issuer_id}           DER-encoded X.509 CRL
-GET    /api/v1/ocsp/{issuer_id}/{serial} OCSP responder (good/revoked/unknown)
-
-# Agent operations
-POST   /api/v1/agents/{id}/csr           Submit CSR for issuance
-GET    /api/v1/agents/{id}/work          Poll for pending deployment jobs
-POST   /api/v1/agents/{id}/discoveries   Submit certificate discovery scan results
-
-# Discovery & network scanning
-GET    /api/v1/discovered-certificates   List discovered certs (?agent_id, ?status)
-POST   /api/v1/discovered-certificates/{id}/claim  Link to managed cert
-POST   /api/v1/network-scan-targets/{id}/scan      Trigger immediate TLS scan
-
-# Jobs & approval
-POST   /api/v1/jobs/{id}/approve         Approve interactive renewal
-POST   /api/v1/jobs/{id}/reject          Reject interactive renewal
-
-# Post-deployment verification
-POST   /api/v1/jobs/{id}/verify          Submit TLS verification result
-GET    /api/v1/jobs/{id}/verification    Get verification status
-
-# Observability
-GET    /api/v1/metrics/prometheus         Prometheus exposition format
-GET    /api/v1/stats/summary             Dashboard summary
-
-# EST enrollment (RFC 7030)
-POST   /.well-known/est/simpleenroll     Device certificate enrollment
-GET    /.well-known/est/cacerts          CA certificate chain (PKCS#7)
+```bash
+sha256sum -c checksums.txt
 ```
 
-Full CRUD is available for certificates, agents, issuers, targets, teams, owners, policies, profiles, agent groups, notifications, and audit events. See the [OpenAPI spec](api/openapi.yaml) or [Feature Inventory](docs/features.md) for the complete endpoint reference.
+**2. Verify the Cosign signature on `checksums.txt`:**
+
+```bash
+cosign verify-blob \
+  --bundle checksums.txt.sigstore.json \
+  --certificate-identity-regexp '^https://github\.com/shankar0123/certctl/\.github/workflows/release\.yml@refs/tags/' \
+  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+  checksums.txt
+```
+
+Every individual binary ships with its own `.sigstore.json` bundle
+(unified Sigstore bundle containing signature, certificate chain, and
+Rekor inclusion proof). Swap `checksums.txt` for any binary name and
+point `--bundle` at the matching `<binary>.sigstore.json` to verify it
+directly.
+
+**3. Verify SLSA Level 3 provenance on a binary:**
+
+```bash
+slsa-verifier verify-artifact \
+  --provenance-path multiple.intoto.jsonl \
+  --source-uri github.com/shankar0123/certctl \
+  --source-tag v2.1.0 \
+  certctl-agent-linux-amd64
+```
+
+**4. Verify a container image signature and its SBOM / provenance attestations:**
+
+```bash
+IMAGE=ghcr.io/shankar0123/certctl-server:v2.1.0
+
+cosign verify \
+  --certificate-identity-regexp '^https://github\.com/shankar0123/certctl/\.github/workflows/release\.yml@refs/tags/' \
+  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+  "$IMAGE"
+
+# SBOM attestation (SPDX-JSON, emitted by docker/build-push-action)
+cosign verify-attestation --type spdxjson \
+  --certificate-identity-regexp '^https://github\.com/shankar0123/certctl/' \
+  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+  "$IMAGE"
+
+# SLSA provenance attestation (docker/build-push-action `provenance: mode=max`)
+cosign verify-attestation --type slsaprovenance \
+  --certificate-identity-regexp '^https://github\.com/shankar0123/certctl/' \
+  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
+  "$IMAGE"
+```
+
+## Examples
+
+Pick the scenario closest to your setup and have it running in 2 minutes.
+
+| Example | Scenario |
+|---------|----------|
+| [`examples/acme-nginx/`](examples/acme-nginx/) | Let's Encrypt + NGINX, HTTP-01 challenges |
+| [`examples/acme-wildcard-dns01/`](examples/acme-wildcard-dns01/) | Wildcard certs via DNS-01 (Cloudflare hook included) |
+| [`examples/private-ca-traefik/`](examples/private-ca-traefik/) | Local CA (self-signed or sub-CA) + Traefik file provider |
+| [`examples/step-ca-haproxy/`](examples/step-ca-haproxy/) | Smallstep step-ca + HAProxy combined PEM |
+| [`examples/multi-issuer/`](examples/multi-issuer/) | ACME for public + Local CA for internal, one dashboard |
+
+Each directory contains a `docker-compose.yml` and a `README.md` explaining the scenario, prerequisites, and customization.
 
 ## CLI
 
@@ -400,38 +329,26 @@ go install github.com/shankar0123/certctl/cmd/cli@latest
 export CERTCTL_SERVER_URL=http://localhost:8443
 export CERTCTL_API_KEY=your-api-key
 
-# Certificate commands
+# Usage
 certctl-cli certs list                    # List all certificates
-certctl-cli certs get mc-api-prod         # Get certificate details
 certctl-cli certs renew mc-api-prod       # Trigger renewal
 certctl-cli certs revoke mc-api-prod --reason keyCompromise
-
-# Agent and job commands
 certctl-cli agents list                   # List registered agents
 certctl-cli jobs list                     # List jobs
-certctl-cli jobs cancel job-123           # Cancel a pending job
-
-# Operations
 certctl-cli status                        # Server health + summary stats
 certctl-cli import certs.pem              # Bulk import from PEM file
-
-# Output formats
 certctl-cli certs list --format json      # JSON output (default: table)
 ```
 
 ## MCP Server (AI Integration)
 
-certctl ships a standalone MCP (Model Context Protocol) server that exposes all 78 API endpoints as tools for AI assistants — Claude, Cursor, Windsurf, OpenClaw, VS Code Copilot, and any MCP-compatible client.
+certctl ships a standalone MCP (Model Context Protocol) server that exposes all 80 API endpoints as tools for AI assistants — Claude, Cursor, Windsurf, OpenClaw, VS Code Copilot, and any MCP-compatible client.
 
 ```bash
-# Install
+# Install and run
 go install github.com/shankar0123/certctl/cmd/mcp-server@latest
-
-# Configure
 export CERTCTL_SERVER_URL=http://localhost:8443
 export CERTCTL_API_KEY=your-api-key
-
-# Run (stdio transport — add to your AI client config)
 mcp-server
 ```
 
@@ -450,46 +367,38 @@ mcp-server
 }
 ```
 
+## Development
+
+```bash
+make build              # Build server + agent binaries
+make test               # Run tests
+make lint               # golangci-lint (11 linters)
+govulncheck ./...       # Vulnerability scan
+make docker-up          # Start Docker Compose stack
+```
+
+CI runs on every push: `go vet`, `go test -race`, `golangci-lint`, `govulncheck`, and per-layer coverage thresholds (service 55%, handler 60%, domain 40%, middleware 30%). Frontend CI runs TypeScript type checking, Vitest tests, and Vite production build. 1,668 Go test functions with 625+ subtests, plus frontend test suite.
+
 ## Roadmap
 
-### V1 (v1.0.0)
+### V1 (v1.0.0) — Shipped
 Core lifecycle management — Local CA + ACME v2 issuers, NGINX target connector, agent-side key generation, API auth + rate limiting, React dashboard, CI pipeline with coverage gates, Docker images on GHCR.
 
-### V2: Operational Maturity
-
-18 milestones complete, 1100+ tests. See the [Feature Inventory](docs/features.md) for details on every capability.
-
-**What shipped (all ✅):**
-
-- **Issuers** — Sub-CA mode (enterprise root chains), ACME DNS-01 + DNS-PERSIST-01 (wildcard certs, any DNS provider), step-ca (native /sign API), OpenSSL/Custom CA (script-based signing)
-- **Revocation** — RFC 5280 reason codes, DER-encoded X.509 CRL, embedded OCSP responder, short-lived cert exemption
-- **Profiles + Ownership** — certificate profiles (key types, max TTL, crypto constraints), ownership tracking (owners + teams), dynamic agent groups, interactive renewal approval
-- **GUI Operations** — bulk renew/revoke/reassign, deployment timeline, inline policy editor, target wizard, audit export (CSV/JSON), short-lived credentials view
-- **Discovery** — filesystem scanning (PEM/DER) + network TLS scanning (CIDR ranges), triage workflow (claim/dismiss), network scan target management
-- **Observability** — Prometheus + JSON metrics, 5 stats API endpoints, dashboard charts (heatmap, trends, distribution), agent fleet overview, structured logging
-- **EST Server** (RFC 7030) — device/WiFi certificate enrollment, PKCS#7 wire format, configurable issuer + profile binding
-- **MCP Server** — 78 API operations as AI tools for Claude, Cursor, and any MCP-compatible client
-- **CLI** — 12 subcommands (list/get/renew/revoke certs, agents, jobs, import, status), JSON/table output
-- **Notifications** — Slack, Microsoft Teams, PagerDuty, OpsGenie connectors
-- **API Enhancements** — sparse fields, sort, time-range filters, cursor pagination, immutable API audit logging
-- **Compliance Mapping** — SOC 2 Type II, PCI-DSS 4.0, NIST SP 800-57 alignment guides
-
-- **Post-Deployment TLS Verification** — agent-side TLS probe confirms the target is serving the correct certificate by SHA-256 fingerprint match
-- **Traefik + Caddy Targets** — Traefik (file provider, auto-reload) and Caddy (Admin API hot-reload or file-based)
-
-**Coming next:**
-
-- **Certificate Export** (v2.1.x) — single-cert download in PFX/PKCS12, DER, and PEM formats
-- **S/MIME Support** (v2.2.x) — profile EKU constraints for S/MIME (emailProtection), code signing, and custom EKUs
+### V2: Operational Maturity — Shipped
+30+ milestones shipping enterprise-grade features for free. Sub-CA mode, ACME DNS-01/DNS-PERSIST-01/EAB/ARI (RFC 9773)/profile selection, step-ca, Vault PKI, DigiCert CertCentral, Sectigo SCM, Google CAS, AWS ACM PCA, Entrust, GlobalSign, EJBCA, OpenSSL/Custom CA issuers. NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, IIS (WinRM), F5 BIG-IP, SSH, Windows Certificate Store, Java Keystore, Kubernetes Secrets targets. EST server (RFC 7030) and SCEP server (RFC 8894) enrollment protocols. RFC 5280 revocation with DER CRL + embedded OCSP responder. Certificate profiles, ownership tracking, team assignment, agent groups, interactive approval workflows. Filesystem, network, and cloud secret manager (AWS SM, Azure KV, GCP SM) certificate discovery with triage GUI. Dynamic issuer/target configuration via GUI with AES-256-GCM encrypted storage. First-run onboarding wizard. Post-deployment TLS verification. Certificate export (PEM/PKCS#12). S/MIME support. Prometheus metrics. Scheduled certificate digest emails. Slack, Teams, PagerDuty, OpsGenie, SMTP notifications. MCP server (80 tools), CLI (12 commands), Helm chart. Compliance mapping (SOC 2, PCI-DSS 4.0, NIST SP 800-57). 5 turnkey deployment examples. Agent install script. Migration guides from certbot, acme.sh, and cert-manager. See the [Feature Inventory](docs/features.md) for details.
 
 ### V3: certctl Pro
+Enterprise capabilities for larger deployments are available in the commercial tier.
 
-Team access controls, identity provider integration, enterprise deployment targets, compliance and risk scoring, advanced fleet operations, event-driven architecture, advanced search, real-time operational views, and premium CA integrations.
-
-### V4+: Cloud, Scale & Passive Discovery
-Passive network discovery (TLS listener), Kubernetes integration (cert-manager external issuer, Secrets target), cloud infrastructure targets (AWS ALB/ACM, Azure Key Vault), extended CA support (Vault PKI, Google CAS, EJBCA), and platform-scale features (Terraform provider, multi-tenancy, HSM support).
+### V4+: Cloud & Scale
+Kubernetes cert-manager external issuer, cloud infrastructure targets, extended CA support, and platform-scale features.
 
 ## License
 
-Certctl is licensed under the [Business Source License 1.1](LICENSE). The source code is publicly available and free to use, modify, and self-host. The one restriction: you may not offer certctl as a managed/hosted certificate management service to third parties.
+Certctl is licensed under the [Business Source License 1.1](LICENSE). The source code is publicly available and free to use, modify, and self-host. The one restriction: you may not use certctl's certificate management functionality as part of a commercial offering to third parties, whether hosted, managed, embedded, bundled, or integrated. The BSL 1.1 license converts automatically to Apache 2.0 on March 14, 2033.
 
+For licensing inquiries: certctl@proton.me
+
+---
+
+If certctl solves a problem you have, [star the repo](https://github.com/shankar0123/certctl) to help others find it. Questions, bugs, or feature requests — [open an issue](https://github.com/shankar0123/certctl/issues).

cmd/agent/main.go

@@ -29,7 +29,13 @@ import (
 	"github.com/shankar0123/certctl/internal/connector/target"
 	"github.com/shankar0123/certctl/internal/connector/target/apache"
 	"github.com/shankar0123/certctl/internal/connector/target/caddy"
+	"github.com/shankar0123/certctl/internal/connector/target/envoy"
+	pf "github.com/shankar0123/certctl/internal/connector/target/postfix"
+	sshconn "github.com/shankar0123/certctl/internal/connector/target/ssh"
 	"github.com/shankar0123/certctl/internal/connector/target/f5"
+	jks "github.com/shankar0123/certctl/internal/connector/target/javakeystore"
+	k8s "github.com/shankar0123/certctl/internal/connector/target/k8ssecret"
+	wcs "github.com/shankar0123/certctl/internal/connector/target/wincertstore"
 	"github.com/shankar0123/certctl/internal/connector/target/haproxy"
 	"github.com/shankar0123/certctl/internal/connector/target/iis"
 	"github.com/shankar0123/certctl/internal/connector/target/nginx"
@@ -344,11 +350,23 @@ func (a *Agent) executeCSRJob(ctx context.Context, job JobItem) {
 	}
 
 	// Step 3: Create CSR with common name and SANs
+	// Split SANs into DNS names and email addresses for proper CSR encoding
+	var dnsNames []string
+	var emailAddresses []string
+	for _, san := range job.SANs {
+		if strings.Contains(san, "@") {
+			emailAddresses = append(emailAddresses, san)
+		} else {
+			dnsNames = append(dnsNames, san)
+		}
+	}
+
 	csrTemplate := &x509.CertificateRequest{
 		Subject: pkix.Name{
 			CommonName: job.CommonName,
 		},
-		DNSNames: job.SANs,
+		DNSNames:       dnsNames,
+		EmailAddresses: emailAddresses,
 	}
 
 	csrDER, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, privKey)
@@ -571,7 +589,11 @@ func (a *Agent) createTargetConnector(targetType string, configJSON json.RawMess
 				return nil, fmt.Errorf("invalid F5 config: %w", err)
 			}
 		}
-		return f5.New(&cfg, a.logger), nil
+		conn, err := f5.New(&cfg, a.logger)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create F5 connector: %w", err)
+		}
+		return conn, nil
 
 	case "IIS":
 		var cfg iis.Config
@@ -580,7 +602,7 @@ func (a *Agent) createTargetConnector(targetType string, configJSON json.RawMess
 				return nil, fmt.Errorf("invalid IIS config: %w", err)
 			}
 		}
-		return iis.New(&cfg, a.logger), nil
+		return iis.New(&cfg, a.logger)
 
 	case "Traefik":
 		var cfg traefik.Config
@@ -600,6 +622,71 @@ func (a *Agent) createTargetConnector(targetType string, configJSON json.RawMess
 		}
 		return caddy.New(&cfg, a.logger), nil
 
+	case "Envoy":
+		var cfg envoy.Config
+		if len(configJSON) > 0 {
+			if err := json.Unmarshal(configJSON, &cfg); err != nil {
+				return nil, fmt.Errorf("invalid Envoy config: %w", err)
+			}
+		}
+		return envoy.New(&cfg, a.logger), nil
+
+	case "Postfix":
+		var cfg pf.Config
+		cfg.Mode = "postfix"
+		if len(configJSON) > 0 {
+			if err := json.Unmarshal(configJSON, &cfg); err != nil {
+				return nil, fmt.Errorf("invalid Postfix config: %w", err)
+			}
+		}
+		return pf.New(&cfg, a.logger), nil
+
+	case "Dovecot":
+		var cfg pf.Config
+		cfg.Mode = "dovecot"
+		if len(configJSON) > 0 {
+			if err := json.Unmarshal(configJSON, &cfg); err != nil {
+				return nil, fmt.Errorf("invalid Dovecot config: %w", err)
+			}
+		}
+		return pf.New(&cfg, a.logger), nil
+
+	case "SSH":
+		var cfg sshconn.Config
+		if len(configJSON) > 0 {
+			if err := json.Unmarshal(configJSON, &cfg); err != nil {
+				return nil, fmt.Errorf("invalid SSH config: %w", err)
+			}
+		}
+		return sshconn.New(&cfg, a.logger)
+
+	case "WinCertStore":
+		var cfg wcs.Config
+		if len(configJSON) > 0 {
+			if err := json.Unmarshal(configJSON, &cfg); err != nil {
+				return nil, fmt.Errorf("invalid WinCertStore config: %w", err)
+			}
+		}
+		return wcs.New(&cfg, a.logger)
+
+	case "JavaKeystore":
+		var cfg jks.Config
+		if len(configJSON) > 0 {
+			if err := json.Unmarshal(configJSON, &cfg); err != nil {
+				return nil, fmt.Errorf("invalid JavaKeystore config: %w", err)
+			}
+		}
+		return jks.New(&cfg, a.logger), nil
+
+	case "KubernetesSecrets":
+		var cfg k8s.Config
+		if len(configJSON) > 0 {
+			if err := json.Unmarshal(configJSON, &cfg); err != nil {
+				return nil, fmt.Errorf("invalid KubernetesSecrets config: %w", err)
+			}
+		}
+		return k8s.New(&cfg, a.logger)
+
 	default:
 		return nil, fmt.Errorf("unsupported target type: %s", targetType)
 	}

cmd/cli/main.go

@@ -35,6 +35,8 @@ Commands:
   jobs cancel ID   Cancel a pending job
 
   import FILE      Bulk import certificates from PEM file(s)
+                   Required: --owner-id, --team-id, --renewal-policy-id, --issuer-id
+                   Optional: --name-template (default {cn}), --environment (default imported)
 
   status           Show server health + summary stats
   version          Show CLI version
@@ -130,6 +132,8 @@ func handleCerts(client *cli.Client, args []string) error {
 			reason = subArgs[2]
 		}
 		return client.RevokeCertificate(id, reason)
+	case "bulk-revoke":
+		return client.BulkRevokeCertificates(subArgs)
 	default:
 		fmt.Fprintf(os.Stderr, "unknown subcommand: certs %s\n", subcommand)
 		return nil

cmd/server/main.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/signal"
 	"strconv"
+	"strings"
 	"syscall"
 	"time"
 
@@ -17,10 +18,10 @@ import (
 	"github.com/shankar0123/certctl/internal/api/router"
 	"github.com/shankar0123/certctl/internal/config"
 	"github.com/shankar0123/certctl/internal/domain"
-	acmeissuer "github.com/shankar0123/certctl/internal/connector/issuer/acme"
-	"github.com/shankar0123/certctl/internal/connector/issuer/local"
-	opensslissuer "github.com/shankar0123/certctl/internal/connector/issuer/openssl"
-	stepcaissuer "github.com/shankar0123/certctl/internal/connector/issuer/stepca"
+	discoveryawssm "github.com/shankar0123/certctl/internal/connector/discovery/awssm"
+	discoveryazurekv "github.com/shankar0123/certctl/internal/connector/discovery/azurekv"
+	discoverygcpsm "github.com/shankar0123/certctl/internal/connector/discovery/gcpsm"
+	notifyemail "github.com/shankar0123/certctl/internal/connector/notifier/email"
 	notifyopsgenie "github.com/shankar0123/certctl/internal/connector/notifier/opsgenie"
 	notifypagerduty "github.com/shankar0123/certctl/internal/connector/notifier/pagerduty"
 	notifyslack "github.com/shankar0123/certctl/internal/connector/notifier/slack"
@@ -44,7 +45,7 @@ func main() {
 	}))
 
 	logger.Info("certctl server starting",
-		"version", "0.1.0",
+		"version", "2.0.9",
 		"server_host", cfg.Server.Host,
 		"server_port", cfg.Server.Port)
 
@@ -80,71 +81,64 @@ func main() {
 	ownerRepo := postgres.NewOwnerRepository(db)
 	logger.Info("initialized all repositories")
 
-	// Initialize Local CA issuer connector.
-	// In sub-CA mode (CERTCTL_CA_CERT_PATH + CERTCTL_CA_KEY_PATH set), loads a pre-signed
-	// CA cert+key from disk. All issued certs chain to the upstream root (e.g., ADCS).
-	// Otherwise, generates an ephemeral self-signed CA for development/demo.
-	localCAConfig := &local.Config{}
-	if cfg.CA.CertPath != "" && cfg.CA.KeyPath != "" {
-		localCAConfig.CACertPath = cfg.CA.CertPath
-		localCAConfig.CAKeyPath = cfg.CA.KeyPath
-		logger.Info("Local CA configured in sub-CA mode",
-			"cert_path", cfg.CA.CertPath,
-			"key_path", cfg.CA.KeyPath)
+	// Initialize dynamic issuer registry.
+	// Issuers are loaded from the database (with AES-256-GCM encrypted config).
+	// On first boot with an empty database, env var issuers are seeded automatically.
+	//
+	// M-8 (CWE-916 / CWE-329): the encryption passphrase is passed as a raw
+	// string into IssuerService / TargetService / IssuerRegistry. Each call to
+	// crypto.EncryptIfKeySet generates a fresh 16-byte PBKDF2 salt and emits a
+	// v2 blob (magic 0x02 || salt || nonce || sealed). Decryption auto-detects
+	// v1 legacy blobs (no magic) and falls back to the fixed v1 salt for
+	// backward compatibility; v1 blobs transparently upgrade to v2 on next
+	// write. DO NOT pre-derive the key here with crypto.DeriveKey — that was
+	// the v1 fixed-salt behaviour that M-8 removes.
+	encryptionKey := cfg.Encryption.ConfigEncryptionKey
+	if encryptionKey != "" {
+		logger.Info("config encryption enabled (AES-256-GCM, per-ciphertext PBKDF2 salt)")
 	} else {
-		logger.Info("Local CA configured in self-signed mode (ephemeral)")
+		// C-2 fix: fail closed at startup when database-sourced issuer or target
+		// rows exist without a configured encryption key. Previously the server
+		// would emit a one-line warning and silently persist new GUI-created
+		// configs as plaintext (CWE-311). Refuse to start instead: the operator
+		// must either configure CERTCTL_CONFIG_ENCRYPTION_KEY or remove the
+		// vulnerable rows before the control plane can boot.
+		ctx := context.Background()
+		dbIssuers, ierr := issuerRepo.List(ctx)
+		if ierr != nil {
+			logger.Error("startup check: failed to list issuers", "error", ierr)
+			os.Exit(1)
+		}
+		dbTargets, terr := targetRepo.List(ctx)
+		if terr != nil {
+			logger.Error("startup check: failed to list targets", "error", terr)
+			os.Exit(1)
+		}
+		var dbIssuerCount, dbTargetCount int
+		for _, iss := range dbIssuers {
+			if iss != nil && iss.Source == "database" {
+				dbIssuerCount++
+			}
+		}
+		for _, tgt := range dbTargets {
+			if tgt != nil && tgt.Source == "database" {
+				dbTargetCount++
+			}
+		}
+		if dbIssuerCount > 0 || dbTargetCount > 0 {
+			logger.Error(
+				"startup refused: CERTCTL_CONFIG_ENCRYPTION_KEY is not set but database-sourced configs exist "+
+					"(would expose sensitive fields as plaintext, CWE-311). "+
+					"Set the encryption key or remove the affected rows before restarting.",
+				"database_sourced_issuers", dbIssuerCount,
+				"database_sourced_targets", dbTargetCount,
+			)
+			os.Exit(1)
+		}
+		logger.Warn("CERTCTL_CONFIG_ENCRYPTION_KEY not set — env-seeded issuers will be stored in plaintext; GUI-created issuers and targets will be rejected until a key is configured")
 	}
-	localCA := local.New(localCAConfig, logger)
-	logger.Info("initialized Local CA issuer connector")
 
-	// Initialize ACME issuer connector (for Let's Encrypt, ZeroSSL, Sectigo, Google Trust Services, etc.)
-	// Supports HTTP-01 (default), DNS-01 (for wildcards), and DNS-PERSIST-01 (standing record) challenge types.
-	// EAB (External Account Binding) required by ZeroSSL, Google Trust Services, SSL.com.
-	acmeConnector := acmeissuer.New(&acmeissuer.Config{
-		DirectoryURL:           os.Getenv("CERTCTL_ACME_DIRECTORY_URL"),
-		Email:                  os.Getenv("CERTCTL_ACME_EMAIL"),
-		EABKid:                 os.Getenv("CERTCTL_ACME_EAB_KID"),
-		EABHmac:                os.Getenv("CERTCTL_ACME_EAB_HMAC"),
-		ChallengeType:          os.Getenv("CERTCTL_ACME_CHALLENGE_TYPE"),
-		DNSPresentScript:       os.Getenv("CERTCTL_ACME_DNS_PRESENT_SCRIPT"),
-		DNSCleanUpScript:       os.Getenv("CERTCTL_ACME_DNS_CLEANUP_SCRIPT"),
-		DNSPersistIssuerDomain: os.Getenv("CERTCTL_ACME_DNS_PERSIST_ISSUER_DOMAIN"),
-	}, logger)
-	logger.Info("initialized ACME issuer connector")
-
-	// Initialize step-ca issuer connector (for Smallstep private CA).
-	// Uses the native /sign API with JWK provisioner authentication.
-	stepcaConnector := stepcaissuer.New(&stepcaissuer.Config{
-		CAURL:               os.Getenv("CERTCTL_STEPCA_URL"),
-		ProvisionerName:     os.Getenv("CERTCTL_STEPCA_PROVISIONER"),
-		ProvisionerKeyPath:  os.Getenv("CERTCTL_STEPCA_KEY_PATH"),
-		ProvisionerPassword: os.Getenv("CERTCTL_STEPCA_PASSWORD"),
-	}, logger)
-	logger.Info("initialized step-ca issuer connector")
-
-	// Initialize OpenSSL/Custom CA issuer connector (for script-based CA integrations).
-	// Delegates certificate signing to user-provided scripts.
-	opensslConnector := opensslissuer.New(&opensslissuer.Config{
-		SignScript:     os.Getenv("CERTCTL_OPENSSL_SIGN_SCRIPT"),
-		RevokeScript:   os.Getenv("CERTCTL_OPENSSL_REVOKE_SCRIPT"),
-		CRLScript:      os.Getenv("CERTCTL_OPENSSL_CRL_SCRIPT"),
-		TimeoutSeconds: getEnvIntDefault(os.Getenv("CERTCTL_OPENSSL_TIMEOUT_SECONDS"), 30),
-	}, logger)
-	logger.Info("initialized OpenSSL/Custom CA issuer connector")
-
-	// Build issuer registry: maps issuer IDs (from database) to connector implementations.
-	// "iss-local" matches the seed data issuer ID for the Local CA.
-	// "iss-acme-staging" and "iss-acme-prod" are conventional IDs for ACME issuers.
-	// "iss-stepca" is the step-ca private CA connector.
-	// "iss-openssl" is the custom CA/OpenSSL connector.
-	issuerRegistry := map[string]service.IssuerConnector{
-		"iss-local":        service.NewIssuerConnectorAdapter(localCA),
-		"iss-acme-staging": service.NewIssuerConnectorAdapter(acmeConnector),
-		"iss-acme-prod":    service.NewIssuerConnectorAdapter(acmeConnector),
-		"iss-stepca":       service.NewIssuerConnectorAdapter(stepcaConnector),
-		"iss-openssl":      service.NewIssuerConnectorAdapter(opensslConnector),
-	}
-	logger.Info("issuer registry configured", "issuers", len(issuerRegistry))
+	issuerRegistry := service.NewIssuerRegistry(logger)
 
 	// Initialize revocation repository
 	revocationRepo := postgres.NewRevocationRepository(db)
@@ -152,6 +146,7 @@ func main() {
 	// Initialize services (following the dependency graph)
 	auditService := service.NewAuditService(auditRepo)
 	policyService := service.NewPolicyService(policyRepo, auditService)
+	policyService.SetCertRepo(certificateRepo) // D-008: CertificateLifetime arm needs CertificateVersion.NotBefore/NotAfter
 	certificateService := service.NewCertificateService(certificateRepo, policyService, auditService)
 	notifierRegistry := make(map[string]service.Notifier)
 
@@ -189,6 +184,25 @@ func main() {
 		logger.Info("OpsGenie notifier enabled")
 	}
 
+	// Wire email notifier if SMTP is configured
+	var emailAdapter *notifyemail.NotifierAdapter
+	if cfg.Notifiers.SMTPHost != "" && cfg.Notifiers.SMTPFromAddress != "" {
+		emailConnector := notifyemail.New(&notifyemail.Config{
+			SMTPHost:    cfg.Notifiers.SMTPHost,
+			SMTPPort:    cfg.Notifiers.SMTPPort,
+			Username:    cfg.Notifiers.SMTPUsername,
+			Password:    cfg.Notifiers.SMTPPassword,
+			FromAddress: cfg.Notifiers.SMTPFromAddress,
+			UseTLS:      cfg.Notifiers.SMTPUseTLS,
+		}, logger)
+		emailAdapter = notifyemail.NewNotifierAdapter(emailConnector)
+		notifierRegistry["Email"] = emailAdapter
+		logger.Info("Email notifier enabled",
+			"smtp_host", cfg.Notifiers.SMTPHost,
+			"smtp_port", cfg.Notifiers.SMTPPort,
+			"from", cfg.Notifiers.SMTPFromAddress)
+	}
+
 	notificationService := service.NewNotificationService(notificationRepo, notifierRegistry)
 	notificationService.SetOwnerRepo(ownerRepo)
 
@@ -205,12 +219,26 @@ func main() {
 	certificateService.SetRevocationSvc(revocationSvc)
 	certificateService.SetCAOperationsSvc(caOperationsSvc)
 	certificateService.SetTargetRepo(targetRepo)
+	certificateService.SetJobRepo(jobRepo)
+	certificateService.SetKeygenMode(cfg.Keygen.Mode)
 	renewalService := service.NewRenewalService(certificateRepo, jobRepo, renewalPolicyRepo, profileRepo, auditService, notificationService, issuerRegistry, cfg.Keygen.Mode)
+	renewalService.SetTargetRepo(targetRepo)
 	deploymentService := service.NewDeploymentService(jobRepo, targetRepo, agentRepo, certificateRepo, auditService, notificationService)
-	jobService := service.NewJobService(jobRepo, renewalService, deploymentService, logger)
+	jobService := service.NewJobService(jobRepo, certificateRepo, ownerRepo, renewalService, deploymentService, logger)
+	// I-001: emit "job_retry" audit events when the scheduler resets Failed→Pending.
+	// SetAuditService is optional — JobService falls back to nil-guarded no-op if unwired.
+	jobService.SetAuditService(auditService)
 	agentService := service.NewAgentService(agentRepo, certificateRepo, jobRepo, targetRepo, auditService, issuerRegistry, renewalService)
-	issuerService := service.NewIssuerService(issuerRepo, auditService)
-	targetService := service.NewTargetService(targetRepo, auditService)
+	agentService.SetProfileRepo(profileRepo)
+	issuerService := service.NewIssuerService(issuerRepo, auditService, issuerRegistry, encryptionKey, logger)
+
+	// Seed issuers from env vars on first boot (empty database only), then build registry
+	issuerService.SeedFromEnvVars(context.Background(), cfg)
+	if err := issuerService.BuildRegistry(context.Background()); err != nil {
+		logger.Error("failed to build issuer registry from database", "error", err)
+	}
+	logger.Info("issuer registry loaded", "issuers", issuerRegistry.Len())
+	targetService := service.NewTargetService(targetRepo, auditService, agentRepo, encryptionKey, logger)
 	profileService := service.NewProfileService(profileRepo, auditService)
 	teamService := service.NewTeamService(teamRepo, auditService)
 	ownerService := service.NewOwnerService(ownerRepo, auditService)
@@ -230,14 +258,99 @@ func main() {
 			Name:   "Network Scanner (Server-Side)",
 			Status: domain.AgentStatusOnline,
 		}
-		if err := agentRepo.Create(context.Background(), sentinelAgent); err != nil {
-			// Ignore duplicate key errors (agent already exists)
-			logger.Debug("sentinel agent creation", "status", "exists or created", "id", service.SentinelAgentID)
+		// M-6: use CreateIfNotExists so duplicate rows on restart/upgrade are
+		// idempotent without swallowing unrelated DB failures (CWE-662).
+		created, err := agentRepo.CreateIfNotExists(context.Background(), sentinelAgent)
+		if err != nil {
+			logger.Error("sentinel agent creation failed", "id", service.SentinelAgentID, "error", err)
+		} else if created {
+			logger.Info("sentinel agent created", "id", service.SentinelAgentID)
+		} else {
+			logger.Debug("sentinel agent already exists", "id", service.SentinelAgentID)
 		}
 	}
 
+	// Initialize cloud discovery sources (M50)
+	var cloudDiscoveryService *service.CloudDiscoveryService
+	if cfg.CloudDiscovery.Enabled {
+		cloudDiscoveryService = service.NewCloudDiscoveryService(discoveryService, logger)
+
+		// AWS Secrets Manager
+		if cfg.CloudDiscovery.AWSSM.Enabled {
+			awsSource := discoveryawssm.New(&cfg.CloudDiscovery.AWSSM, logger)
+			cloudDiscoveryService.RegisterSource(awsSource)
+			// Create sentinel agent for AWS SM
+			sentinelAWS := &domain.Agent{
+				ID:     service.SentinelAWSSecretsMgr,
+				Name:   "AWS Secrets Manager Discovery",
+				Status: domain.AgentStatusOnline,
+			}
+			// M-6: idempotent create (CWE-662).
+			created, err := agentRepo.CreateIfNotExists(context.Background(), sentinelAWS)
+			if err != nil {
+				logger.Error("sentinel agent creation failed", "id", service.SentinelAWSSecretsMgr, "error", err)
+			} else if created {
+				logger.Info("sentinel agent created", "id", service.SentinelAWSSecretsMgr)
+			} else {
+				logger.Debug("sentinel agent already exists", "id", service.SentinelAWSSecretsMgr)
+			}
+		}
+
+		// Azure Key Vault
+		if cfg.CloudDiscovery.AzureKV.Enabled {
+			azureSource := discoveryazurekv.New(discoveryazurekv.Config{
+				VaultURL:     cfg.CloudDiscovery.AzureKV.VaultURL,
+				TenantID:     cfg.CloudDiscovery.AzureKV.TenantID,
+				ClientID:     cfg.CloudDiscovery.AzureKV.ClientID,
+				ClientSecret: cfg.CloudDiscovery.AzureKV.ClientSecret,
+			}, logger)
+			cloudDiscoveryService.RegisterSource(azureSource)
+			sentinelAzure := &domain.Agent{
+				ID:     service.SentinelAzureKeyVault,
+				Name:   "Azure Key Vault Discovery",
+				Status: domain.AgentStatusOnline,
+			}
+			// M-6: idempotent create (CWE-662).
+			created, err := agentRepo.CreateIfNotExists(context.Background(), sentinelAzure)
+			if err != nil {
+				logger.Error("sentinel agent creation failed", "id", service.SentinelAzureKeyVault, "error", err)
+			} else if created {
+				logger.Info("sentinel agent created", "id", service.SentinelAzureKeyVault)
+			} else {
+				logger.Debug("sentinel agent already exists", "id", service.SentinelAzureKeyVault)
+			}
+		}
+
+		// GCP Secret Manager
+		if cfg.CloudDiscovery.GCPSM.Enabled {
+			gcpSource := discoverygcpsm.New(&cfg.CloudDiscovery.GCPSM, logger)
+			cloudDiscoveryService.RegisterSource(gcpSource)
+			sentinelGCP := &domain.Agent{
+				ID:     service.SentinelGCPSecretMgr,
+				Name:   "GCP Secret Manager Discovery",
+				Status: domain.AgentStatusOnline,
+			}
+			// M-6: idempotent create (CWE-662).
+			created, err := agentRepo.CreateIfNotExists(context.Background(), sentinelGCP)
+			if err != nil {
+				logger.Error("sentinel agent creation failed", "id", service.SentinelGCPSecretMgr, "error", err)
+			} else if created {
+				logger.Info("sentinel agent created", "id", service.SentinelGCPSecretMgr)
+			} else {
+				logger.Debug("sentinel agent already exists", "id", service.SentinelGCPSecretMgr)
+			}
+		}
+
+		logger.Info("cloud discovery enabled",
+			"sources", cloudDiscoveryService.SourceCount(),
+			"interval", cfg.CloudDiscovery.Interval.String())
+	}
+
 	logger.Info("initialized all services")
 
+	// Initialize bulk revocation service
+	bulkRevocationService := service.NewBulkRevocationService(revocationSvc, certificateRepo, auditService, logger)
+
 	// Initialize stats and metrics services
 	statsService := service.NewStatsService(certificateRepo, jobRepo, agentRepo)
 	logger.Info("initialized stats service")
@@ -262,6 +375,53 @@ func main() {
 	networkScanHandler := handler.NewNetworkScanHandler(networkScanService)
 	verificationService := service.NewVerificationService(jobRepo, auditService, logger)
 	verificationHandler := handler.NewVerificationHandler(verificationService)
+	exportService := service.NewExportService(certificateRepo, auditService)
+	exportHandler := handler.NewExportHandler(exportService)
+
+	bulkRevocationHandler := handler.NewBulkRevocationHandler(bulkRevocationService)
+
+	// Initialize digest service (requires email notifier)
+	var digestService *service.DigestService
+	var digestHandler *handler.DigestHandler
+	if cfg.Digest.Enabled && emailAdapter != nil {
+		digestService = service.NewDigestService(
+			statsService, certificateRepo, ownerRepo, emailAdapter, cfg.Digest.Recipients, logger,
+		)
+		digestHandler = handler.NewDigestHandler(digestService)
+		logger.Info("digest service enabled",
+			"interval", cfg.Digest.Interval.String(),
+			"recipients", len(cfg.Digest.Recipients))
+	} else {
+		// Create a no-op digest handler for route registration
+		digestHandler = handler.NewDigestHandler(nil)
+		if cfg.Digest.Enabled && emailAdapter == nil {
+			logger.Warn("digest enabled but SMTP not configured — digest emails will not be sent")
+		}
+	}
+
+	// Initialize health check service (M48)
+	var healthCheckService *service.HealthCheckService
+	var healthCheckHandler *handler.HealthCheckHandler
+	if cfg.HealthCheck.Enabled {
+		healthCheckRepo := postgres.NewHealthCheckRepository(db)
+		healthCheckService = service.NewHealthCheckService(
+			healthCheckRepo,
+			auditService,
+			logger,
+			cfg.HealthCheck.MaxConcurrent,
+			time.Duration(cfg.HealthCheck.DefaultTimeout)*time.Millisecond,
+			cfg.HealthCheck.HistoryRetention,
+			cfg.HealthCheck.AutoCreate,
+		)
+		healthCheckHandler = handler.NewHealthCheckHandler(healthCheckService)
+		logger.Info("health check service enabled",
+			"interval", cfg.HealthCheck.CheckInterval.String(),
+			"max_concurrent", cfg.HealthCheck.MaxConcurrent)
+	} else {
+		// Create a no-op health check handler for route registration
+		healthCheckHandler = handler.NewHealthCheckHandler(nil)
+	}
+
 	logger.Info("initialized all handlers")
 
 	// Create context with cancellation
@@ -281,12 +441,33 @@ func main() {
 	// Configure scheduler intervals from config
 	sched.SetRenewalCheckInterval(cfg.Scheduler.RenewalCheckInterval)
 	sched.SetJobProcessorInterval(cfg.Scheduler.JobProcessorInterval)
+	// I-001: drive the failed-job retry loop. Runs on start + every RetryInterval
+	// (default 5m, CERTCTL_SCHEDULER_RETRY_INTERVAL). Kept adjacent to the job
+	// processor setter because they share the JobServicer dependency.
+	sched.SetJobRetryInterval(cfg.Scheduler.RetryInterval)
 	sched.SetAgentHealthCheckInterval(cfg.Scheduler.AgentHealthCheckInterval)
 	sched.SetNotificationProcessInterval(cfg.Scheduler.NotificationProcessInterval)
 	if cfg.NetworkScan.Enabled {
 		sched.SetNetworkScanInterval(cfg.NetworkScan.ScanInterval)
 		logger.Info("network scanning enabled", "interval", cfg.NetworkScan.ScanInterval.String())
 	}
+	if digestService != nil {
+		sched.SetDigestService(digestService)
+		sched.SetDigestInterval(cfg.Digest.Interval)
+		logger.Info("digest scheduler enabled", "interval", cfg.Digest.Interval.String())
+	}
+	if healthCheckService != nil {
+		sched.SetHealthCheckService(healthCheckService)
+		sched.SetHealthCheckInterval(cfg.HealthCheck.CheckInterval)
+		logger.Info("health check scheduler enabled", "interval", cfg.HealthCheck.CheckInterval.String())
+	}
+	if cloudDiscoveryService != nil && cloudDiscoveryService.SourceCount() > 0 {
+		sched.SetCloudDiscoveryService(cloudDiscoveryService)
+		sched.SetCloudDiscoveryInterval(cfg.CloudDiscovery.Interval)
+		logger.Info("cloud discovery scheduler enabled",
+			"interval", cfg.CloudDiscovery.Interval.String(),
+			"sources", cloudDiscoveryService.SourceCount())
+	}
 
 	// Start scheduler
 	logger.Info("starting scheduler")
@@ -315,15 +496,20 @@ func main() {
 		Discovery:     discoveryHandler,
 		NetworkScan:   networkScanHandler,
 		Verification:  verificationHandler,
+		Export:        exportHandler,
+		Digest:        *digestHandler,
+		HealthChecks:     healthCheckHandler,
+		BulkRevocation:   bulkRevocationHandler,
 	})
 	// Register EST (RFC 7030) handlers if enabled
 	if cfg.EST.Enabled {
-		issuerConn, ok := issuerRegistry[cfg.EST.IssuerID]
+		issuerConn, ok := issuerRegistry.Get(cfg.EST.IssuerID)
 		if !ok {
 			logger.Error("EST issuer not found in registry", "issuer_id", cfg.EST.IssuerID)
 			os.Exit(1)
 		}
 		estService := service.NewESTService(cfg.EST.IssuerID, issuerConn, auditService, logger)
+		estService.SetProfileRepo(profileRepo)
 		if cfg.EST.ProfileID != "" {
 			estService.SetProfileID(cfg.EST.ProfileID)
 		}
@@ -335,13 +521,102 @@ func main() {
 			"endpoints", "/.well-known/est/{cacerts,simpleenroll,simplereenroll,csrattrs}")
 	}
 
+	// Register SCEP (RFC 8894) handlers if enabled
+	if cfg.SCEP.Enabled {
+		// H-2 fix: fail closed at startup when SCEP is enabled without a
+		// challenge password configured. Previously the service-layer guard
+		// at internal/service/scep.go:72-79 skipped the password check when
+		// s.challengePassword == "", meaning any client that could reach the
+		// /scep endpoint could enroll an arbitrary CSR against the configured
+		// issuer (CWE-306, missing authentication for a critical function).
+		// Refuse to start instead: the operator must set
+		// CERTCTL_SCEP_CHALLENGE_PASSWORD (or disable SCEP) before the control
+		// plane can boot.
+		if err := preflightSCEPChallengePassword(cfg.SCEP.Enabled, cfg.SCEP.ChallengePassword); err != nil {
+			logger.Error(
+				"startup refused: SCEP is enabled but CERTCTL_SCEP_CHALLENGE_PASSWORD is not set "+
+					"(would allow unauthenticated certificate enrollment, CWE-306). "+
+					"Set a non-empty challenge password or disable SCEP before restarting.",
+				"error", err,
+			)
+			os.Exit(1)
+		}
+		issuerConn, ok := issuerRegistry.Get(cfg.SCEP.IssuerID)
+		if !ok {
+			logger.Error("SCEP issuer not found in registry", "issuer_id", cfg.SCEP.IssuerID)
+			os.Exit(1)
+		}
+		scepService := service.NewSCEPService(cfg.SCEP.IssuerID, issuerConn, auditService, logger, cfg.SCEP.ChallengePassword)
+		scepService.SetProfileRepo(profileRepo)
+		if cfg.SCEP.ProfileID != "" {
+			scepService.SetProfileID(cfg.SCEP.ProfileID)
+		}
+		scepHandler := handler.NewSCEPHandler(scepService)
+		apiRouter.RegisterSCEPHandlers(scepHandler)
+		logger.Info("SCEP server enabled",
+			"issuer_id", cfg.SCEP.IssuerID,
+			"profile_id", cfg.SCEP.ProfileID,
+			"challenge_password_set", cfg.SCEP.ChallengePassword != "",
+			"endpoints", "/scep?operation={GetCACaps,GetCACert,PKIOperation}")
+	}
+
+	// Register RFC 5280 CRL and RFC 6960 OCSP handlers under /.well-known/pki/.
+	// These are always enabled (no config gate) — revocation data must be
+	// reachable to relying parties for any cert certctl issues. The finalHandler
+	// routing gate below strips auth middleware for this prefix so browsers,
+	// OpenSSL, OCSP stapling sidecars, and mTLS clients can fetch without
+	// presenting certctl Bearer tokens.
+	apiRouter.RegisterPKIHandlers(certificateHandler)
+	logger.Info("PKI endpoints registered",
+		"endpoints", "/.well-known/pki/{crl/{issuer_id},ocsp/{issuer_id}/{serial}}")
+
 	logger.Info("registered all API handlers")
 
-	// Build middleware stack
-	authMiddleware := middleware.NewAuth(middleware.AuthConfig{
-		Type:   cfg.Auth.Type,
-		Secret: cfg.Auth.Secret,
-	})
+	// Build middleware stack.
+	//
+	// Authentication unification (M-002): every authenticated request now
+	// carries a named actor in the request context so audit events record
+	// the real key identity instead of the hardcoded "api-key-user" string.
+	// Named keys come from CERTCTL_API_KEYS_NAMED (preferred). For backward
+	// compatibility CERTCTL_AUTH_SECRET is synthesized into legacy-key-N
+	// entries with Admin=false.
+	var namedKeys []middleware.NamedAPIKey
+	if cfg.Auth.Type != "none" {
+		// Translate typed config.NamedAPIKey -> middleware.NamedAPIKey. The
+		// two structs are field-compatible but live in different packages to
+		// preserve the config→middleware dependency direction.
+		for _, nk := range cfg.Auth.NamedKeys {
+			namedKeys = append(namedKeys, middleware.NamedAPIKey{
+				Name:  nk.Name,
+				Key:   nk.Key,
+				Admin: nk.Admin,
+			})
+		}
+		// Back-compat: if no named keys but legacy Secret is configured,
+		// synthesize named entries so the audit trail still attributes the
+		// action (instead of falling back to "api-key-user" / "anonymous").
+		if len(namedKeys) == 0 && cfg.Auth.Secret != "" {
+			parts := strings.Split(cfg.Auth.Secret, ",")
+			idx := 0
+			for _, p := range parts {
+				p = strings.TrimSpace(p)
+				if p == "" {
+					continue
+				}
+				namedKeys = append(namedKeys, middleware.NamedAPIKey{
+					Name:  fmt.Sprintf("legacy-key-%d", idx),
+					Key:   p,
+					Admin: false,
+				})
+				idx++
+			}
+			if len(namedKeys) > 0 {
+				logger.Warn("CERTCTL_AUTH_SECRET is deprecated — set CERTCTL_API_KEYS_NAMED for named actor attribution and admin gating",
+					"synthesized_keys", len(namedKeys))
+			}
+		}
+	}
+	authMiddleware := middleware.NewAuthWithNamedKeys(namedKeys)
 	corsMiddleware := middleware.NewCORS(middleware.CORSConfig{
 		AllowedOrigins: cfg.CORS.AllowedOrigins,
 	})
@@ -373,7 +648,7 @@ func main() {
 		bodyLimitMiddleware,
 		corsMiddleware,
 		authMiddleware,
-		auditMiddleware,
+		auditMiddleware.Middleware,
 	}
 
 	// Add rate limiter if enabled
@@ -390,7 +665,7 @@ func main() {
 			rateLimiter,
 			corsMiddleware,
 			authMiddleware,
-			auditMiddleware,
+			auditMiddleware.Middleware,
 		}
 		logger.Info("rate limiting enabled", "rps", cfg.RateLimit.RPS, "burst", cfg.RateLimit.BurstSize)
 	}
@@ -417,13 +692,36 @@ func main() {
 	if _, err := os.Stat(webDir + "/index.html"); err != nil {
 		webDir = "./web"
 	}
+	// Health/ready routes bypass the full middleware stack (no auth required).
+	// These are registered on the inner router without auth, but the outer
+	// middleware chain wraps everything. Route them directly to the inner router.
+	noAuthHandler := middleware.Chain(apiRouter,
+		middleware.RequestID,
+		structuredLogger,
+		middleware.Recovery,
+	)
+
 	if _, err := os.Stat(webDir + "/index.html"); err == nil {
 		fileServer := http.FileServer(http.Dir(webDir))
 		finalHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			path := r.URL.Path
-			// API, health, and EST routes go to the API handler
-			if path == "/health" || path == "/ready" ||
-				(len(path) >= 8 && path[:8] == "/api/v1/") ||
+			// Health/ready and auth/info bypass auth middleware.
+			// Health/ready: Docker/K8s health probes don't carry Bearer tokens.
+			// auth/info: React app calls this before login to detect auth mode.
+			if path == "/health" || path == "/ready" || path == "/api/v1/auth/info" {
+				noAuthHandler.ServeHTTP(w, r)
+				return
+			}
+			// RFC 5280 CRL and RFC 6960 OCSP live under /.well-known/pki/ and
+			// MUST be served unauthenticated — relying parties (browsers,
+			// OpenSSL, OCSP stapling sidecars, mTLS clients) cannot present
+			// certctl Bearer tokens. See router.RegisterPKIHandlers.
+			if len(path) >= 16 && path[:16] == "/.well-known/pki" {
+				noAuthHandler.ServeHTTP(w, r)
+				return
+			}
+			// All other API and EST routes go through the full middleware stack (with auth)
+			if (len(path) >= 8 && path[:8] == "/api/v1/") ||
 				(len(path) >= 16 && path[:16] == "/.well-known/est") {
 				apiHandler.ServeHTTP(w, r)
 				return
@@ -438,18 +736,32 @@ func main() {
 		})
 		logger.Info("dashboard available at /", "web_dir", webDir)
 	} else {
-		finalHandler = apiHandler
+		// No dashboard: route health/auth-info and /.well-known/pki without
+		// auth, everything else through full stack.
+		finalHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			path := r.URL.Path
+			if path == "/health" || path == "/ready" || path == "/api/v1/auth/info" {
+				noAuthHandler.ServeHTTP(w, r)
+				return
+			}
+			if len(path) >= 16 && path[:16] == "/.well-known/pki" {
+				noAuthHandler.ServeHTTP(w, r)
+				return
+			}
+			apiHandler.ServeHTTP(w, r)
+		})
 		logger.Info("dashboard directory not found, serving API only")
 	}
 
 	// Server configuration
 	addr := net.JoinHostPort(cfg.Server.Host, strconv.Itoa(cfg.Server.Port))
 	httpServer := &http.Server{
-		Addr:         addr,
-		Handler:      finalHandler,
-		ReadTimeout:  15 * time.Second,
-		WriteTimeout: 15 * time.Second,
-		IdleTimeout:  60 * time.Second,
+		Addr:              addr,
+		Handler:           finalHandler,
+		ReadTimeout:       30 * time.Second,
+		ReadHeaderTimeout: 5 * time.Second,
+		WriteTimeout:      120 * time.Second, // Must accommodate ACME issuance (order + challenge + finalize)
+		IdleTimeout:       60 * time.Second,
 	}
 
 	// Start HTTP server in background
@@ -484,6 +796,17 @@ func main() {
 		logger.Error("HTTP server shutdown error", "error", err)
 	}
 
+	// Drain in-flight audit-recording goroutines before closing the DB pool.
+	// The audit middleware spawns one goroutine per non-excluded request; those
+	// goroutines run detached from the request context and write to the
+	// audit_events table via the same *sql.DB. Without this drain, SIGTERM
+	// would close the DB pool while recordings were mid-flight, silently
+	// dropping audit events (M-1, CWE-662 / CWE-400).
+	logger.Info("flushing audit middleware in-flight recordings")
+	if err := auditMiddleware.Flush(shutdownCtx); err != nil {
+		logger.Warn("audit middleware flush did not complete in time", "error", err)
+	}
+
 	// Close database connection
 	if err := db.Close(); err != nil {
 		logger.Error("error closing database connection", "error", err)
@@ -492,14 +815,23 @@ func main() {
 	logger.Info("certctl server stopped")
 }
 
-// getEnvIntDefault parses an integer from a string with a default fallback.
-func getEnvIntDefault(s string, defaultVal int) int {
-	if s == "" {
-		return defaultVal
+// preflightSCEPChallengePassword enforces the H-2 fix: if SCEP is enabled, a
+// non-empty challenge password MUST be configured. Returns a non-nil error
+// otherwise so the caller can refuse to start the control plane (CWE-306,
+// missing authentication for a critical function).
+//
+// This helper is extracted so the check can be unit tested without booting
+// the full server. The caller (main) is responsible for translating the
+// returned error into a structured log line and os.Exit(1).
+func preflightSCEPChallengePassword(enabled bool, challengePassword string) error {
+	if !enabled {
+		return nil
 	}
-	val, err := strconv.Atoi(s)
-	if err != nil {
-		return defaultVal
+	if challengePassword == "" {
+		return fmt.Errorf("SCEP enabled but CERTCTL_SCEP_CHALLENGE_PASSWORD is empty: " +
+			"SCEP enrollment would accept any client (CWE-306); " +
+			"configure a non-empty shared secret or set CERTCTL_SCEP_ENABLED=false")
 	}
-	return val
+	return nil
 }
+

cmd/server/main_test.go

@@ -0,0 +1,606 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/api/router"
+	"github.com/shankar0123/certctl/internal/config"
+	"github.com/shankar0123/certctl/internal/service"
+)
+
+// TestMain_HealthEndpointBypassesAuth verifies that health check endpoints
+// bypass auth middleware while protected API endpoints require auth.
+// This is the most critical test — it validates the core routing pattern used in main.go.
+func TestMain_HealthEndpointBypassesAuth(t *testing.T) {
+	// Simulate the finalHandler logic from main.go with minimal setup
+	// Create handler functions for health endpoints
+	healthHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"status":"ok"}`))
+	})
+
+	readyHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"status":"ready"}`))
+	})
+
+	authInfoHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"auth_type":"api-key"}`))
+	})
+
+	// Protected API endpoint
+	certHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`[]`))
+	})
+
+	// Build the handler chain the same way main.go does
+	authMiddleware := middleware.NewAuth(middleware.AuthConfig{
+		Type:   "api-key",
+		Secret: "test-secret-key",
+	})
+
+	// API handler with auth
+	authHandler := middleware.Chain(certHandler,
+		middleware.RequestID,
+		middleware.Recovery,
+		authMiddleware,
+	)
+
+	// Create finalHandler matching main.go logic
+	finalHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path := r.URL.Path
+		switch path {
+		case "/health":
+			healthHandler.ServeHTTP(w, r)
+		case "/ready":
+			readyHandler.ServeHTTP(w, r)
+		case "/api/v1/auth/info":
+			authInfoHandler.ServeHTTP(w, r)
+		case "/api/v1/certificates":
+			authHandler.ServeHTTP(w, r)
+		default:
+			http.Error(w, "Not Found", http.StatusNotFound)
+		}
+	})
+
+	tests := []struct {
+		name           string
+		path           string
+		method         string
+		bypassesAuth   bool
+		expectedStatus int
+	}{
+		{
+			name:           "GET /health without auth",
+			path:           "/health",
+			method:         "GET",
+			bypassesAuth:   true,
+			expectedStatus: http.StatusOK,
+		},
+		{
+			name:           "GET /ready without auth",
+			path:           "/ready",
+			method:         "GET",
+			bypassesAuth:   true,
+			expectedStatus: http.StatusOK,
+		},
+		{
+			name:           "GET /api/v1/auth/info without auth",
+			path:           "/api/v1/auth/info",
+			method:         "GET",
+			bypassesAuth:   true,
+			expectedStatus: http.StatusOK,
+		},
+		{
+			name:           "GET /api/v1/certificates without auth (should fail)",
+			path:           "/api/v1/certificates",
+			method:         "GET",
+			bypassesAuth:   false,
+			expectedStatus: http.StatusUnauthorized,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(tt.method, tt.path, nil)
+			w := httptest.NewRecorder()
+
+			finalHandler.ServeHTTP(w, req)
+
+			if tt.bypassesAuth && w.Code != tt.expectedStatus {
+				t.Errorf("endpoint %s should bypass auth, got status %d, expected %d",
+					tt.path, w.Code, tt.expectedStatus)
+			}
+
+			if !tt.bypassesAuth && w.Code != tt.expectedStatus {
+				t.Logf("endpoint %s requires auth, got status %d, expected %d (auth middleware working)",
+					tt.path, w.Code, tt.expectedStatus)
+			}
+		})
+	}
+}
+
+// TestMain_HealthHandlersRespond verifies health endpoints return correct responses.
+func TestMain_HealthHandlersRespond(t *testing.T) {
+	healthHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"status":"ok"}`))
+	})
+
+	req := httptest.NewRequest("GET", "/health", nil)
+	w := httptest.NewRecorder()
+
+	healthHandler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected status 200, got %d", w.Code)
+	}
+
+	if body := w.Body.String(); body != `{"status":"ok"}` {
+		t.Errorf("expected body '{\"status\":\"ok\"}', got '%s'", body)
+	}
+}
+
+// TestMain_AuthMiddlewareRejectsUnauthorized verifies auth middleware works.
+func TestMain_AuthMiddlewareRejectsUnauthorized(t *testing.T) {
+	// Create a protected endpoint
+	protectedHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"data":"protected"}`))
+	})
+
+	// Wrap with auth middleware
+	authMiddleware := middleware.NewAuth(middleware.AuthConfig{
+		Type:   "api-key",
+		Secret: "test-secret-key",
+	})
+
+	chainedHandler := middleware.Chain(protectedHandler, authMiddleware)
+
+	// Request without auth should be rejected
+	req := httptest.NewRequest("GET", "/api/v1/protected", nil)
+	w := httptest.NewRecorder()
+
+	chainedHandler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusUnauthorized {
+		t.Errorf("expected status 401 for unauthorized request, got %d", w.Code)
+	}
+}
+
+// TestMain_AuthMiddlewareAllowsWithValidKey verifies auth middleware allows valid keys.
+func TestMain_AuthMiddlewareAllowsWithValidKey(t *testing.T) {
+	testKey := "test-secret-key"
+
+	// Create a protected endpoint
+	protectedHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"data":"protected"}`))
+	})
+
+	// Wrap with auth middleware
+	authMiddleware := middleware.NewAuth(middleware.AuthConfig{
+		Type:   "api-key",
+		Secret: testKey,
+	})
+
+	chainedHandler := middleware.Chain(protectedHandler, authMiddleware)
+
+	// Request with valid auth should be allowed
+	req := httptest.NewRequest("GET", "/api/v1/protected", nil)
+	req.Header.Set("Authorization", "Bearer "+testKey)
+	w := httptest.NewRecorder()
+
+	chainedHandler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected status 200 for authorized request, got %d", w.Code)
+	}
+}
+
+// TestMain_ServerConfigFromEnvironment verifies config.Load() reads env vars correctly.
+func TestMain_ServerConfigFromEnvironment(t *testing.T) {
+	// Save original env vars
+	oldAuthType := os.Getenv("CERTCTL_AUTH_TYPE")
+	oldServerHost := os.Getenv("CERTCTL_SERVER_HOST")
+	oldServerPort := os.Getenv("CERTCTL_SERVER_PORT")
+	defer func() {
+		if oldAuthType != "" {
+			os.Setenv("CERTCTL_AUTH_TYPE", oldAuthType)
+		} else {
+			os.Unsetenv("CERTCTL_AUTH_TYPE")
+		}
+		if oldServerHost != "" {
+			os.Setenv("CERTCTL_SERVER_HOST", oldServerHost)
+		} else {
+			os.Unsetenv("CERTCTL_SERVER_HOST")
+		}
+		if oldServerPort != "" {
+			os.Setenv("CERTCTL_SERVER_PORT", oldServerPort)
+		} else {
+			os.Unsetenv("CERTCTL_SERVER_PORT")
+		}
+	}()
+
+	// Set test env vars
+	os.Setenv("CERTCTL_AUTH_TYPE", "none")
+	os.Setenv("CERTCTL_SERVER_HOST", "127.0.0.1")
+	os.Setenv("CERTCTL_SERVER_PORT", "8080")
+
+	cfg, err := config.Load()
+	if err != nil {
+		t.Fatalf("Failed to load config from env vars: %v", err)
+	}
+
+	if cfg.Auth.Type != "none" {
+		t.Errorf("Expected auth type 'none', got '%s'", cfg.Auth.Type)
+	}
+
+	if cfg.Server.Host != "127.0.0.1" {
+		t.Errorf("Expected server host '127.0.0.1', got '%s'", cfg.Server.Host)
+	}
+
+	if cfg.Server.Port != 8080 {
+		t.Errorf("Expected server port 8080, got %d", cfg.Server.Port)
+	}
+}
+
+// TestMain_AuthTypeConfiguration verifies auth type is read from config.
+func TestMain_AuthTypeConfiguration(t *testing.T) {
+	// Save original env vars
+	oldAuthType := os.Getenv("CERTCTL_AUTH_TYPE")
+	oldAuthSecret := os.Getenv("CERTCTL_AUTH_SECRET")
+	defer func() {
+		if oldAuthType != "" {
+			os.Setenv("CERTCTL_AUTH_TYPE", oldAuthType)
+		} else {
+			os.Unsetenv("CERTCTL_AUTH_TYPE")
+		}
+		if oldAuthSecret != "" {
+			os.Setenv("CERTCTL_AUTH_SECRET", oldAuthSecret)
+		} else {
+			os.Unsetenv("CERTCTL_AUTH_SECRET")
+		}
+	}()
+
+	// Set auth secret for api-key mode
+	os.Setenv("CERTCTL_AUTH_SECRET", "test-secret")
+
+	testCases := []string{"api-key", "none"}
+
+	for _, authType := range testCases {
+		t.Run(fmt.Sprintf("auth_type_%s", authType), func(t *testing.T) {
+			os.Setenv("CERTCTL_AUTH_TYPE", authType)
+
+			cfg, err := config.Load()
+			if err != nil {
+				t.Fatalf("Failed to load config: %v", err)
+			}
+
+			if cfg.Auth.Type != authType {
+				t.Errorf("Expected auth type '%s', got '%s'", authType, cfg.Auth.Type)
+			}
+		})
+	}
+}
+
+// TestMain_MiddlewareChainConstruction tests that middleware can be properly chained.
+func TestMain_MiddlewareChainConstruction(t *testing.T) {
+	// Test that the middleware.Chain function works as expected
+	baseHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("success"))
+	})
+
+	// Chain with RequestID and Recovery middleware
+	chainedHandler := middleware.Chain(baseHandler,
+		middleware.RequestID,
+		middleware.Recovery,
+	)
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	w := httptest.NewRecorder()
+
+	chainedHandler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected status 200, got %d", w.Code)
+	}
+
+	if body := w.Body.String(); body != "success" {
+		t.Errorf("expected body 'success', got '%s'", body)
+	}
+}
+
+// TestMain_RequestIDMiddleware verifies RequestID is added to responses.
+func TestMain_RequestIDMiddleware(t *testing.T) {
+	baseHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	// Wrap with RequestID middleware
+	chainedHandler := middleware.Chain(baseHandler, middleware.RequestID)
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	w := httptest.NewRecorder()
+
+	chainedHandler.ServeHTTP(w, req)
+
+	// RequestID should be set in response header
+	if rid := w.Header().Get("X-Request-ID"); rid == "" {
+		t.Logf("X-Request-ID header not present (middleware may work differently)")
+	} else {
+		t.Logf("X-Request-ID header set: %s", rid)
+	}
+}
+
+// TestMain_RecoveryMiddlewareHandlesPanic verifies recovery middleware works.
+func TestMain_RecoveryMiddlewareHandlesPanic(t *testing.T) {
+	panicHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		panic("test panic")
+	})
+
+	// Wrap with recovery middleware
+	chainedHandler := middleware.Chain(panicHandler, middleware.Recovery)
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	w := httptest.NewRecorder()
+
+	// Should not panic
+	chainedHandler.ServeHTTP(w, req)
+
+	// Should return 500 error
+	if w.Code != http.StatusInternalServerError {
+		t.Logf("Expected 500 for panicked handler, got %d", w.Code)
+	}
+}
+
+// TestMain_ServiceInitialization tests that services can be instantiated.
+// This validates the initialization pattern from main.go without needing a real DB.
+func TestMain_ServiceInitialization(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{
+		Level: slog.LevelInfo,
+	}))
+
+	// Create test issuer registry (same as main.go does)
+	issuerRegistry := service.NewIssuerRegistry(logger)
+
+	if issuerRegistry == nil {
+		t.Fatal("issuer registry should not be nil")
+	}
+
+	// Verify the registry has a Len() method (used in main.go)
+	count := issuerRegistry.Len()
+	if count < 0 {
+		t.Errorf("issuer registry length should be >= 0, got %d", count)
+	}
+}
+
+// TestMain_CORSMiddlewareSetHeaders verifies CORS headers are set.
+func TestMain_CORSMiddlewareSetHeaders(t *testing.T) {
+	baseHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	corsMiddleware := middleware.NewCORS(middleware.CORSConfig{
+		AllowedOrigins: []string{"http://example.com"},
+	})
+
+	chainedHandler := middleware.Chain(baseHandler, corsMiddleware)
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	req.Header.Set("Origin", "http://example.com")
+	w := httptest.NewRecorder()
+
+	chainedHandler.ServeHTTP(w, req)
+
+	// CORS middleware should set access control headers
+	if acah := w.Header().Get("Access-Control-Allow-Origin"); acah == "" {
+		t.Logf("Access-Control-Allow-Origin not set (may be by design)")
+	}
+}
+
+// TestMain_AuthNoneMode verifies auth can be disabled.
+func TestMain_AuthNoneMode(t *testing.T) {
+	protectedHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"data":"protected"}`))
+	})
+
+	// Wrap with auth middleware in "none" mode
+	authMiddleware := middleware.NewAuth(middleware.AuthConfig{
+		Type: "none",
+	})
+
+	chainedHandler := middleware.Chain(protectedHandler, authMiddleware)
+
+	// Request without auth should be allowed in "none" mode
+	req := httptest.NewRequest("GET", "/api/v1/protected", nil)
+	w := httptest.NewRecorder()
+
+	chainedHandler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected status 200 in 'none' auth mode, got %d", w.Code)
+	}
+}
+
+// TestMain_RouterRegistration tests that router registration works.
+func TestMain_RouterRegistration(t *testing.T) {
+	r := router.New()
+
+	// Register a test handler
+	r.RegisterFunc("GET /test", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("test"))
+	})
+
+	// Request the route
+	req := httptest.NewRequest("GET", "/test", nil)
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	// Route should be registered and accessible
+	if w.Code == http.StatusNotFound {
+		t.Errorf("route not registered, got 404")
+	} else if w.Code == http.StatusOK {
+		t.Logf("route registered successfully")
+	}
+}
+
+// TestMain_RateLimiterIntegration tests rate limiter middleware works.
+func TestMain_RateLimiterIntegration(t *testing.T) {
+	baseHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	// Create rate limiter with 10 RPS, 1 burst
+	rateLimiter := middleware.NewRateLimiter(middleware.RateLimitConfig{
+		RPS:       10,
+		BurstSize: 1,
+	})
+
+	chainedHandler := middleware.Chain(baseHandler, rateLimiter)
+
+	// First request should succeed
+	req := httptest.NewRequest("GET", "/test", nil)
+	w := httptest.NewRecorder()
+	chainedHandler.ServeHTTP(w, req)
+
+	if w.Code == http.StatusServiceUnavailable {
+		t.Logf("rate limiter is active")
+	} else {
+		t.Logf("rate limiter allowed request (status %d)", w.Code)
+	}
+}
+
+// TestMain_ContentTypeMiddleware verifies content type is set correctly.
+func TestMain_ContentTypeMiddleware(t *testing.T) {
+	baseHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"status":"ok"}`))
+	})
+
+	// Wrap with middleware that sets Content-Type
+	chainedHandler := middleware.Chain(baseHandler, middleware.ContentType)
+
+	req := httptest.NewRequest("GET", "/api/v1/test", nil)
+	w := httptest.NewRecorder()
+
+	chainedHandler.ServeHTTP(w, req)
+
+	// Verify response
+	if w.Code != http.StatusOK {
+		t.Errorf("expected status 200, got %d", w.Code)
+	}
+
+	// ContentType middleware should set header
+	if ct := w.Header().Get("Content-Type"); ct != "" {
+		t.Logf("Content-Type header set: %s", ct)
+	}
+}
+
+// TestMain_ContextPropagation verifies context is propagated through middleware.
+func TestMain_ContextPropagation(t *testing.T) {
+	type contextKey string
+	testKey := contextKey("test-key")
+	testValue := "test-value"
+
+	baseHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		val := r.Context().Value(testKey)
+		if val == testValue {
+			w.WriteHeader(http.StatusOK)
+		} else {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	})
+
+	chainedHandler := middleware.Chain(baseHandler, middleware.RequestID)
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	// Add context value before request
+	req = req.WithContext(context.WithValue(req.Context(), testKey, testValue))
+
+	w := httptest.NewRecorder()
+	chainedHandler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Logf("Context value may not be propagated (status %d), this may be expected", w.Code)
+	}
+}
+
+// TestPreflightSCEPChallengePassword is the H-2 regression guard for the
+// startup pre-flight check. The helper MUST return a non-nil error whenever
+// SCEP is enabled with an empty challenge password — that configuration
+// previously allowed unauthenticated certificate enrollment (CWE-306).
+// Disabled-SCEP and configured-password cases must pass cleanly.
+func TestPreflightSCEPChallengePassword(t *testing.T) {
+	tests := []struct {
+		name              string
+		enabled           bool
+		challengePassword string
+		wantErr           bool
+		wantErrSubstring  string
+	}{
+		{
+			name:              "disabled_empty_password_ok",
+			enabled:           false,
+			challengePassword: "",
+			wantErr:           false,
+		},
+		{
+			name:              "disabled_with_password_ok",
+			enabled:           false,
+			challengePassword: "leftover-value",
+			wantErr:           false,
+		},
+		{
+			name:              "enabled_empty_password_rejected",
+			enabled:           true,
+			challengePassword: "",
+			wantErr:           true,
+			wantErrSubstring:  "CERTCTL_SCEP_CHALLENGE_PASSWORD",
+		},
+		{
+			name:              "enabled_with_password_ok",
+			enabled:           true,
+			challengePassword: "hunter2",
+			wantErr:           false,
+		},
+		{
+			name:              "enabled_single_char_password_ok",
+			enabled:           true,
+			challengePassword: "x",
+			wantErr:           false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := preflightSCEPChallengePassword(tt.enabled, tt.challengePassword)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("expected error, got nil")
+				}
+				if tt.wantErrSubstring != "" && !strings.Contains(err.Error(), tt.wantErrSubstring) {
+					t.Errorf("expected error to mention %q, got: %v", tt.wantErrSubstring, err)
+				}
+				if !strings.Contains(err.Error(), "CWE-306") {
+					t.Errorf("expected error to cite CWE-306 for traceability, got: %v", err)
+				}
+			} else if err != nil {
+				t.Errorf("expected no error, got: %v", err)
+			}
+		})
+	}
+}

deploy/ENVIRONMENTS.md

@@ -0,0 +1,520 @@
+# certctl Docker Compose Environments
+
+This guide walks through every Docker Compose file in the `deploy/` directory. Each section explains what the environment does, when to use it, every service and environment variable, and the commands to run it. If you've never used Docker before, start with the [Prerequisites](#prerequisites) section. If you're experienced, skip to the environment you need.
+
+## Contents
+
+1. [Prerequisites](#prerequisites)
+2. [How Docker Compose Works (30-Second Version)](#how-docker-compose-works)
+3. [Base Environment (docker-compose.yml)](#base-environment)
+4. [Demo Overlay (docker-compose.demo.yml)](#demo-overlay)
+5. [Development Overlay (docker-compose.dev.yml)](#development-overlay)
+6. [Test Environment (docker-compose.test.yml)](#test-environment)
+7. [Environment Variable Reference](#environment-variable-reference)
+8. [Common Operations](#common-operations)
+
+---
+
+## Prerequisites
+
+You need two things: **Docker** (the container runtime) and **Docker Compose** (an orchestration tool that ships with Docker Desktop).
+
+On macOS:
+```bash
+brew install --cask docker
+```
+
+On Linux (Ubuntu/Debian):
+```bash
+curl -fsSL https://get.docker.com | sh
+sudo usermod -aG docker $USER
+# Log out and back in for group changes to take effect
+```
+
+Verify the install:
+```bash
+docker --version        # Docker Engine 24+ recommended
+docker compose version  # Docker Compose v2+ required (note: no hyphen)
+```
+
+**What Docker actually does:** Docker packages an application and all its dependencies (OS libraries, runtimes, config files) into an isolated unit called a container. When you run `docker compose up`, Docker reads a YAML file that describes multiple containers, creates a private network between them, and starts everything in the right order. Each container sees only its own filesystem and network unless you explicitly share volumes or ports.
+
+**Why this matters for certctl:** Instead of installing PostgreSQL, building Go binaries, configuring the agent, and wiring everything together by hand, one command gives you the complete platform. Each compose file targets a different use case.
+
+---
+
+## How Docker Compose Works
+
+A compose file defines **services** (containers), **networks** (how they talk to each other), and **volumes** (persistent storage). The key concepts:
+
+**Services** are named containers. `certctl-server` is the API and web dashboard. `postgres` is the database. `certctl-agent` polls the server for certificate work.
+
+**Depends_on + healthchecks** control startup order. The server won't start until PostgreSQL reports healthy. The agent won't start until the server reports healthy. This prevents connection errors during boot.
+
+**Volumes** persist data across restarts. `postgres_data` keeps your database between `docker compose down` and `docker compose up`. Adding `-v` to `down` deletes volumes for a clean slate.
+
+**Overlay files** let you layer changes. Running `docker compose -f base.yml -f overlay.yml up` merges both files. The overlay can add services, change environment variables, or mount extra volumes without editing the base.
+
+**Port mapping** (`"8443:8443"`) maps host port (left) to container port (right). After startup, `http://localhost:8443` on your machine reaches the certctl server inside its container.
+
+---
+
+## Base Environment
+
+**File:** `docker-compose.yml`
+**When to use:** Production deployments, first-time setup, or any time you want a clean dashboard with the onboarding wizard.
+
+### What it runs
+
+Three services on a private bridge network:
+
+| Service | Image | Purpose | Ports |
+|---------|-------|---------|-------|
+| `postgres` | `postgres:16-alpine` | Database. Stores certificates, agents, jobs, audit trail, policies, discovery results. | 5432 |
+| `certctl-server` | Built from `Dockerfile` | API server + web dashboard + background scheduler. | 8443 |
+| `certctl-agent` | Built from `Dockerfile.agent` | Polls server for work, generates keys, deploys certificates, discovers existing certs. | none |
+
+### Starting it
+
+```bash
+git clone https://github.com/shankar0123/certctl.git
+cd certctl
+docker compose -f deploy/docker-compose.yml up -d --build
+```
+
+`--build` compiles the Go server and agent from source, including the React frontend. Without it, Docker may reuse a stale image from a previous build.
+
+`-d` runs in detached mode (background). Omit it to see logs in your terminal.
+
+Wait about 30 seconds, then verify:
+```bash
+docker compose -f deploy/docker-compose.yml ps
+# All three services should show "Up (healthy)"
+
+curl http://localhost:8443/health
+# {"status":"healthy"}
+```
+
+Open **http://localhost:8443** in your browser. You'll see the onboarding wizard guiding you through: connecting a CA, deploying an agent, and adding your first certificate.
+
+### Service-by-service walkthrough
+
+#### PostgreSQL
+
+```yaml
+postgres:
+  image: postgres:16-alpine
+  environment:
+    POSTGRES_DB: certctl
+    POSTGRES_USER: certctl
+    POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-certctl}
+```
+
+Alpine-based PostgreSQL 16. The `${POSTGRES_PASSWORD:-certctl}` syntax means: use the `POSTGRES_PASSWORD` environment variable from your shell if set, otherwise default to `certctl`. For production, create a `.env` file:
+
+```bash
+echo 'POSTGRES_PASSWORD=your-secure-password-here' > deploy/.env
+```
+
+The `volumes` section mounts 10 migration files into PostgreSQL's init directory (`/docker-entrypoint-initdb.d/`). PostgreSQL runs these SQL files in alphabetical order on first boot only. They create the schema (tables, indexes, constraints) and seed the base data (default issuer, default policy). If the `postgres_data` volume already exists with an initialized database, these scripts are skipped entirely.
+
+**Expert note:** The numbered prefix pattern (`001_`, `002_`, ..., `020_`) ensures deterministic execution order. All migrations use `IF NOT EXISTS` and `ON CONFLICT DO NOTHING` for idempotency, so re-running them against an existing database is safe.
+
+#### certctl Server
+
+```yaml
+certctl-server:
+  depends_on:
+    postgres:
+      condition: service_healthy
+  environment:
+    CERTCTL_DATABASE_URL: postgres://certctl:${POSTGRES_PASSWORD:-certctl}@postgres:5432/certctl?sslmode=disable
+    CERTCTL_SERVER_HOST: 0.0.0.0
+    CERTCTL_SERVER_PORT: 8443
+    CERTCTL_LOG_LEVEL: info
+    CERTCTL_AUTH_TYPE: none
+    CERTCTL_KEYGEN_MODE: server
+    CERTCTL_NETWORK_SCAN_ENABLED: "true"
+    CERTCTL_CONFIG_ENCRYPTION_KEY: ${CERTCTL_CONFIG_ENCRYPTION_KEY:-change-me-32-char-encryption-key}
+```
+
+The server is the control plane. It serves the REST API, the React dashboard, runs 7 background scheduler loops (renewal, job processing, health checks, notifications, short-lived cert expiry, network scanning, digest emails), and manages the issuer/target registry.
+
+Key environment variables explained:
+
+- `CERTCTL_DATABASE_URL` references the `postgres` service by hostname. Docker's internal DNS resolves `postgres` to the container's IP on the bridge network. `sslmode=disable` is appropriate because traffic stays on the private Docker network.
+- `CERTCTL_AUTH_TYPE: none` disables API key authentication so you can explore immediately. For production, set `api-key` and configure `CERTCTL_AUTH_SECRET`.
+- `CERTCTL_KEYGEN_MODE: server` means the server generates private keys. This is convenient for demos but insecure for production. In production, set `agent` so keys are generated on agent machines and never transmitted.
+- `CERTCTL_CONFIG_ENCRYPTION_KEY` enables AES-256-GCM encryption for issuer and target configurations stored in the database (credentials, API keys). Without this, the dynamic configuration GUI (adding issuers/targets from the dashboard) won't encrypt sensitive fields. For production, generate a strong random key.
+- `CERTCTL_NETWORK_SCAN_ENABLED` activates the scheduler loop that probes TLS endpoints on your network to discover certificates you might not be managing.
+
+**Expert note:** The healthcheck hits `GET /health` every 10 seconds with 5 retries. The `depends_on: condition: service_healthy` on the agent means Docker holds agent startup until this check passes. Resource limits (`cpus: '1.0'`, `memory: 512M`) prevent the server from consuming unbounded resources in shared environments.
+
+#### certctl Agent
+
+```yaml
+certctl-agent:
+  depends_on:
+    certctl-server:
+      condition: service_healthy
+  environment:
+    CERTCTL_SERVER_URL: http://certctl-server:8443
+    CERTCTL_API_KEY: ${CERTCTL_API_KEY:-change-me-in-production}
+    CERTCTL_AGENT_NAME: docker-agent
+    CERTCTL_LOG_LEVEL: info
+    CERTCTL_DISCOVERY_DIRS: /var/lib/certctl/keys
+  volumes:
+    - agent_keys:/var/lib/certctl/keys
+```
+
+The agent is a lightweight Go binary that polls the server for pending work (certificate deployments, CSR generation requests), executes that work locally, and reports results back. It also scans configured directories for existing certificates (filesystem discovery).
+
+- `CERTCTL_SERVER_URL` uses the Docker internal hostname `certctl-server`. This resolves inside the Docker network only.
+- `CERTCTL_DISCOVERY_DIRS` tells the agent which directories to scan for existing certificates. The agent walks these directories recursively, parses PEM and DER files, and reports findings to the server for triage.
+- The `agent_keys` volume persists private keys generated by the agent across container restarts. Without this volume, keys would be lost when the container stops.
+
+**Expert note:** The agent's healthcheck uses `pgrep` because the agent doesn't expose an HTTP endpoint. The `restart: unless-stopped` policy means Docker automatically restarts the agent on crashes but respects manual `docker compose stop` commands.
+
+### Stopping and cleaning up
+
+```bash
+# Stop containers but keep data
+docker compose -f deploy/docker-compose.yml down
+
+# Stop and delete all data (database, keys, volumes)
+docker compose -f deploy/docker-compose.yml down -v
+```
+
+---
+
+## Demo Overlay
+
+**File:** `docker-compose.demo.yml`
+**When to use:** Demos, screenshots, stakeholder presentations, or any time you want a populated dashboard on first boot.
+
+### What it adds
+
+One line: mounts `seed_demo.sql` into PostgreSQL's init directory. This 667-line SQL file inserts 180 days of simulated operational history: teams, owners, certificates across multiple issuers, agents on different platforms, jobs with realistic timestamps, discovery scan results, audit events, policies, and profiles.
+
+### Starting it
+
+```bash
+docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.demo.yml up -d --build
+```
+
+The `-f` flags are ordered: base first, overlay second. Docker merges them. The demo overlay adds the seed_demo.sql volume mount to the `postgres` service defined in the base file.
+
+### What you see
+
+The dashboard shows pre-populated charts: expiration heatmap with upcoming renewals, status distribution across Active/Expiring/Expired/Failed states, 30-day job trends, and issuance rates. The sidebar pages (Certificates, Agents, Discovery, Jobs, etc.) all have data to explore.
+
+### Resetting demo data
+
+```bash
+docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.demo.yml down -v
+docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.demo.yml up -d --build
+```
+
+The `down -v` deletes the `postgres_data` volume. On next boot, PostgreSQL re-runs all init scripts including the demo seed, giving you a clean starting point.
+
+**Expert note:** The demo overlay is a pure data layer, not a configuration change. The server, agent, and their environment variables remain identical to the base. This means any behavior you see in the demo is exactly what the base environment produces once you populate data through normal operations.
+
+---
+
+## Development Overlay
+
+**File:** `docker-compose.dev.yml`
+**When to use:** When you're contributing to certctl and need debug logging, database inspection, or a debugger attached to the server process.
+
+### What it adds
+
+| Addition | Purpose |
+|----------|---------|
+| Debug-level logging on server and agent | See every HTTP request, scheduler tick, and connector operation |
+| PgAdmin on port 5050 | Visual database browser for inspecting tables, running queries |
+| Delve debugger port 40000 | Attach a Go debugger to the running server process |
+
+### Starting it
+
+```bash
+docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.dev.yml up --build
+```
+
+Omit `-d` during development so you see logs streaming in your terminal.
+
+### Using PgAdmin
+
+Open **http://localhost:5050** in your browser. PgAdmin is pre-configured in desktop mode (no login required). To connect to the certctl database:
+
+1. Right-click "Servers" in the left panel, choose "Register" > "Server"
+2. Name: `certctl`
+3. Connection tab: Host = `postgres`, Port = `5432`, Username = `certctl`, Password = `certctl` (or whatever you set in `.env`)
+
+From there you can browse all 19 tables, inspect certificate records, view audit events, check the scheduler's job queue, and run arbitrary SQL.
+
+### Using the Delve debugger
+
+Port 40000 is exposed for remote debugging. To use it, you'd need to modify the Dockerfile to build with debug symbols and start the server under Delve:
+
+```bash
+# In Dockerfile, replace the CMD with:
+CMD ["dlv", "--listen=:40000", "--headless=true", "--api-version=2", "exec", "/app/server"]
+```
+
+Then attach from your IDE (VS Code, GoLand) using remote debug configuration pointing to `localhost:40000`.
+
+### Hot reload
+
+The dev overlay includes commented-out volume mounts for source code directories. Uncomment them and install [air](https://github.com/cosmtrek/air) to get automatic recompilation on file changes:
+
+```bash
+go install github.com/cosmtrek/air@latest
+```
+
+**Expert note:** The `builds: context: ..` in the dev overlay overrides the base service's image reference, forcing a local build from the repository root. This means changes to your Go source code are compiled fresh on each `docker compose up --build`.
+
+---
+
+## Test Environment
+
+**File:** `docker-compose.test.yml`
+**When to use:** Integration testing against real CA backends. This is a standalone environment (not an overlay) with 7 containers on a static-IP subnet.
+
+### What it runs
+
+| Service | IP | Purpose |
+|---------|----|---------|
+| `postgres` | 10.30.50.2 | Database (clean, no demo data) |
+| `pebble-challtestsrv` | 10.30.50.3 | DNS/HTTP challenge test server for Pebble |
+| `pebble` | 10.30.50.4 | ACME test server (simulates Let's Encrypt) |
+| `step-ca` | 10.30.50.5 | Private CA (Smallstep, JWK provisioner) |
+| `certctl-server` | 10.30.50.6 | Control plane with all issuers configured |
+| `nginx` | 10.30.50.7 | TLS target server for deployment testing |
+| `certctl-agent` | 10.30.50.8 | Agent with NGINX volume + discovery |
+
+### Why static IPs?
+
+Pebble (the ACME test server) validates HTTP-01 challenges by connecting to the challenge URL. It resolves domain names via `pebble-challtestsrv`, which is configured to return `10.30.50.6` (the certctl server) for all lookups. Without static IPs, container IPs would be assigned randomly on each boot, breaking the challenge validation chain.
+
+The `/24` subnet (10.30.50.0/24) provides 254 usable addresses, far more than needed but standard practice for test networks.
+
+### Starting it
+
+```bash
+docker compose -f deploy/docker-compose.test.yml up --build
+```
+
+Wait for all health checks to pass (about 60 seconds for step-ca's first-run bootstrap). Then:
+
+```bash
+# Dashboard with auth enabled
+open http://localhost:8443
+# API key: test-key-2026
+
+# NGINX serving a self-signed placeholder
+curl -k https://localhost:8444
+```
+
+### What's different from the base
+
+The test environment is configured for production-like behavior:
+
+- **API key auth enabled** (`CERTCTL_AUTH_TYPE: api-key`, `CERTCTL_AUTH_SECRET: test-key-2026`). Every API request needs `Authorization: Bearer test-key-2026`.
+- **Agent-side key generation** (`CERTCTL_KEYGEN_MODE: agent`). The agent generates ECDSA P-256 keys locally and submits only the CSR to the server. Private keys never leave the agent container.
+- **Three real issuers configured:**
+  - **Local CA** (self-signed) for instant issuance testing
+  - **ACME via Pebble** for Let's Encrypt-compatible flow testing (HTTP-01 challenges validated through the challenge test server)
+  - **step-ca** for private CA testing with JWK provisioner authentication
+- **EST server enabled** (`CERTCTL_EST_ENABLED: "true"`) for RFC 7030 enrollment testing
+- **Post-deployment verification enabled** (`CERTCTL_VERIFY_DEPLOYMENT: "true"`) so the agent probes NGINX after deploying a cert and confirms the TLS fingerprint matches
+- **Dynamic config encryption enabled** (`CERTCTL_CONFIG_ENCRYPTION_KEY`) so issuer/target configs added through the GUI are encrypted at rest
+- **TLS trust bootstrapping:** The server runs a `setup-trust.sh` entrypoint that fetches Pebble's root CA from its management API and copies step-ca's root cert from a shared volume, then runs `update-ca-certificates` before starting the server binary. This is necessary because both CAs use self-signed roots that aren't in Alpine's default trust store.
+
+### Running the Go integration tests
+
+The test environment is designed to support the Go integration test suite at `deploy/test/integration_test.go`:
+
+```bash
+# Start the environment
+docker compose -f deploy/docker-compose.test.yml up --build -d
+
+# Wait for health checks
+sleep 30
+
+# Run integration tests (from repo root)
+go test -tags integration -v ./deploy/test/...
+```
+
+The integration tests exercise 12 phases: health, agent heartbeat, Local CA issuance, ACME issuance, renewal, step-ca issuance, revocation + CRL + OCSP, EST enrollment, S/MIME issuance, discovery, network scan, and deployment verification. PostgreSQL port 5432 is exposed so the test binary can query the database directly for assertions.
+
+See [docs/test-env.md](../docs/test-env.md) for the full walkthrough and manual QA procedures.
+
+### Stopping and cleaning up
+
+```bash
+# Stop but keep data (volumes persist)
+docker compose -f deploy/docker-compose.test.yml down
+
+# Full reset (delete step-ca bootstrap, database, agent keys, NGINX certs)
+docker compose -f deploy/docker-compose.test.yml down -v
+```
+
+**Expert note:** The step-ca container auto-bootstraps on first run: generates a root CA, creates a JWK provisioner named "admin" with password "password123", and writes everything to the `stepca_data` volume. Subsequent starts reuse this volume. If you `down -v`, the next boot generates a new root CA, which means all previously issued step-ca certs become untrusted.
+
+---
+
+## Environment Variable Reference
+
+Every `CERTCTL_*` environment variable is read by the server's `internal/config/config.go` via `os.Getenv`. If the prefix is missing, the variable is silently ignored.
+
+### Server
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_DATABASE_URL` | (required) | PostgreSQL connection string |
+| `CERTCTL_SERVER_HOST` | `0.0.0.0` | Listen address |
+| `CERTCTL_SERVER_PORT` | `8443` | Listen port |
+| `CERTCTL_LOG_LEVEL` | `info` | Log verbosity: `debug`, `info`, `warn`, `error` |
+| `CERTCTL_AUTH_TYPE` | `api-key` | Auth mode: `api-key` or `none` |
+| `CERTCTL_AUTH_SECRET` | (none) | API key(s), comma-separated for rotation |
+| `CERTCTL_KEYGEN_MODE` | `agent` | Key generation: `agent` (production) or `server` (demo) |
+| `CERTCTL_CONFIG_ENCRYPTION_KEY` | (none) | AES-256-GCM key for encrypting issuer/target configs in DB |
+| `CERTCTL_NETWORK_SCAN_ENABLED` | `false` | Enable network TLS scanning scheduler loop |
+| `CERTCTL_NETWORK_SCAN_INTERVAL` | `6h` | How often the network scanner runs |
+| `CERTCTL_MAX_BODY_SIZE` | `1048576` | Max request body size in bytes (1MB) |
+| `CERTCTL_CORS_ORIGINS` | (empty) | Allowed CORS origins, comma-separated. Empty = deny all cross-origin |
+| `CERTCTL_RATE_LIMIT_RPS` | `10` | Requests per second per client |
+| `CERTCTL_RATE_LIMIT_BURST` | `20` | Burst allowance above RPS |
+
+### Agent
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_SERVER_URL` | (required) | Server API URL |
+| `CERTCTL_API_KEY` | (none) | API key for authenticating with server |
+| `CERTCTL_AGENT_NAME` | (hostname) | Display name in dashboard |
+| `CERTCTL_AGENT_ID` | (auto-generated) | Stable agent identifier |
+| `CERTCTL_KEYGEN_MODE` | `agent` | Must match server setting |
+| `CERTCTL_LOG_LEVEL` | `info` | Log verbosity |
+| `CERTCTL_KEY_DIR` | `/var/lib/certctl/keys` | Directory for private key storage (0600 perms) |
+| `CERTCTL_DISCOVERY_DIRS` | (none) | Comma-separated paths to scan for existing certs |
+
+### Issuers (Server)
+
+| Variable | Description |
+|----------|-------------|
+| `CERTCTL_ACME_DIRECTORY_URL` | ACME CA directory (e.g., Let's Encrypt, Pebble) |
+| `CERTCTL_ACME_EMAIL` | ACME account email |
+| `CERTCTL_ACME_CHALLENGE_TYPE` | `http-01`, `dns-01`, or `dns-persist-01` |
+| `CERTCTL_ACME_INSECURE` | Skip TLS verification for ACME CA (test only) |
+| `CERTCTL_ACME_EAB_KID` / `CERTCTL_ACME_EAB_HMAC` | External Account Binding for ZeroSSL, Google Trust Services |
+| `CERTCTL_ACME_ARI_ENABLED` | Enable RFC 9773 Renewal Information |
+| `CERTCTL_ACME_PROFILE` | ACME profile (`tlsserver`, `shortlived`) |
+| `CERTCTL_STEPCA_URL` | step-ca server URL |
+| `CERTCTL_STEPCA_ROOT_CERT` | Path to step-ca root CA cert |
+| `CERTCTL_STEPCA_PROVISIONER` | Provisioner name |
+| `CERTCTL_STEPCA_PASSWORD` | Provisioner password |
+| `CERTCTL_STEPCA_KEY_PATH` | Path to provisioner key |
+| `CERTCTL_CA_CERT_PATH` / `CERTCTL_CA_KEY_PATH` | Sub-CA mode: load CA cert+key from disk |
+| `CERTCTL_VAULT_ADDR` | Vault server address |
+| `CERTCTL_VAULT_TOKEN` | Vault auth token |
+| `CERTCTL_VAULT_MOUNT` | PKI secrets engine mount (default: `pki`) |
+| `CERTCTL_VAULT_ROLE` | PKI role name |
+| `CERTCTL_DIGICERT_API_KEY` | DigiCert CertCentral API key |
+| `CERTCTL_DIGICERT_ORG_ID` | DigiCert organization ID |
+| `CERTCTL_SECTIGO_CUSTOMER_URI` / `_LOGIN` / `_PASSWORD` | Sectigo SCM auth |
+| `CERTCTL_GOOGLE_CAS_PROJECT` / `_LOCATION` / `_CA_POOL` / `_CREDENTIALS` | Google CAS config |
+
+### EST Server
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_EST_ENABLED` | `false` | Enable RFC 7030 EST endpoints |
+| `CERTCTL_EST_ISSUER_ID` | `iss-local` | Which issuer processes EST enrollments |
+| `CERTCTL_EST_PROFILE_ID` | (none) | Optional profile constraint |
+
+### Post-Deployment Verification
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_VERIFY_DEPLOYMENT` | `false` | Agent probes TLS after deploying |
+| `CERTCTL_VERIFY_TIMEOUT` | `10s` | TLS probe timeout |
+| `CERTCTL_VERIFY_DELAY` | `2s` | Wait before probing (let service reload) |
+
+### Notifications
+
+| Variable | Description |
+|----------|-------------|
+| `CERTCTL_SMTP_HOST` / `_PORT` / `_USERNAME` / `_PASSWORD` / `_FROM_ADDRESS` / `_USE_TLS` | SMTP email |
+| `CERTCTL_SLACK_WEBHOOK_URL` / `_CHANNEL` / `_USERNAME` | Slack notifications |
+| `CERTCTL_TEAMS_WEBHOOK_URL` | Microsoft Teams |
+| `CERTCTL_PAGERDUTY_ROUTING_KEY` / `_SEVERITY` | PagerDuty alerts |
+| `CERTCTL_OPSGENIE_API_KEY` / `_PRIORITY` | OpsGenie alerts |
+| `CERTCTL_DIGEST_ENABLED` / `_INTERVAL` / `_RECIPIENTS` | Scheduled digest email |
+
+---
+
+## Common Operations
+
+### Viewing logs
+
+```bash
+# All services
+docker compose -f deploy/docker-compose.yml logs -f
+
+# Single service
+docker compose -f deploy/docker-compose.yml logs -f certctl-server
+
+# Last 100 lines
+docker compose -f deploy/docker-compose.yml logs --tail 100 certctl-server
+```
+
+### Rebuilding after code changes
+
+```bash
+docker compose -f deploy/docker-compose.yml up -d --build
+```
+
+Docker only rebuilds images that have changed source files. The `--build` flag is essential after editing Go code or frontend files.
+
+### Connecting to the database directly
+
+```bash
+docker exec -it certctl-postgres psql -U certctl -d certctl
+```
+
+Useful queries:
+```sql
+-- Certificate inventory
+SELECT id, common_name, status, expires_at FROM managed_certificates ORDER BY expires_at;
+
+-- Recent jobs
+SELECT id, type, status, certificate_id, created_at FROM jobs ORDER BY created_at DESC LIMIT 20;
+
+-- Audit trail
+SELECT event_type, actor, resource_id, created_at FROM audit_events ORDER BY created_at DESC LIMIT 20;
+
+-- Issuer configurations (encrypted_config is AES-256-GCM)
+SELECT id, type, source, enabled, test_status FROM issuers;
+```
+
+### Checking container resource usage
+
+```bash
+docker stats --no-stream
+```
+
+### Upgrading
+
+```bash
+git pull
+docker compose -f deploy/docker-compose.yml up -d --build
+```
+
+Migrations are idempotent (`IF NOT EXISTS`), so upgrading to a version with new schema changes is safe. PostgreSQL only runs init scripts on first boot of a fresh volume, so new migrations in an upgrade require running them manually:
+
+```bash
+docker exec -i certctl-postgres psql -U certctl -d certctl < migrations/000011_new_feature.up.sql
+```
+
+Or, for a clean upgrade: `down -v` and `up --build` (loses existing data).

deploy/docker-compose.demo.yml

@@ -0,0 +1,14 @@
+# Demo mode: pre-populated dashboard with 32 certificates, 8 agents, 10 issuers, etc.
+# Use this to showcase certctl's dashboard with realistic data.
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.demo.yml up --build
+#
+# To start fresh (wipe previous data):
+#   docker compose -f docker-compose.yml -f docker-compose.demo.yml down -v
+#   docker compose -f docker-compose.yml -f docker-compose.demo.yml up --build
+
+services:
+  postgres:
+    volumes:
+      - ../migrations/seed_demo.sql:/docker-entrypoint-initdb.d/030_seed_demo.sql

deploy/docker-compose.dev.yml

@@ -9,11 +9,21 @@ services:
     build:
       context: ..
       dockerfile: Dockerfile
+      # Proxy propagation (M-4, Issue #9) — forwards host shell's proxy env
+      # vars into the Docker build so the Node frontend stage and Go module
+      # download can reach the public registries behind corporate proxies.
+      # Defaults to empty; omit the variables from the host environment for
+      # un-proxied builds and the behaviour is byte-identical to the pre-fix
+      # tree.
+      args:
+        HTTP_PROXY: ${HTTP_PROXY:-}
+        HTTPS_PROXY: ${HTTPS_PROXY:-}
+        NO_PROXY: ${NO_PROXY:-}
     environment:
       # Verbose logging for development
-      LOG_LEVEL: debug
-      SERVER_HOST: 0.0.0.0
-      SERVER_PORT: 8443
+      CERTCTL_LOG_LEVEL: debug
+      CERTCTL_SERVER_HOST: 0.0.0.0
+      CERTCTL_SERVER_PORT: "8443"
     volumes:
       # Mount local source for hot reload (requires air or similar)
       # Uncomment if using air or similar for hot reload:
@@ -29,8 +39,17 @@ services:
     build:
       context: ..
       dockerfile: Dockerfile.agent
+      # Proxy propagation (M-4, Issue #9) — forwards host shell's proxy env
+      # vars into the Docker build so the Go module download stage can reach
+      # the public Go module proxy behind corporate proxies. Defaults to
+      # empty; omit the variables from the host environment for un-proxied
+      # builds and the behaviour is byte-identical to the pre-fix tree.
+      args:
+        HTTP_PROXY: ${HTTP_PROXY:-}
+        HTTPS_PROXY: ${HTTPS_PROXY:-}
+        NO_PROXY: ${NO_PROXY:-}
     environment:
-      LOG_LEVEL: debug
+      CERTCTL_LOG_LEVEL: debug
 
   # PgAdmin for database exploration
   pgadmin:

deploy/docker-compose.test.yml

@@ -0,0 +1,333 @@
+# =============================================================================
+# certctl Testing Environment — Docker Compose
+# =============================================================================
+#
+# Spins up the full certctl platform with real CA backends for manual QA:
+#
+#   1. PostgreSQL 16        — database (clean, no demo data)
+#   2. certctl-server       — control plane API + web dashboard on :8443
+#   3. certctl-agent        — polls for work, deploys certs to NGINX
+#   4. step-ca              — private CA (JWK provisioner, auto-bootstraps)
+#   5. Pebble               — ACME test server (simulates Let's Encrypt)
+#   6. pebble-challtestsrv  — DNS/HTTP challenge test server for Pebble
+#   7. NGINX                — TLS target server on :8080 (HTTP) / :8444 (HTTPS)
+#
+# Usage:
+#   cd deploy
+#   docker compose -f docker-compose.test.yml up --build
+#
+# Dashboard:  http://localhost:8443
+# API key:    test-key-2026
+# NGINX:      https://localhost:8444 (self-signed placeholder until cert deployed)
+#
+# See docs/test-env.md for the full walkthrough.
+# =============================================================================
+
+services:
+
+  # ---------------------------------------------------------------------------
+  # Database
+  # ---------------------------------------------------------------------------
+  postgres:
+    image: postgres:16-alpine
+    container_name: certctl-test-postgres
+    environment:
+      POSTGRES_DB: certctl
+      POSTGRES_USER: certctl
+      POSTGRES_PASSWORD: testpass
+    volumes:
+      - test_postgres_data:/var/lib/postgresql/data
+      - ../migrations/000001_initial_schema.up.sql:/docker-entrypoint-initdb.d/001_schema.sql
+      - ../migrations/000002_agent_metadata.up.sql:/docker-entrypoint-initdb.d/002_agent_metadata.sql
+      - ../migrations/000003_certificate_profiles.up.sql:/docker-entrypoint-initdb.d/003_certificate_profiles.sql
+      - ../migrations/000004_agent_groups.up.sql:/docker-entrypoint-initdb.d/004_agent_groups.sql
+      - ../migrations/000005_revocation.up.sql:/docker-entrypoint-initdb.d/005_revocation.sql
+      - ../migrations/000006_discovery.up.sql:/docker-entrypoint-initdb.d/006_discovery.sql
+      - ../migrations/000007_network_discovery.up.sql:/docker-entrypoint-initdb.d/007_network_discovery.sql
+      - ../migrations/000008_verification.up.sql:/docker-entrypoint-initdb.d/008_verification.sql
+      - ../migrations/000009_issuer_config.up.sql:/docker-entrypoint-initdb.d/009_issuer_config.sql
+      - ../migrations/000010_target_config.up.sql:/docker-entrypoint-initdb.d/010_target_config.sql
+      - ../migrations/seed.sql:/docker-entrypoint-initdb.d/020_seed.sql
+      - ../migrations/seed_test.sql:/docker-entrypoint-initdb.d/025_seed_test.sql
+      # No seed_demo.sql — start with a clean database for real testing
+    networks:
+      certctl-test:
+        ipv4_address: 10.30.50.2
+    ports:
+      - "5432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U certctl -d certctl"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  # ---------------------------------------------------------------------------
+  # Pebble — ACME test server (simulates Let's Encrypt)
+  # ---------------------------------------------------------------------------
+  # Pebble is the official ACME test server from Let's Encrypt (RFC 8555).
+  # It validates challenges via the companion challtestsrv.
+  # Root CA cert available at https://pebble:15000/roots/0 (management API).
+  pebble-challtestsrv:
+    image: ghcr.io/letsencrypt/pebble-challtestsrv:latest
+    container_name: certctl-test-challtestsrv
+    # ENTRYPOINT is /app (the binary). command: provides only the FLAGS.
+    # Matches the official Pebble docker-compose format.
+    # -doh "" disables DoH (default :8443 would conflict with certctl server).
+    # defaultIPv4 must point to the certctl-server (10.30.50.6) because that's where
+    # the ACME HTTP-01 challenge server runs (port 80 inside the container).
+    # Pebble resolves domains via challtestsrv, then connects to this IP to validate.
+    command: -defaultIPv4 10.30.50.6 -defaultIPv6 "" -doh ""
+    networks:
+      certctl-test:
+        ipv4_address: 10.30.50.3
+    restart: unless-stopped
+
+  pebble:
+    image: ghcr.io/letsencrypt/pebble:latest
+    container_name: certctl-test-pebble
+    depends_on:
+      - pebble-challtestsrv
+    environment:
+      PEBBLE_VA_NOSLEEP: 1
+      PEBBLE_VA_ALWAYS_VALID: 0
+    # ENTRYPOINT is /app (the binary). command: provides only the FLAGS.
+    command:
+      - -config
+      - /test/config/pebble-config.json
+      - -dnsserver
+      - "10.30.50.3:8053"
+      - -strict
+    volumes:
+      - ./test/pebble-config.json:/test/config/pebble-config.json:ro
+    networks:
+      certctl-test:
+        ipv4_address: 10.30.50.4
+    restart: unless-stopped
+
+  # ---------------------------------------------------------------------------
+  # step-ca — Private CA (Smallstep)
+  # ---------------------------------------------------------------------------
+  # Auto-bootstraps on first run: generates root CA + JWK provisioner "admin".
+  # Root cert: /home/step/certs/root_ca.crt (inside stepca_data volume)
+  # Provisioner key: /home/step/secrets/provisioner_key (encrypted JWK)
+  step-ca:
+    image: smallstep/step-ca:latest
+    container_name: certctl-test-stepca
+    environment:
+      DOCKER_STEPCA_INIT_NAME: "certctl-test-ca"
+      DOCKER_STEPCA_INIT_DNS_NAMES: "step-ca,localhost"
+      DOCKER_STEPCA_INIT_PROVISIONER_NAME: "admin"
+      DOCKER_STEPCA_INIT_PASSWORD: "password123"
+      DOCKER_STEPCA_INIT_ADDRESS: ":9000"
+    volumes:
+      - stepca_data:/home/step
+    networks:
+      certctl-test:
+        ipv4_address: 10.30.50.5
+    healthcheck:
+      test: ["CMD", "curl", "-fk", "https://localhost:9000/health"]
+      interval: 10s
+      timeout: 5s
+      start_period: 15s
+      retries: 10
+    restart: unless-stopped
+
+  # ---------------------------------------------------------------------------
+  # certctl Server (Control Plane)
+  # ---------------------------------------------------------------------------
+  # Connects to PostgreSQL, Pebble (ACME), step-ca, and Local CA.
+  #
+  # TLS trust problem: Pebble and step-ca use self-signed root CAs that
+  # aren't in Alpine's trust store. The ACME and step-ca connectors use
+  # Go's default http.Client (no InsecureSkipVerify), so they need the
+  # CA certs in the system trust store.
+  #
+  # Solution: setup-trust.sh runs as root, fetches Pebble CA from its
+  # management API, copies step-ca root cert from the shared volume,
+  # runs update-ca-certificates, then execs the server binary.
+  certctl-server:
+    build:
+      context: ..
+      dockerfile: Dockerfile
+      # Proxy propagation (M-4, Issue #9) — forwards host shell's proxy env
+      # vars into the Docker build so the Node frontend stage and Go module
+      # download can reach the public registries behind corporate proxies.
+      # Defaults to empty; omit the variables from the host environment for
+      # un-proxied builds and the behaviour is byte-identical to the pre-fix
+      # tree.
+      args:
+        HTTP_PROXY: ${HTTP_PROXY:-}
+        HTTPS_PROXY: ${HTTPS_PROXY:-}
+        NO_PROXY: ${NO_PROXY:-}
+    container_name: certctl-test-server
+    depends_on:
+      postgres:
+        condition: service_healthy
+      pebble:
+        condition: service_started
+      step-ca:
+        condition: service_healthy
+    # Run as root so update-ca-certificates can write to /etc/ssl/certs.
+    # Container isolation provides the security boundary.
+    user: "0:0"
+    entrypoint: ["/bin/sh", "/app/setup-trust.sh"]
+    environment:
+      # Database
+      CERTCTL_DATABASE_URL: postgres://certctl:testpass@postgres:5432/certctl?sslmode=disable
+
+      # Server
+      CERTCTL_SERVER_HOST: 0.0.0.0
+      CERTCTL_SERVER_PORT: 8443
+      CERTCTL_LOG_LEVEL: debug
+
+      # Auth — API key required (production-like)
+      CERTCTL_AUTH_TYPE: api-key
+      CERTCTL_AUTH_SECRET: test-key-2026
+
+      # Key generation — agent-side (production-like)
+      CERTCTL_KEYGEN_MODE: agent
+
+      # Local CA issuer (iss-local) — self-signed mode (no CA cert/key paths)
+      # This is the simplest issuer, always available.
+
+      # ACME issuer (iss-acme-staging) — pointed at Pebble
+      CERTCTL_ACME_DIRECTORY_URL: https://pebble:14000/dir
+      CERTCTL_ACME_EMAIL: test@certctl.dev
+      CERTCTL_ACME_CHALLENGE_TYPE: http-01
+      CERTCTL_ACME_INSECURE: "true"
+
+      # step-ca issuer (iss-stepca)
+      CERTCTL_STEPCA_URL: https://step-ca:9000
+      CERTCTL_STEPCA_ROOT_CERT: /stepca-data/certs/root_ca.crt
+      CERTCTL_STEPCA_PROVISIONER: admin
+      CERTCTL_STEPCA_PASSWORD: password123
+      CERTCTL_STEPCA_KEY_PATH: /stepca-data/secrets/provisioner_key
+
+      # EST server (RFC 7030) — uses Local CA by default
+      CERTCTL_EST_ENABLED: "true"
+      CERTCTL_EST_ISSUER_ID: iss-local
+
+      # Dynamic issuer/target config encryption (M34/M35)
+      CERTCTL_CONFIG_ENCRYPTION_KEY: test-encryption-key-32chars!!
+
+      # Network scanning
+      CERTCTL_NETWORK_SCAN_ENABLED: "true"
+
+      # Post-deployment TLS verification
+      CERTCTL_VERIFY_DEPLOYMENT: "true"
+      CERTCTL_VERIFY_TIMEOUT: "10s"
+      CERTCTL_VERIFY_DELAY: "3s"
+    ports:
+      - "8443:8443"
+    volumes:
+      - ./test/setup-trust.sh:/app/setup-trust.sh:ro
+      # step-ca data volume (root cert at /certs/root_ca.crt, key at /secrets/provisioner_key)
+      - stepca_data:/stepca-data:ro
+    networks:
+      certctl-test:
+        ipv4_address: 10.30.50.6
+    healthcheck:
+      # /health requires auth when CERTCTL_AUTH_TYPE=api-key, so include the Bearer token
+      test: ["CMD", "curl", "-f", "-H", "Authorization: Bearer test-key-2026", "http://localhost:8443/health"]
+      interval: 10s
+      timeout: 5s
+      start_period: 30s
+      retries: 10
+    restart: unless-stopped
+
+  # ---------------------------------------------------------------------------
+  # NGINX — TLS Target Server
+  # ---------------------------------------------------------------------------
+  # The agent deploys certificates here via the shared nginx_certs volume.
+  # nginx-entrypoint.sh generates a self-signed placeholder cert so NGINX
+  # can boot before the agent deploys a real cert.
+  #
+  # Ports: 8080 (HTTP) / 8444 (HTTPS) — offset to avoid conflict with server.
+  nginx:
+    image: nginx:alpine
+    container_name: certctl-test-nginx
+    entrypoint: ["/bin/sh", "/entrypoint.sh"]
+    volumes:
+      - ./test/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./test/nginx-entrypoint.sh:/entrypoint.sh:ro
+      - nginx_certs:/etc/nginx/certs
+    ports:
+      - "8080:80"
+      - "8444:443"
+    networks:
+      certctl-test:
+        ipv4_address: 10.30.50.7
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fk https://localhost/health || exit 1"]
+      interval: 10s
+      timeout: 5s
+      start_period: 15s
+      retries: 5
+    restart: unless-stopped
+
+  # ---------------------------------------------------------------------------
+  # certctl Agent
+  # ---------------------------------------------------------------------------
+  # Polls the server for work, generates ECDSA P-256 keys locally,
+  # deploys certs to NGINX via the shared volume, and discovers existing
+  # certs in the NGINX cert directory.
+  certctl-agent:
+    build:
+      context: ..
+      dockerfile: Dockerfile.agent
+      # Proxy propagation (M-4, Issue #9) — forwards host shell's proxy env
+      # vars into the Docker build so the Go module download stage can reach
+      # the public Go module proxy behind corporate proxies. Defaults to
+      # empty; omit the variables from the host environment for un-proxied
+      # builds and the behaviour is byte-identical to the pre-fix tree.
+      args:
+        HTTP_PROXY: ${HTTP_PROXY:-}
+        HTTPS_PROXY: ${HTTPS_PROXY:-}
+        NO_PROXY: ${NO_PROXY:-}
+    container_name: certctl-test-agent
+    depends_on:
+      certctl-server:
+        condition: service_healthy
+    environment:
+      CERTCTL_SERVER_URL: http://certctl-server:8443
+      CERTCTL_API_KEY: test-key-2026
+      CERTCTL_AGENT_NAME: test-agent-01
+      CERTCTL_AGENT_ID: agent-test-01
+      CERTCTL_KEYGEN_MODE: agent
+      CERTCTL_LOG_LEVEL: debug
+      CERTCTL_DISCOVERY_DIRS: /nginx-certs
+    volumes:
+      - agent_keys:/var/lib/certctl/keys
+      - nginx_certs:/nginx-certs
+    networks:
+      certctl-test:
+        ipv4_address: 10.30.50.8
+    restart: unless-stopped
+
+# =============================================================================
+# Network
+# =============================================================================
+# Static IPs are required because:
+# - Pebble needs to know the challtestsrv DNS server address (10.30.50.3)
+# - challtestsrv resolves all domains to certctl-server (10.30.50.6) for HTTP-01 challenges
+# - Avoids DNS race conditions during startup
+networks:
+  certctl-test:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.30.50.0/24
+
+# =============================================================================
+# Volumes
+# =============================================================================
+volumes:
+  test_postgres_data:
+    driver: local
+  stepca_data:
+    driver: local
+  agent_keys:
+    driver: local
+  nginx_certs:
+    driver: local

deploy/docker-compose.yml

@@ -18,8 +18,10 @@ services:
       - ../migrations/000005_revocation.up.sql:/docker-entrypoint-initdb.d/005_revocation.sql
       - ../migrations/000006_discovery.up.sql:/docker-entrypoint-initdb.d/006_discovery.sql
       - ../migrations/000007_network_discovery.up.sql:/docker-entrypoint-initdb.d/007_network_discovery.sql
-      - ../migrations/seed.sql:/docker-entrypoint-initdb.d/010_seed.sql
-      - ../migrations/seed_demo.sql:/docker-entrypoint-initdb.d/011_seed_demo.sql
+      - ../migrations/000008_verification.up.sql:/docker-entrypoint-initdb.d/008_verification.sql
+      - ../migrations/000009_issuer_config.up.sql:/docker-entrypoint-initdb.d/009_issuer_config.sql
+      - ../migrations/000010_target_config.up.sql:/docker-entrypoint-initdb.d/010_target_config.sql
+      - ../migrations/seed.sql:/docker-entrypoint-initdb.d/020_seed.sql
     networks:
       - certctl-network
     healthcheck:
@@ -34,6 +36,16 @@ services:
     build:
       context: ..
       dockerfile: Dockerfile
+      # Proxy propagation (M-4, Issue #9) — forwards host shell's proxy env
+      # vars into the Docker build so the Node frontend stage and Go module
+      # download can reach the public registries behind corporate proxies.
+      # Defaults to empty; omit the variables from the host environment for
+      # un-proxied builds and the behaviour is byte-identical to the pre-fix
+      # tree.
+      args:
+        HTTP_PROXY: ${HTTP_PROXY:-}
+        HTTPS_PROXY: ${HTTPS_PROXY:-}
+        NO_PROXY: ${NO_PROXY:-}
     container_name: certctl-server
     depends_on:
       postgres:
@@ -46,6 +58,7 @@ services:
       CERTCTL_AUTH_TYPE: none
       CERTCTL_KEYGEN_MODE: server  # Demo uses server-side keygen; production should use "agent"
       CERTCTL_NETWORK_SCAN_ENABLED: "true"  # Enable network scan GUI with seeded demo targets
+      CERTCTL_CONFIG_ENCRYPTION_KEY: ${CERTCTL_CONFIG_ENCRYPTION_KEY:-change-me-32-char-encryption-key}  # AES-256-GCM for dynamic issuer/target config
     ports:
       - "8443:8443"
     networks:
@@ -72,6 +85,15 @@ services:
     build:
       context: ..
       dockerfile: Dockerfile.agent
+      # Proxy propagation (M-4, Issue #9) — forwards host shell's proxy env
+      # vars into the Docker build so the Go module download stage can reach
+      # the public Go module proxy behind corporate proxies. Defaults to
+      # empty; omit the variables from the host environment for un-proxied
+      # builds and the behaviour is byte-identical to the pre-fix tree.
+      args:
+        HTTP_PROXY: ${HTTP_PROXY:-}
+        HTTPS_PROXY: ${HTTPS_PROXY:-}
+        NO_PROXY: ${NO_PROXY:-}
     container_name: certctl-agent
     depends_on:
       certctl-server:
@@ -81,6 +103,7 @@ services:
       CERTCTL_API_KEY: ${CERTCTL_API_KEY:-change-me-in-production}
       CERTCTL_AGENT_NAME: docker-agent
       CERTCTL_LOG_LEVEL: info
+      CERTCTL_DISCOVERY_DIRS: /var/lib/certctl/keys  # Agent scans this directory for existing certificates
     volumes:
       - agent_keys:/var/lib/certctl/keys
     networks:

deploy/helm/CHART_SUMMARY.md

@@ -0,0 +1,461 @@
+# Certctl Helm Chart - Complete Summary
+
+## Overview
+
+A production-ready Helm chart for deploying certctl (self-hosted certificate lifecycle management platform) on Kubernetes. The chart provides:
+
+- High availability support with multi-replica deployments
+- Persistent PostgreSQL database with automatic schema migration
+- DaemonSet or Deployment-based agent deployment
+- Comprehensive security contexts and RBAC
+- Multiple deployment scenarios (dev, prod, HA, external DB)
+- Full documentation and examples
+
+## Chart Metadata
+
+- **Name**: certctl
+- **Chart Version**: 0.1.0
+- **App Version**: 2.1.0
+- **Type**: application
+- **License**: BSL-1.1 (converts to Apache 2.0 in 2033)
+
+## File Structure
+
+```
+deploy/helm/
+├── README.md                              # Main Helm chart documentation
+├── DEPLOYMENT_GUIDE.md                    # Step-by-step deployment guide
+├── CHART_SUMMARY.md                       # This file
+│
+├── certctl/
+│   ├── Chart.yaml                         # Chart metadata
+│   ├── values.yaml                        # Default configuration values
+│   ├── .helmignore                        # Files to ignore when building chart
+│   │
+│   └── templates/
+│       ├── _helpers.tpl                   # Helm template helper functions
+│       ├── NOTES.txt                      # Post-deployment notes
+│       │
+│       ├── server-deployment.yaml         # Certctl API server deployment
+│       ├── server-service.yaml            # Server Kubernetes service
+│       ├── server-configmap.yaml          # Server configuration
+│       ├── server-secret.yaml             # Server secrets (API key, DB password, etc)
+│       │
+│       ├── postgres-statefulset.yaml      # PostgreSQL database statefulset
+│       ├── postgres-service.yaml          # PostgreSQL headless service
+│       ├── postgres-secret.yaml           # Database credentials secret
+│       │
+│       ├── agent-daemonset.yaml           # Certctl agent daemonset/deployment
+│       ├── agent-configmap.yaml           # Agent configuration
+│       │
+│       ├── ingress.yaml                   # Optional ingress resource
+│       └── serviceaccount.yaml            # ServiceAccount and RBAC
+│
+└── examples/
+    ├── values-dev.yaml                    # Development/testing configuration
+    ├── values-prod-ha.yaml                # Production HA configuration
+    ├── values-external-db.yaml            # External PostgreSQL (RDS, Cloud SQL)
+    └── values-acme-dns01.yaml             # ACME with DNS-01 (Let's Encrypt)
+```
+
+## Key Components
+
+### 1. Server Deployment
+
+**File**: `templates/server-deployment.yaml`
+
+- Manages certctl API server instances
+- Configurable replicas (default: 1)
+- Health checks (liveness & readiness probes)
+- Security context: non-root user, read-only filesystem
+- Resource limits (default: 500m CPU, 512Mi memory)
+- Automatic restart on failure
+
+**Values**:
+```yaml
+server:
+  replicas: 1
+  port: 8443
+  auth:
+    type: api-key
+    apiKey: "REQUIRED"
+  resources:
+    requests: {cpu: 100m, memory: 128Mi}
+    limits: {cpu: 500m, memory: 512Mi}
+```
+
+### 2. PostgreSQL StatefulSet
+
+**File**: `templates/postgres-statefulset.yaml`
+
+- Persistent database storage
+- Automatic schema migrations on startup
+- Single replica (can be extended with external HA tools)
+- Health checks via pg_isready
+- Configurable storage size and class
+- Security context: non-root user (UID 999)
+
+**Values**:
+```yaml
+postgresql:
+  enabled: true
+  storage:
+    size: 10Gi
+    storageClass: ""  # Use default
+  auth:
+    database: certctl
+    username: certctl
+    password: "REQUIRED"
+```
+
+### 3. Agent DaemonSet/Deployment
+
+**File**: `templates/agent-daemonset.yaml`
+
+- DaemonSet mode: one agent per Kubernetes node
+- Deployment mode: custom number of agent replicas
+- Local key storage with secure permissions (0600)
+- Health checks and automatic restart
+- Optional certificate discovery from filesystem
+
+**Values**:
+```yaml
+agent:
+  enabled: true
+  kind: DaemonSet  # or Deployment
+  replicas: 1      # for Deployment only
+  keyDir: /var/lib/certctl/keys
+  discoveryDirs: "/etc/ssl/certs"  # optional
+```
+
+### 4. Ingress (Optional)
+
+**File**: `templates/ingress.yaml`
+
+- Optional HTTPS ingress
+- cert-manager integration for automatic TLS
+- Multiple host support
+- Path-based routing
+
+**Values**:
+```yaml
+ingress:
+  enabled: false
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+    - host: certctl.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+```
+
+### 5. ConfigMaps and Secrets
+
+**Files**:
+- `server-configmap.yaml` - Non-secret server configuration
+- `server-secret.yaml` - API key, database URL, SMTP password
+- `postgres-secret.yaml` - Database credentials
+- `agent-configmap.yaml` - Agent configuration
+
+All secrets are base64-encoded and stored in Kubernetes Secrets.
+
+### 6. ServiceAccount and RBAC
+
+**File**: `templates/serviceaccount.yaml`
+
+- Optional ServiceAccount creation
+- Optional RBAC (ClusterRole, ClusterRoleBinding)
+- Namespace-scoped by default
+
+## Deployment Scenarios
+
+### Development Setup
+
+Use `examples/values-dev.yaml`:
+
+```bash
+helm install certctl certctl/ \
+  --values examples/values-dev.yaml \
+  --set server.auth.apiKey="dev-key" \
+  --set postgresql.auth.password="dev-password"
+```
+
+**Features**:
+- Single server replica
+- Demo auth (no API key required)
+- Small database (5Gi)
+- LoadBalancer service for easy access
+- Debug logging level
+
+### Production HA Setup
+
+Use `examples/values-prod-ha.yaml`:
+
+```bash
+helm install certctl certctl/ \
+  --values examples/values-prod-ha.yaml \
+  --set server.auth.apiKey="$(openssl rand -base64 32)" \
+  --set postgresql.auth.password="$(openssl rand -base64 32)"
+```
+
+**Features**:
+- 3 server replicas with pod anti-affinity
+- Large database storage (100Gi)
+- Pod disruption budgets
+- Prometheus monitoring enabled
+- Production resource limits
+
+### External PostgreSQL
+
+Use `examples/values-external-db.yaml`:
+
+```bash
+helm install certctl certctl/ \
+  --values examples/values-external-db.yaml \
+  --set postgresql.enabled=false \
+  --set 'server.env.CERTCTL_DATABASE_URL=postgres://...'
+```
+
+**Use cases**:
+- AWS RDS
+- Google Cloud SQL
+- Azure Database for PostgreSQL
+- External self-managed PostgreSQL
+
+### ACME with DNS-01
+
+Use `examples/values-acme-dns01.yaml`:
+
+```bash
+helm install certctl certctl/ \
+  --values examples/values-acme-dns01.yaml
+```
+
+**Enables**:
+- Automatic certificate issuance from Let's Encrypt
+- DNS-01 challenge (wildcard support)
+- Custom DNS provider scripts
+
+## Configuration Options
+
+### Server Configuration
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `server.replicas` | 1 | Number of server replicas |
+| `server.port` | 8443 | Server port |
+| `server.auth.type` | api-key | Authentication type |
+| `server.auth.apiKey` | "" | API key (REQUIRED) |
+| `server.logging.level` | info | Log level |
+| `server.logging.format` | json | Log format |
+
+### PostgreSQL Configuration
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `postgresql.enabled` | true | Enable internal PostgreSQL |
+| `postgresql.storage.size` | 10Gi | Database storage size |
+| `postgresql.storage.storageClass` | "" | Storage class name |
+| `postgresql.auth.password` | "" | Database password (REQUIRED) |
+
+### Agent Configuration
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `agent.enabled` | true | Deploy agents |
+| `agent.kind` | DaemonSet | DaemonSet or Deployment |
+| `agent.replicas` | 1 | Replicas (Deployment only) |
+| `agent.keyDir` | /var/lib/certctl/keys | Key storage directory |
+
+### Issuer Configuration
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `server.issuer.local.enabled` | true | Enable Local CA |
+| `server.issuer.acme.enabled` | false | Enable ACME |
+| `server.issuer.acme.directoryURL` | "" | ACME directory URL |
+| `server.issuer.acme.email` | "" | ACME email |
+| `server.issuer.acme.challengeType` | http-01 | Challenge type |
+
+See `values.yaml` for complete configuration options.
+
+## Helm Template Functions
+
+Defined in `templates/_helpers.tpl`:
+
+| Function | Purpose |
+|----------|---------|
+| `certctl.name` | Chart name |
+| `certctl.fullname` | Full release name |
+| `certctl.chart` | Chart name and version |
+| `certctl.labels` | Common labels |
+| `certctl.selectorLabels` | Selector labels |
+| `certctl.serverSelectorLabels` | Server selector labels |
+| `certctl.agentSelectorLabels` | Agent selector labels |
+| `certctl.postgresSelectorLabels` | PostgreSQL selector labels |
+| `certctl.serviceAccountName` | ServiceAccount name |
+| `certctl.serverImage` | Server image URI |
+| `certctl.agentImage` | Agent image URI |
+| `certctl.postgresImage` | PostgreSQL image URI |
+| `certctl.databaseURL` | Database connection string |
+| `certctl.serverURL` | Server URL for agents |
+
+## Security Features
+
+### Pod Security
+
+- Non-root users (UID 1000 for app, UID 999 for PostgreSQL)
+- Read-only root filesystems
+- No privilege escalation
+- Dropped capabilities (ALL)
+- Resource limits to prevent DoS
+
+### Secrets Management
+
+- All sensitive data in Kubernetes Secrets
+- Base64 encoded at rest
+- Can be integrated with:
+  - sealed-secrets
+  - external-secrets
+  - Vault
+  - AWS Secrets Manager
+
+### RBAC
+
+- ServiceAccount per release
+- Optional ClusterRole/ClusterRoleBinding
+- Extensible for custom permissions
+
+### Network Security
+
+- Support for Kubernetes NetworkPolicies
+- Service-to-service communication via internal DNS
+- Optional Ingress with TLS
+
+## Monitoring and Observability
+
+### Health Checks
+
+- Liveness probes (detect dead containers)
+- Readiness probes (detect not-ready services)
+- HTTP endpoints: `/health`, `/readyz`
+
+### Logging
+
+- Structured JSON logging
+- Request ID propagation
+- Configurable log levels (debug, info, warn, error)
+
+### Metrics
+
+- Prometheus metrics endpoint: `/api/v1/metrics/prometheus`
+- Optional ServiceMonitor for Prometheus Operator
+- Built-in metrics:
+  - Certificate counts by status
+  - Agent counts and status
+  - Job completion/failure rates
+  - Server uptime
+
+## Installation Quick Reference
+
+```bash
+# Development
+helm install certctl certctl/ \
+  --set server.auth.apiKey=dev \
+  --set postgresql.auth.password=dev
+
+# Production HA
+helm install certctl certctl/ \
+  --values examples/values-prod-ha.yaml \
+  --set server.auth.apiKey="$(openssl rand -base64 32)" \
+  --set postgresql.auth.password="$(openssl rand -base64 32)"
+
+# External database
+helm install certctl certctl/ \
+  --values examples/values-external-db.yaml \
+  --set postgresql.enabled=false \
+  --set 'server.env.CERTCTL_DATABASE_URL=postgres://...'
+
+# ACME with Let's Encrypt
+helm install certctl certctl/ \
+  --set server.issuer.acme.enabled=true \
+  --set server.issuer.acme.directoryURL=https://acme-v02.api.letsencrypt.org/directory
+
+# Check status
+kubectl get pods -l app.kubernetes.io/instance=certctl
+kubectl logs -l app.kubernetes.io/component=server -f
+
+# Upgrade
+helm upgrade certctl certctl/ -f new-values.yaml
+
+# Uninstall
+helm uninstall certctl
+```
+
+## Best Practices
+
+### 1. Use Secrets Management
+
+```bash
+# Use sealed-secrets
+kubectl create secret generic certctl-secrets \
+  --from-literal=api-key="$(openssl rand -base64 32)" \
+  --dry-run=client -o yaml | kubeseal -f - | kubectl apply -f -
+```
+
+### 2. Configure Resource Limits
+
+Match limits to your cluster capacity:
+
+```yaml
+server:
+  resources:
+    requests: {cpu: 250m, memory: 256Mi}
+    limits: {cpu: 1000m, memory: 512Mi}
+```
+
+### 3. Enable HA for Production
+
+```yaml
+server:
+  replicas: 3
+podAntiAffinity:
+  requiredDuringSchedulingIgnoredDuringExecution: [...]
+```
+
+### 4. Use Persistent Storage
+
+```yaml
+postgresql:
+  storage:
+    size: 100Gi
+    storageClass: fast-ssd
+```
+
+### 5. Enable Monitoring
+
+```yaml
+monitoring:
+  enabled: true
+  serviceMonitor:
+    enabled: true
+```
+
+## Documentation
+
+- **README.md** - Complete Helm chart documentation
+- **DEPLOYMENT_GUIDE.md** - Step-by-step deployment instructions
+- **values.yaml** - Commented configuration reference
+
+## Support
+
+For issues, questions, or contributions:
+- GitHub: https://github.com/shankar0123/certctl
+- Documentation: https://github.com/shankar0123/certctl/tree/main/docs
+
+## License
+
+BSL-1.1 (Business Source License)
+Converts to Apache 2.0 on March 14, 2033

deploy/helm/DEPLOYMENT_GUIDE.md

@@ -0,0 +1,515 @@
+# Certctl Helm Deployment Guide
+
+Complete guide for deploying certctl on Kubernetes with Helm.
+
+## Table of Contents
+
+1. [Prerequisites](#prerequisites)
+2. [Installation Methods](#installation-methods)
+3. [Production Deployment](#production-deployment)
+4. [Configuration Examples](#configuration-examples)
+5. [Post-Deployment Setup](#post-deployment-setup)
+6. [Monitoring and Logging](#monitoring-and-logging)
+7. [Maintenance](#maintenance)
+
+## Prerequisites
+
+### Required Tools
+
+```bash
+# Verify Kubernetes cluster access
+kubectl cluster-info
+kubectl get nodes
+
+# Install Helm (if not already installed)
+curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+helm version
+
+# Verify Helm installation
+helm repo list
+```
+
+### Kubernetes Requirements
+
+- Kubernetes 1.19 or later
+- At least 2GB available memory
+- At least 10GB available storage (for PostgreSQL)
+- Network policies support (optional, for security)
+- Ingress controller (nginx, istio, etc.) - optional
+
+### Create Namespace
+
+```bash
+# Create isolated namespace
+kubectl create namespace certctl
+
+# Set as default namespace
+kubectl config set-context --current --namespace=certctl
+
+# Label for network policies (optional)
+kubectl label namespace certctl certctl-ns=true
+```
+
+## Installation Methods
+
+### Method 1: Minimal Development Setup
+
+Perfect for testing and development:
+
+```bash
+# Install with minimal configuration
+helm install certctl certctl/certctl \
+  --namespace certctl \
+  --set server.auth.apiKey="dev-key-change-in-production" \
+  --set postgresql.auth.password="dev-password-change-in-production"
+
+# Wait for deployment
+kubectl rollout status deployment/certctl-server
+kubectl rollout status statefulset/certctl-postgres
+```
+
+### Method 2: Production HA Setup
+
+For production workloads:
+
+```bash
+# Generate secure credentials
+API_KEY=$(openssl rand -base64 32)
+DB_PASSWORD=$(openssl rand -base64 32)
+
+# Install with HA configuration
+helm install certctl certctl/certctl \
+  --namespace certctl \
+  --values deploy/helm/examples/values-prod-ha.yaml \
+  --set server.auth.apiKey="$API_KEY" \
+  --set postgresql.auth.password="$DB_PASSWORD"
+```
+
+### Method 3: External PostgreSQL
+
+Using managed database service:
+
+```bash
+# Install with external database
+helm install certctl certctl/certctl \
+  --namespace certctl \
+  --values deploy/helm/examples/values-external-db.yaml \
+  --set server.auth.apiKey="$API_KEY" \
+  --set 'server.env.CERTCTL_DATABASE_URL=postgres://user:pass@db.example.com:5432/certctl?sslmode=require'
+```
+
+### Method 4: Using Custom values.yaml
+
+Recommended for GitOps workflows:
+
+```bash
+# Create values file with secrets management
+cat > /tmp/certctl-values.yaml <<EOF
+server:
+  auth:
+    apiKey: "$API_KEY"
+  logging:
+    level: info
+
+postgresql:
+  auth:
+    password: "$DB_PASSWORD"
+  storage:
+    size: 50Gi
+
+agent:
+  enabled: true
+  kind: DaemonSet
+
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: certctl.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+EOF
+
+# Install using values file
+helm install certctl certctl/certctl \
+  --namespace certctl \
+  --values /tmp/certctl-values.yaml
+```
+
+## Production Deployment
+
+### Step 1: Prepare Environment
+
+```bash
+# Create namespace
+kubectl create namespace certctl
+cd deploy/helm
+
+# Generate credentials
+API_KEY=$(openssl rand -base64 32)
+DB_PASSWORD=$(openssl rand -base64 32)
+
+echo "API Key: $API_KEY"
+echo "DB Password: $DB_PASSWORD"
+
+# Save credentials in secure location (e.g., 1Password, Vault, AWS Secrets Manager)
+```
+
+### Step 2: Prepare Storage
+
+```bash
+# List available storage classes
+kubectl get storageclass
+
+# If needed, create a high-performance storage class for production
+cat <<EOF | kubectl apply -f -
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: fast-ssd
+provisioner: ebs.csi.aws.com  # For AWS, adjust for your cloud provider
+parameters:
+  type: gp3
+  iops: "3000"
+  throughput: "125"
+EOF
+```
+
+### Step 3: Set Up TLS with cert-manager
+
+```bash
+# Install cert-manager (if not already installed)
+helm repo add jetstack https://charts.jetstack.io
+helm repo update
+helm install cert-manager jetstack/cert-manager \
+  --namespace cert-manager \
+  --create-namespace \
+  --set installCRDs=true
+
+# Create ClusterIssuer for Let's Encrypt
+kubectl apply -f - <<EOF
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: admin@example.com
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+    - http01:
+        ingress:
+          class: nginx
+EOF
+```
+
+### Step 4: Install Certctl
+
+```bash
+# Install using HA values
+helm install certctl certctl/ \
+  --namespace certctl \
+  --values examples/values-prod-ha.yaml \
+  --set server.auth.apiKey="$API_KEY" \
+  --set postgresql.auth.password="$DB_PASSWORD" \
+  --set ingress.annotations."cert-manager\.io/cluster-issuer"=letsencrypt-prod \
+  --set ingress.hosts[0].host=certctl.example.com
+
+# Verify installation
+kubectl get all -l app.kubernetes.io/instance=certctl
+```
+
+### Step 5: Verify Deployment
+
+```bash
+# Check pod status
+kubectl get pods -l app.kubernetes.io/instance=certctl
+kubectl describe pods -l app.kubernetes.io/instance=certctl
+
+# Check service status
+kubectl get svc -l app.kubernetes.io/instance=certctl
+
+# Check ingress status
+kubectl get ingress
+kubectl describe ingress certctl
+
+# Test API connectivity
+POD=$(kubectl get pods -l app.kubernetes.io/component=server -o jsonpath='{.items[0].metadata.name}')
+kubectl port-forward $POD 8443:8443 &
+curl -H "Authorization: Bearer $API_KEY" http://localhost:8443/health
+```
+
+### Step 6: Access the Dashboard
+
+```bash
+# Port forward to local machine
+kubectl port-forward svc/certctl-server 8443:8443 &
+
+# Or if using Ingress:
+# Open browser: https://certctl.example.com
+# Login with API key: $API_KEY
+```
+
+## Configuration Examples
+
+### Example 1: ACME (Let's Encrypt)
+
+```bash
+helm install certctl certctl/ \
+  --set server.issuer.acme.enabled=true \
+  --set server.issuer.acme.directoryURL=https://acme-v02.api.letsencrypt.org/directory \
+  --set server.issuer.acme.email=admin@example.com \
+  --set server.issuer.acme.challengeType=http-01
+```
+
+### Example 2: DNS-01 (Wildcard Certs)
+
+Requires DNS scripts ConfigMap:
+
+```bash
+# Create DNS scripts ConfigMap
+kubectl create configmap dns-scripts \
+  --from-file=dns-present.sh=./scripts/dns-present.sh \
+  --from-file=dns-cleanup.sh=./scripts/dns-cleanup.sh
+
+# Install with DNS-01
+helm install certctl certctl/ \
+  --set server.issuer.acme.enabled=true \
+  --set server.issuer.acme.challengeType=dns-01 \
+  --values examples/values-acme-dns01.yaml
+```
+
+### Example 3: AWS RDS Database
+
+```bash
+helm install certctl certctl/ \
+  --set postgresql.enabled=false \
+  --set 'server.env.CERTCTL_DATABASE_URL=postgres://user:password@mydb.c9akciq32.us-east-1.rds.amazonaws.com:5432/certctl?sslmode=require'
+```
+
+### Example 4: Multiple Issuers
+
+```bash
+helm install certctl certctl/ \
+  --set server.issuer.local.enabled=true \
+  --set server.issuer.acme.enabled=true \
+  --set server.issuer.acme.directoryURL=https://acme-v02.api.letsencrypt.org/directory
+```
+
+### Example 5: Email Notifications
+
+```bash
+helm install certctl certctl/ \
+  --set server.smtp.enabled=true \
+  --set server.smtp.host=smtp.example.com \
+  --set server.smtp.port=587 \
+  --set server.smtp.username=alerts@example.com \
+  --set server.smtp.password="$SMTP_PASSWORD" \
+  --set server.smtp.fromAddress=certctl@example.com
+```
+
+## Post-Deployment Setup
+
+### 1. Initial Database Setup
+
+```bash
+# Check database connection
+POD=$(kubectl get pods -l app.kubernetes.io/component=postgres -o jsonpath='{.items[0].metadata.name}')
+
+# Execute psql commands
+kubectl exec -it $POD -- \
+  psql -U certctl -d certctl -c '\dt'
+
+# View database status
+kubectl logs $POD | tail -20
+```
+
+### 2. Create Default Certificates
+
+```bash
+# Port forward to API
+kubectl port-forward svc/certctl-server 8443:8443 &
+
+# Create a test certificate
+API_KEY="your-api-key"
+curl -X POST http://localhost:8443/api/v1/certificates \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "common_name": "test.example.com",
+    "sans": ["test.example.com", "*.example.com"],
+    "owner": "admin@example.com"
+  }'
+```
+
+### 3. Configure Agents
+
+```bash
+# Get agent names
+kubectl get pods -l app.kubernetes.io/component=agent -o wide
+
+# Check agent connectivity
+POD=$(kubectl get pods -l app.kubernetes.io/component=agent -o jsonpath='{.items[0].metadata.name}')
+kubectl logs $POD | grep -i heartbeat
+```
+
+### 4. Set Up HTTPS for Web Dashboard
+
+The Ingress will handle TLS if configured properly:
+
+```bash
+# Verify ingress is ready
+kubectl get ingress
+kubectl describe ingress certctl
+
+# Test HTTPS
+curl https://certctl.example.com/health
+```
+
+## Monitoring and Logging
+
+### 1. View Logs
+
+```bash
+# Server logs
+kubectl logs -l app.kubernetes.io/component=server -f --all-containers=true
+
+# PostgreSQL logs
+kubectl logs -l app.kubernetes.io/component=postgres -f
+
+# Agent logs
+kubectl logs -l app.kubernetes.io/component=agent -f --all-containers=true
+
+# Logs from all components
+kubectl logs -l app.kubernetes.io/instance=certctl -f --all-containers=true
+```
+
+### 2. Install Prometheus Monitoring
+
+```bash
+# Install Prometheus operator (if not already installed)
+helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+helm repo update
+
+helm install prometheus prometheus-community/kube-prometheus-stack \
+  --namespace monitoring \
+  --create-namespace
+
+# Certctl will automatically expose metrics if monitoring.enabled=true
+helm install certctl certctl/ \
+  --set monitoring.enabled=true \
+  --set monitoring.serviceMonitor.enabled=true
+```
+
+### 3. Set Up Alerts
+
+```bash
+# Create Prometheus alerts
+cat <<EOF | kubectl apply -f -
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: certctl-alerts
+spec:
+  groups:
+  - name: certctl
+    interval: 30s
+    rules:
+    - alert: CertctlServerDown
+      expr: up{job="certctl-server"} == 0
+      for: 5m
+      annotations:
+        summary: "Certctl server is down"
+
+    - alert: CertificateExpiringSoon
+      expr: certctl_certificate_expiring_soon > 0
+      for: 1h
+      annotations:
+        summary: "{{ \$value }} certificates expiring soon"
+EOF
+```
+
+## Maintenance
+
+### Scaling
+
+```bash
+# Scale server replicas
+helm upgrade certctl certctl/ \
+  --set server.replicas=5
+
+# Scale agents (Deployment kind only)
+helm upgrade certctl certctl/ \
+  --set agent.kind=Deployment \
+  --set agent.replicas=10
+```
+
+### Updating
+
+```bash
+# Update chart version
+helm repo update
+helm upgrade certctl certctl/certctl \
+  --namespace certctl \
+  -f values.yaml
+
+# Verify update
+kubectl rollout status deployment/certctl-server
+kubectl rollout status statefulset/certctl-postgres
+```
+
+### Backup and Restore
+
+```bash
+# Backup PostgreSQL data
+kubectl exec -i $(kubectl get pods -l app.kubernetes.io/component=postgres -o jsonpath='{.items[0].metadata.name}') \
+  pg_dump -U certctl certctl | gzip > certctl-backup.sql.gz
+
+# Restore from backup
+zcat certctl-backup.sql.gz | kubectl exec -i $(kubectl get pods -l app.kubernetes.io/component=postgres -o jsonpath='{.items[0].metadata.name}') \
+  psql -U certctl certctl
+
+# Backup PVC data
+kubectl get pvc
+kubectl exec -i $(kubectl get pods -l app.kubernetes.io/component=postgres -o jsonpath='{.items[0].metadata.name}') \
+  tar czf - /var/lib/postgresql/data | gzip > certctl-data-backup.tar.gz
+```
+
+### Uninstall
+
+```bash
+# Remove Helm release (keeps PVCs by default)
+helm uninstall certctl --namespace certctl
+
+# Delete PVCs if needed
+kubectl delete pvc --all -n certctl
+
+# Delete namespace
+kubectl delete namespace certctl
+```
+
+## Troubleshooting
+
+See [README.md](README.md#troubleshooting) for detailed troubleshooting steps.
+
+Common commands:
+
+```bash
+# Get all resources
+kubectl get all -n certctl
+
+# Describe pod for events
+kubectl describe pod <pod-name> -n certctl
+
+# Stream logs
+kubectl logs -f <pod-name> -n certctl
+
+# Execute commands in pod
+kubectl exec -it <pod-name> -n certctl -- /bin/sh
+
+# Check events
+kubectl get events -n certctl --sort-by='.lastTimestamp'
+```

deploy/helm/INDEX.md

@@ -0,0 +1,234 @@
+# Certctl Helm Chart - Complete File Index
+
+## Navigation Guide
+
+### Getting Started
+
+1. **Start here**: `INSTALLATION.md` - Quick installation guide with one-liners
+2. **Full reference**: `README.md` - Complete Helm chart documentation
+3. **Detailed guide**: `DEPLOYMENT_GUIDE.md` - Step-by-step deployment walkthrough
+4. **Architecture**: `CHART_SUMMARY.md` - Technical overview and design
+
+### Chart Directory Structure
+
+```
+deploy/helm/
+│
+├── README.md                           Main documentation (15 KB)
+├── DEPLOYMENT_GUIDE.md                 Step-by-step guide (12 KB)
+├── CHART_SUMMARY.md                    Architecture & design (13 KB)
+├── INSTALLATION.md                     Quick start (2.2 KB)
+├── INDEX.md                            This file
+│
+├── certctl/                            Helm chart package
+│   ├── Chart.yaml                      Chart metadata
+│   ├── values.yaml                     Default configuration (11 KB)
+│   ├── .helmignore                     Build ignore patterns
+│   │
+│   └── templates/                      15 Kubernetes resource templates
+│       ├── _helpers.tpl                Helper functions
+│       ├── NOTES.txt                   Post-install notes
+│       ├── server-deployment.yaml      API server
+│       ├── server-service.yaml         Server networking
+│       ├── server-configmap.yaml       Server configuration
+│       ├── server-secret.yaml          Server secrets
+│       ├── postgres-statefulset.yaml   Database
+│       ├── postgres-service.yaml       Database networking
+│       ├── postgres-secret.yaml        Database secrets
+│       ├── agent-daemonset.yaml        Agents (DaemonSet/Deployment)
+│       ├── agent-configmap.yaml        Agent configuration
+│       ├── ingress.yaml                Optional HTTPS ingress
+│       └── serviceaccount.yaml         RBAC resources
+│
+└── examples/                           Example configurations
+    ├── values-dev.yaml                 Development setup
+    ├── values-prod-ha.yaml             Production HA setup
+    ├── values-external-db.yaml         External PostgreSQL
+    └── values-acme-dns01.yaml          ACME DNS-01 configuration
+```
+
+## File Descriptions
+
+### Documentation Files
+
+| File | Purpose | Size |
+|------|---------|------|
+| `README.md` | Complete Helm chart documentation, configuration reference, security considerations | 15 KB |
+| `DEPLOYMENT_GUIDE.md` | Step-by-step installation instructions, production setup, troubleshooting | 12 KB |
+| `CHART_SUMMARY.md` | Technical overview, architecture, features, best practices | 13 KB |
+| `INSTALLATION.md` | Quick start guide, one-liner commands, verification steps | 2.2 KB |
+| `INDEX.md` | This file - complete file index and navigation | - |
+
+### Chart Files
+
+| File | Purpose |
+|------|---------|
+| `Chart.yaml` | Helm chart metadata (name, version, appVersion, license) |
+| `values.yaml` | Default configuration values with comprehensive comments |
+| `.helmignore` | Files to ignore when building the chart |
+
+### Template Files
+
+| File | Components Created |
+|------|-------------------|
+| `_helpers.tpl` | 14 Helm template helper functions |
+| `NOTES.txt` | Post-installation notes and instructions |
+| `server-deployment.yaml` | Certctl API server deployment (1-N replicas) |
+| `server-service.yaml` | Service exposing the server |
+| `server-configmap.yaml` | Non-secret server configuration |
+| `server-secret.yaml` | Secrets (API key, DB password, SMTP) |
+| `postgres-statefulset.yaml` | PostgreSQL database with persistent storage |
+| `postgres-service.yaml` | Headless service for PostgreSQL |
+| `postgres-secret.yaml` | Database credentials |
+| `agent-daemonset.yaml` | Certctl agents (DaemonSet or Deployment) |
+| `agent-configmap.yaml` | Agent configuration |
+| `ingress.yaml` | Optional HTTPS ingress resource |
+| `serviceaccount.yaml` | ServiceAccount and RBAC resources |
+
+### Example Configuration Files
+
+| File | Use Case | Features |
+|------|----------|----------|
+| `values-dev.yaml` | Development/testing | Single replica, debug logging, LoadBalancer, no auth |
+| `values-prod-ha.yaml` | Production HA | 3 replicas, pod anti-affinity, monitoring, large storage |
+| `values-external-db.yaml` | External PostgreSQL | AWS RDS, Cloud SQL, Azure Database, self-managed |
+| `values-acme-dns01.yaml` | Let's Encrypt | DNS-01 challenges, wildcard certs, custom DNS scripts |
+
+## Quick Links
+
+### Installation Commands
+
+#### Development
+```bash
+helm install certctl certctl/ \
+  --set server.auth.type=none \
+  --set postgresql.auth.password=dev
+```
+
+#### Production HA
+```bash
+helm install certctl certctl/ \
+  --values examples/values-prod-ha.yaml \
+  --set server.auth.apiKey="$(openssl rand -base64 32)" \
+  --set postgresql.auth.password="$(openssl rand -base64 32)"
+```
+
+#### External Database
+```bash
+helm install certctl certctl/ \
+  --values examples/values-external-db.yaml \
+  --set postgresql.enabled=false \
+  --set 'server.env.CERTCTL_DATABASE_URL=postgres://...'
+```
+
+### Verification Commands
+
+```bash
+# Check chart syntax
+helm lint certctl/
+helm template certctl certctl/
+
+# Install in cluster
+helm install certctl certctl/
+helm status certctl
+
+# Check pod status
+kubectl get pods -l app.kubernetes.io/instance=certctl
+
+# View logs
+kubectl logs -l app.kubernetes.io/component=server -f
+```
+
+## Documentation Organization
+
+### By User Role
+
+**DevOps/Platform Engineers**
+- Start: `INSTALLATION.md`
+- Deep dive: `DEPLOYMENT_GUIDE.md`
+- Configuration reference: `README.md`
+
+**Kubernetes Developers**
+- Architecture: `CHART_SUMMARY.md`
+- Configuration: `values.yaml`
+- Templates: `templates/`
+
+**Security/SREs**
+- Security section: `README.md#security-considerations`
+- RBAC: `templates/serviceaccount.yaml`
+- Network policies: `DEPLOYMENT_GUIDE.md#network-policies`
+
+**Database Administrators**
+- PostgreSQL config: `values.yaml` (postgresql section)
+- External DB setup: `examples/values-external-db.yaml`
+- Backup/restore: `DEPLOYMENT_GUIDE.md#backup-and-restore`
+
+### By Task
+
+**Getting Started**
+1. Read: `INSTALLATION.md`
+2. Install: `helm install certctl certctl/`
+3. Verify: Run commands in `INSTALLATION.md`
+
+**Production Deployment**
+1. Read: `DEPLOYMENT_GUIDE.md`
+2. Choose: `examples/values-prod-ha.yaml`
+3. Deploy: Follow step-by-step guide
+4. Reference: `README.md` for detailed options
+
+**Troubleshooting**
+- Common issues: `README.md#troubleshooting`
+- Detailed guide: `DEPLOYMENT_GUIDE.md#troubleshooting`
+- Error messages: kubectl logs and events
+
+**Configuration**
+- All options: `values.yaml`
+- Examples: `examples/values-*.yaml`
+- Detailed docs: `README.md#configuration`
+
+## Key Features
+
+### High Availability
+- Multi-replica server deployment
+- Pod anti-affinity
+- StatefulSet for database
+- Pod disruption budgets
+
+### Security
+- Non-root containers
+- Read-only filesystems
+- RBAC support
+- Kubernetes Secrets
+- Network policies
+
+### Flexibility
+- Multiple issuers (Local CA, ACME, step-ca, OpenSSL)
+- Internal or external PostgreSQL
+- DaemonSet or Deployment agents
+- Optional Ingress with TLS
+- Email notifications
+
+### Observability
+- Health checks
+- Structured logging
+- Prometheus metrics
+- ServiceMonitor support
+
+## Support
+
+- **GitHub**: https://github.com/shankar0123/certctl
+- **Issues**: Report on GitHub issues
+- **Documentation**: All docs are in `deploy/helm/`
+
+## File Statistics
+
+- **Total files**: 24
+- **Documentation**: 4 files (42 KB)
+- **Chart files**: 3 files
+- **Templates**: 13 files
+- **Examples**: 4 files
+- **Total size**: 144 KB
+
+## License
+
+All files are covered under the BSL-1.1 license (converts to Apache 2.0 in 2033).

deploy/helm/INSTALLATION.md

@@ -0,0 +1,95 @@
+# Quick Installation Guide
+
+## One-Liner Installation
+
+### Development (no auth)
+```bash
+helm install certctl certctl/ \
+  --set server.auth.type=none \
+  --set postgresql.auth.password=dev
+```
+
+### Production (with API key)
+```bash
+API_KEY=$(openssl rand -base64 32)
+DB_PASSWORD=$(openssl rand -base64 32)
+
+helm install certctl certctl/ \
+  --values examples/values-prod-ha.yaml \
+  --set server.auth.apiKey="$API_KEY" \
+  --set postgresql.auth.password="$DB_PASSWORD"
+```
+
+## Verify Installation
+
+```bash
+# Wait for pods to be ready
+kubectl rollout status deployment/certctl-server
+kubectl rollout status statefulset/certctl-postgres
+
+# Check all components
+kubectl get pods -l app.kubernetes.io/instance=certctl
+
+# View server logs
+kubectl logs -l app.kubernetes.io/component=server -f
+
+# Access the API
+kubectl port-forward svc/certctl-server 8443:8443 &
+curl http://localhost:8443/health
+```
+
+## Next Steps
+
+1. **Read Documentation**
+   - `README.md` - Complete reference
+   - `DEPLOYMENT_GUIDE.md` - Step-by-step guide
+   - `CHART_SUMMARY.md` - Architecture overview
+
+2. **Configure for Your Environment**
+   - Review `examples/` for your deployment scenario
+   - Customize `values.yaml` as needed
+   - Use `helm upgrade` to apply changes
+
+3. **Set Up Monitoring**
+   - Install Prometheus (optional)
+   - Enable Ingress with HTTPS
+   - Configure email notifications
+
+4. **Deploy Agents**
+   - Agents deploy automatically as DaemonSet
+   - Verify with: `kubectl get pods -l app.kubernetes.io/component=agent`
+
+5. **Create Certificates**
+   - Configure issuer connectors (Local CA, ACME, etc.)
+   - Access web dashboard at ingress or port-forward
+
+## Common Commands
+
+```bash
+# List installations
+helm list
+
+# View chart values
+helm values certctl
+
+# Upgrade chart
+helm upgrade certctl certctl/ -f new-values.yaml
+
+# Rollback to previous version
+helm rollback certctl 1
+
+# Uninstall chart
+helm uninstall certctl
+
+# View deployment history
+helm history certctl
+
+# Dry-run installation to see generated YAML
+helm install certctl certctl/ --dry-run --debug
+```
+
+## Support
+
+- Full documentation in `README.md`
+- Troubleshooting in `DEPLOYMENT_GUIDE.md`
+- Issues: https://github.com/shankar0123/certctl

deploy/helm/README.md

@@ -0,0 +1,516 @@
+# Certctl Helm Chart
+
+Production-ready Helm chart for deploying certctl (self-hosted certificate lifecycle management platform) on Kubernetes.
+
+## Table of Contents
+
+1. [Quick Start](#quick-start)
+2. [Chart Features](#chart-features)
+3. [Prerequisites](#prerequisites)
+4. [Installation](#installation)
+5. [Configuration](#configuration)
+6. [Usage Examples](#usage-examples)
+7. [Upgrading](#upgrading)
+8. [Uninstalling](#uninstalling)
+9. [Architecture](#architecture)
+10. [Security Considerations](#security-considerations)
+11. [Troubleshooting](#troubleshooting)
+
+## Quick Start
+
+```bash
+# Add the chart repository (when available)
+helm repo add certctl https://charts.example.com
+helm repo update
+
+# Install with default values
+helm install certctl certctl/certctl \
+  --set server.auth.apiKey="your-secure-api-key" \
+  --set postgresql.auth.password="your-secure-password"
+
+# Check installation status
+kubectl get pods -l app.kubernetes.io/instance=certctl
+```
+
+## Chart Features
+
+- **Server Deployment** — certctl control plane with configurable replicas
+- **PostgreSQL StatefulSet** — Persistent database with automatic schema migration
+- **Agent DaemonSet or Deployment** — Flexible agent deployment (per-node or custom replicas)
+- **Ingress Support** — Optional HTTPS ingress with cert-manager integration
+- **Security Contexts** — Non-root containers, read-only filesystems, minimal capabilities
+- **Resource Limits** — Configurable CPU and memory requests/limits
+- **Health Checks** — Liveness and readiness probes on all containers
+- **ConfigMaps and Secrets** — Centralized configuration management
+- **Service Account and RBAC** — Optional cluster role bindings
+- **Pod Disruption Budgets** — HA-ready with configurable disruption budgets
+- **Monitoring** — Optional Prometheus ServiceMonitor support
+
+## Prerequisites
+
+- Kubernetes 1.19 or later
+- Helm 3.0 or later
+- Optional: cert-manager (for automatic TLS certificate provisioning)
+- Optional: Prometheus (for metrics scraping)
+
+## Installation
+
+### 1. Using Chart from Repository
+
+```bash
+helm repo add certctl https://charts.example.com
+helm repo update
+helm install certctl certctl/certctl -f my-values.yaml
+```
+
+### 2. Using Local Chart
+
+```bash
+cd deploy/helm
+helm install certctl certctl/ \
+  --set server.auth.apiKey="$(openssl rand -base64 32)" \
+  --set postgresql.auth.password="$(openssl rand -base64 32)"
+```
+
+### 3. Minimal Production Installation
+
+```bash
+helm install certctl certctl/certctl \
+  --namespace certctl \
+  --create-namespace \
+  --set server.auth.apiKey="change-me" \
+  --set postgresql.auth.password="change-me" \
+  --set server.replicas=2 \
+  --set server.resources.requests.cpu=200m \
+  --set server.resources.requests.memory=256Mi \
+  --set ingress.enabled=true \
+  --set ingress.className=nginx \
+  --set ingress.hosts[0].host=certctl.example.com
+```
+
+## Configuration
+
+### Server Configuration
+
+```yaml
+server:
+  replicas: 1                    # Number of server replicas
+  port: 8443                     # Service port
+  auth:
+    type: api-key               # Authentication type
+    apiKey: "your-api-key"      # REQUIRED for production
+  logging:
+    level: info                 # Log level (debug, info, warn, error)
+    format: json                # Output format
+  issuer:
+    local:
+      enabled: true             # Enable local CA issuer
+    acme:
+      enabled: false            # Enable ACME issuer
+      directoryURL: ""          # ACME directory URL
+      email: ""                 # ACME registration email
+      challengeType: "http-01"  # Challenge type (http-01, dns-01, dns-persist-01)
+```
+
+### PostgreSQL Configuration
+
+```yaml
+postgresql:
+  enabled: true                 # Use managed PostgreSQL
+  auth:
+    database: certctl
+    username: certctl
+    password: "your-password"   # REQUIRED
+  storage:
+    size: 10Gi                  # PVC size
+    storageClass: ""            # Use default StorageClass
+```
+
+### Agent Configuration
+
+```yaml
+agent:
+  enabled: true                 # Deploy agents
+  kind: DaemonSet              # DaemonSet (one per node) or Deployment
+  replicas: 1                  # For Deployment kind only
+  discoveryDirs: ""            # Comma-separated cert discovery paths
+  nodeSelector: {}             # Node affinity for DaemonSet
+```
+
+### Ingress Configuration
+
+```yaml
+ingress:
+  enabled: false
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+    - host: certctl.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: certctl-tls
+      hosts:
+        - certctl.example.com
+```
+
+See `values.yaml` for all available configuration options.
+
+## Usage Examples
+
+### Example 1: High Availability Setup
+
+```yaml
+# ha-values.yaml
+server:
+  replicas: 3
+  resources:
+    requests:
+      cpu: 250m
+      memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 512Mi
+
+postgresql:
+  storage:
+    size: 50Gi
+
+podAntiAffinity:
+  requiredDuringSchedulingIgnoredDuringExecution:
+    - labelSelector:
+        matchExpressions:
+          - key: app.kubernetes.io/component
+            operator: In
+            values: [server]
+      topologyKey: kubernetes.io/hostname
+```
+
+Deploy with:
+```bash
+helm install certctl certctl/certctl -f ha-values.yaml
+```
+
+### Example 2: External PostgreSQL Database
+
+```yaml
+# external-db-values.yaml
+postgresql:
+  enabled: false
+
+server:
+  env:
+    CERTCTL_DATABASE_URL: "postgres://user:password@rds.example.com:5432/certctl?sslmode=require"
+```
+
+Deploy with:
+```bash
+helm install certctl certctl/certctl -f external-db-values.yaml
+```
+
+### Example 3: ACME + Let's Encrypt
+
+```yaml
+# acme-values.yaml
+server:
+  issuer:
+    acme:
+      enabled: true
+      directoryURL: https://acme-v02.api.letsencrypt.org/directory
+      email: admin@example.com
+      challengeType: dns-01
+      dnsPresentScript: /scripts/dns-present.sh
+      dnsCleanupScript: /scripts/dns-cleanup.sh
+      dnsPropagationWait: 30s
+```
+
+### Example 4: Email Notifications via Slack + SMTP
+
+```yaml
+# notifications-values.yaml
+server:
+  smtp:
+    enabled: true
+    host: smtp.example.com
+    port: 587
+    username: certctl@example.com
+    password: "smtp-password"
+    fromAddress: certctl@example.com
+    useTLS: true
+
+  notifiers:
+    slack:
+      enabled: true
+      webhookUrl: https://hooks.slack.com/services/YOUR/WEBHOOK/URL
+      channel: "#certificates"
+```
+
+## Upgrading
+
+```bash
+# Update chart repository
+helm repo update
+
+# Upgrade release
+helm upgrade certctl certctl/certctl -f values.yaml
+
+# View upgrade history
+helm history certctl
+
+# Rollback to previous version
+helm rollback certctl 1
+```
+
+## Uninstalling
+
+```bash
+# Delete the release (keeps data by default)
+helm uninstall certctl
+
+# Also delete persistent data
+kubectl delete pvc --all -l app.kubernetes.io/instance=certctl
+
+# Delete namespace
+kubectl delete namespace certctl
+```
+
+## Architecture
+
+### Components
+
+```
+┌──────────────────────────────────────────────────────────────┐
+│ Kubernetes Cluster                                           │
+├──────────────────────────────────────────────────────────────┤
+│                                                              │
+│  ┌─────────────────┐                 ┌──────────────────┐  │
+│  │ Ingress/LB      │                 │  Agent Pod 1     │  │
+│  │ (optional)      │                 │  (DaemonSet)     │  │
+│  └────────┬────────┘                 └──────────────────┘  │
+│           │                                                  │
+│           ▼                           ┌──────────────────┐  │
+│  ┌─────────────────────────┐          │  Agent Pod 2     │  │
+│  │ Server Deployment       │          │  (DaemonSet)     │  │
+│  │ (1 to N replicas)       │          └──────────────────┘  │
+│  │ - REST API              │                                 │
+│  │ - Scheduler             │          ┌──────────────────┐  │
+│  │ - UI Dashboard          │          │  Agent Pod N     │  │
+│  └────────┬────────────────┘          │  (DaemonSet)     │  │
+│           │                           └──────────────────┘  │
+│           │                                                  │
+│           ▼                                                  │
+│  ┌──────────────────────────┐                               │
+│  │ PostgreSQL StatefulSet   │                               │
+│  │ - Database               │                               │
+│  │ - PVC (persistent)       │                               │
+│  └──────────────────────────┘                               │
+│                                                              │
+└──────────────────────────────────────────────────────────────┘
+```
+
+### Network Communication
+
+- **Server → PostgreSQL**: Internal cluster DNS (`certctl-postgres:5432`)
+- **Agent → Server**: Internal cluster DNS (`certctl-server:8443`)
+- **External → Server**: Via Ingress or Service (ClusterIP/LoadBalancer/NodePort)
+
+## Security Considerations
+
+### 1. Secrets Management
+
+All sensitive data is stored in Kubernetes Secrets:
+- PostgreSQL credentials
+- API keys
+- SMTP passwords
+- ACME account secrets
+
+**Best Practices:**
+- Use sealed-secrets or external-secrets operator
+- Enable encryption at rest in etcd
+- Rotate secrets regularly
+
+```bash
+# Example: Using sealed-secrets
+kubectl create secret generic certctl-api-key --from-literal=api-key="$(openssl rand -base64 32)" --dry-run=client -o yaml | kubeseal -f - | kubectl apply -f -
+```
+
+### 2. RBAC
+
+The chart creates minimal RBAC by default:
+- ServiceAccount per release
+- ClusterRole (empty, extensible)
+- ClusterRoleBinding
+
+**To restrict further:**
+```yaml
+rbac:
+  create: true
+  # Add specific rules here
+```
+
+### 3. Pod Security
+
+All containers run with:
+- Non-root user (UID 1000)
+- Read-only root filesystem
+- No privilege escalation
+- Dropped capabilities (ALL)
+
+### 4. Network Policies
+
+Restrict pod-to-pod communication:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: certctl-default-deny
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: certctl
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: certctl
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              name: certctl
+    - to:
+        - podSelector: {}
+      ports:
+        - protocol: TCP
+          port: 53  # DNS
+        - protocol: UDP
+          port: 53
+```
+
+### 5. TLS/HTTPS
+
+Enable HTTPS with cert-manager:
+
+```bash
+helm install cert-manager jetstack/cert-manager \
+  --namespace cert-manager \
+  --create-namespace \
+  --set installCRDs=true
+```
+
+Then configure Ingress with TLS.
+
+### 6. API Key Security
+
+For production:
+1. Generate a strong API key: `openssl rand -base64 32`
+2. Store securely (Vault, sealed-secrets, etc.)
+3. Never commit to Git
+4. Rotate periodically
+
+```bash
+# Generate and deploy API key
+NEW_KEY=$(openssl rand -base64 32)
+kubectl patch secret certctl-server -p "{\"data\":{\"api-key\":\"$(echo -n $NEW_KEY | base64)\"}}"
+```
+
+## Troubleshooting
+
+### 1. Pods Not Starting
+
+```bash
+# Check pod status
+kubectl get pods -l app.kubernetes.io/instance=certctl
+kubectl describe pod <pod-name>
+kubectl logs <pod-name>
+```
+
+### 2. Database Connection Issues
+
+```bash
+# Verify PostgreSQL is running
+kubectl get pods -l app.kubernetes.io/component=postgres
+kubectl logs -l app.kubernetes.io/component=postgres
+
+# Test connection from server pod
+kubectl exec -it <server-pod> -- \
+  psql postgres://certctl:password@certctl-postgres:5432/certctl
+```
+
+### 3. Agent Not Connecting
+
+```bash
+# Check agent logs
+kubectl logs -l app.kubernetes.io/component=agent
+
+# Verify server is reachable
+kubectl exec -it <agent-pod> -- \
+  wget -q -O - http://certctl-server:8443/health
+```
+
+### 4. Persistent Data Loss
+
+```bash
+# Check PVC status
+kubectl get pvc
+
+# Verify data is being stored
+kubectl exec -it <postgres-pod> -- \
+  ls -lah /var/lib/postgresql/data/postgres
+```
+
+### 5. Permission Denied Errors
+
+The chart runs containers as non-root (UID 1000). If you see permission errors:
+
+```yaml
+# Temporarily allow root for debugging
+server:
+  securityContext:
+    runAsUser: 0  # NOT FOR PRODUCTION
+```
+
+### 6. Out of Memory
+
+Increase resource limits:
+
+```bash
+helm upgrade certctl certctl/certctl \
+  --set server.resources.limits.memory=1Gi \
+  --set postgresql.resources.limits.memory=2Gi
+```
+
+### 7. Certificate Validation Issues
+
+For self-signed certificates:
+
+```bash
+kubectl exec -it <pod> -- \
+  CERTCTL_TLS_INSECURE_SKIP_VERIFY=true <command>
+```
+
+### Common Issues and Solutions
+
+| Issue | Solution |
+|-------|----------|
+| `ImagePullBackOff` | Update `server.image.repository` to your registry |
+| `CrashLoopBackOff` | Check logs with `kubectl logs <pod>` |
+| `Pending` PVC | Check storage class availability |
+| Connection timeout | Verify network policies and service DNS |
+| High memory usage | Adjust `postgresql.resources.limits` and `server.resources.limits` |
+
+## Support and Contributing
+
+For issues, questions, or contributions, visit:
+- GitHub: https://github.com/shankar0123/certctl
+- Documentation: https://github.com/shankar0123/certctl/tree/main/docs
+
+## License
+
+BSL-1.1 (converts to Apache 2.0 in 2033)

deploy/helm/certctl/.helmignore

@@ -0,0 +1,31 @@
+# Patterns to ignore when building packages.
+# This supports shell glob patterns, relative path patterns, and negated
+# patterns.  Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.swo
+*~
+*.pyo
+*.pyc
+.pytest_cache/
+*.egg-info/
+dist/
+build/
+# IDE
+.vscode/
+.idea/
+*.sublime-project
+*.sublime-workspace
+# OS
+Thumbs.db
+# Helm
+Chart.lock

deploy/helm/certctl/Chart.yaml

@@ -0,0 +1,20 @@
+apiVersion: v2
+name: certctl
+description: Self-hosted certificate lifecycle management platform
+type: application
+version: 0.1.0
+appVersion: "2.1.0"
+keywords:
+  - certificate
+  - tls
+  - ssl
+  - pki
+  - acme
+  - lifecycle
+  - kubernetes
+maintainers:
+  - name: certctl
+home: https://github.com/shankar0123/certctl
+sources:
+  - https://github.com/shankar0123/certctl
+license: BSL-1.1

deploy/helm/certctl/templates/NOTES.txt

@@ -0,0 +1,68 @@
+1. Get the certctl Server URL by running:
+{{- if .Values.ingress.enabled }}
+  https://{{ index .Values.ingress.hosts 0 "host" }}
+{{- else if contains "NodePort" .Values.server.service.type }}
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "certctl.fullname" . }}-server)
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.server.service.type }}
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "certctl.fullname" . }}-server --template "{.status.loadBalancer.ingress[0].ip}")
+  echo http://$SERVICE_IP:{{ .Values.server.service.port }}
+{{- else }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "certctl.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=server" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+
+2. Get the default API key:
+  kubectl get secret --namespace {{ .Release.Namespace }} {{ include "certctl.fullname" . }}-server -o jsonpath="{.data.api-key}" | base64 --decode; echo
+
+3. Get PostgreSQL connection details:
+  Host: {{ include "certctl.fullname" . }}-postgres.{{ .Release.Namespace }}.svc.cluster.local
+  Port: 5432
+  Database: {{ .Values.postgresql.auth.database }}
+  Username: {{ .Values.postgresql.auth.username }}
+  Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "certctl.fullname" . }}-postgres -o jsonpath="{.data.password}" | base64 --decode)
+
+4. Check deployment status:
+  kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
+
+5. View server logs:
+  kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "certctl.name" . }},app.kubernetes.io/component=server -f
+
+{{- if .Values.agent.enabled }}
+
+6. View agent logs:
+  kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "certctl.name" . }},app.kubernetes.io/component=agent -f
+
+{{- end }}
+
+IMPORTANT NOTES FOR PRODUCTION:
+
+1. Update the API key for security:
+   kubectl patch secret {{ include "certctl.fullname" . }}-server -n {{ .Release.Namespace }} \
+     -p '{"data":{"api-key":"'$(echo -n "YOUR_NEW_API_KEY" | base64)'"}}'
+
+2. Update PostgreSQL password:
+   kubectl patch secret {{ include "certctl.fullname" . }}-postgres -n {{ .Release.Namespace }} \
+     -p '{"data":{"password":"'$(echo -n "YOUR_NEW_PASSWORD" | base64)'"}}'
+
+3. Configure certificate issuers (ACME, step-ca, etc.) via values.yaml:
+   helm upgrade {{ .Release.Name }} certctl/certctl \
+     --set server.issuer.acme.enabled=true \
+     --set server.issuer.acme.directoryURL=https://acme-v02.api.letsencrypt.org/directory \
+     --set server.issuer.acme.email=admin@example.com
+
+4. For production with persistent databases and backups:
+   - Use an external PostgreSQL managed service (AWS RDS, Cloud SQL, etc.)
+   - Set postgresql.enabled=false and configure CERTCTL_DATABASE_URL in values
+
+5. Enable HTTPS/TLS using an Ingress with certificate management:
+   - Configure cert-manager for automatic TLS certificate renewal
+   - Update ingress values with your domain and certificate issuer
+
+6. Review security contexts and network policies:
+   - All containers run as non-root
+   - Implement network policies to restrict traffic between components
+   - Consider pod security policies or security standards for your cluster

deploy/helm/certctl/templates/_helpers.tpl

@@ -0,0 +1,125 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "certctl.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "certctl.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "certctl.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "certctl.labels" -}}
+helm.sh/chart: {{ include "certctl.chart" . }}
+{{ include "certctl.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels for the main service (server, agent, postgres)
+*/}}
+{{- define "certctl.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "certctl.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Server selector labels
+*/}}
+{{- define "certctl.serverSelectorLabels" -}}
+{{ include "certctl.selectorLabels" . }}
+app.kubernetes.io/component: server
+{{- end }}
+
+{{/*
+Agent selector labels
+*/}}
+{{- define "certctl.agentSelectorLabels" -}}
+{{ include "certctl.selectorLabels" . }}
+app.kubernetes.io/component: agent
+{{- end }}
+
+{{/*
+PostgreSQL selector labels
+*/}}
+{{- define "certctl.postgresSelectorLabels" -}}
+{{ include "certctl.selectorLabels" . }}
+app.kubernetes.io/component: postgres
+{{- end }}
+
+{{/*
+Service account name
+*/}}
+{{- define "certctl.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "certctl.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Server image
+*/}}
+{{- define "certctl.serverImage" -}}
+{{- $image := .Values.server.image }}
+{{- printf "%s:%s" $image.repository (coalesce $image.tag .Chart.AppVersion) }}
+{{- end }}
+
+{{/*
+Agent image
+*/}}
+{{- define "certctl.agentImage" -}}
+{{- $image := .Values.agent.image }}
+{{- printf "%s:%s" $image.repository (coalesce $image.tag .Chart.AppVersion) }}
+{{- end }}
+
+{{/*
+PostgreSQL image
+*/}}
+{{- define "certctl.postgresImage" -}}
+{{- $image := .Values.postgresql.image }}
+{{- printf "%s:%s" $image.repository $image.tag }}
+{{- end }}
+
+{{/*
+Database connection string
+*/}}
+{{- define "certctl.databaseURL" -}}
+postgres://{{ .Values.postgresql.auth.username }}:$(POSTGRES_PASSWORD)@{{ include "certctl.fullname" . }}-postgres:5432/{{ .Values.postgresql.auth.database }}?sslmode=disable
+{{- end }}
+
+{{/*
+Server URL (for agents)
+*/}}
+{{- define "certctl.serverURL" -}}
+http://{{ include "certctl.fullname" . }}-server:{{ .Values.server.service.port }}
+{{- end }}

deploy/helm/certctl/templates/agent-configmap.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.agent.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "certctl.fullname" . }}-agent
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent
+data:
+  {{- if .Values.agent.discoveryDirs }}
+  discovery-dirs: {{ .Values.agent.discoveryDirs | quote }}
+  {{- end }}
+{{- end }}

deploy/helm/certctl/templates/agent-daemonset.yaml

@@ -0,0 +1,162 @@
+{{- if .Values.agent.enabled }}
+{{- if eq .Values.agent.kind "DaemonSet" }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "certctl.fullname" . }}-agent
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent
+spec:
+  selector:
+    matchLabels:
+      {{- include "certctl.agentSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "certctl.agentSelectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "certctl.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.agent.securityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: agent
+          image: {{ include "certctl.agentImage" . }}
+          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
+          env:
+            - name: CERTCTL_SERVER_URL
+              value: {{ include "certctl.serverURL" . }}
+            - name: CERTCTL_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: api-key
+            - name: CERTCTL_AGENT_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: CERTCTL_KEY_DIR
+              value: {{ .Values.agent.keyDir }}
+            {{- if .Values.agent.discoveryDirs }}
+            - name: CERTCTL_DISCOVERY_DIRS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-agent
+                  key: discovery-dirs
+            {{- end }}
+            {{- with .Values.agent.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.agent.resources | nindent 12 }}
+          volumeMounts:
+            - name: agent-keys
+              mountPath: {{ .Values.agent.keyDir }}
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: agent-keys
+          emptyDir:
+            sizeLimit: 1Gi
+        - name: tmp
+          emptyDir: {}
+{{- else if eq .Values.agent.kind "Deployment" }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "certctl.fullname" . }}-agent
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent
+spec:
+  replicas: {{ .Values.agent.replicas }}
+  selector:
+    matchLabels:
+      {{- include "certctl.agentSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "certctl.agentSelectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "certctl.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.agent.securityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: agent
+          image: {{ include "certctl.agentImage" . }}
+          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
+          env:
+            - name: CERTCTL_SERVER_URL
+              value: {{ include "certctl.serverURL" . }}
+            - name: CERTCTL_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: api-key
+            - name: CERTCTL_AGENT_NAME
+              {{- if .Values.agent.name }}
+              value: {{ .Values.agent.name | quote }}
+              {{- else }}
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+              {{- end }}
+            - name: CERTCTL_KEY_DIR
+              value: {{ .Values.agent.keyDir }}
+            {{- if .Values.agent.discoveryDirs }}
+            - name: CERTCTL_DISCOVERY_DIRS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-agent
+                  key: discovery-dirs
+            {{- end }}
+            {{- with .Values.agent.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.agent.resources | nindent 12 }}
+          volumeMounts:
+            - name: agent-keys
+              mountPath: {{ .Values.agent.keyDir }}
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: agent-keys
+          emptyDir:
+            sizeLimit: 1Gi
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- end }}

deploy/helm/certctl/templates/ingress.yaml

@@ -0,0 +1,41 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "certctl.fullname" . }}
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "certctl.fullname" . }}-server
+                port:
+                  number: {{ $.Values.server.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

deploy/helm/certctl/templates/postgres-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "certctl.fullname" . }}-postgres
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+type: Opaque
+stringData:
+  password: {{ .Values.postgresql.auth.password | default "changeme" | quote }}
+  username: {{ .Values.postgresql.auth.username | quote }}
+  database: {{ .Values.postgresql.auth.database | quote }}

deploy/helm/certctl/templates/postgres-service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.postgresql.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "certctl.fullname" . }}-postgres
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  clusterIP: None
+  ports:
+    - port: {{ .Values.postgresql.service.port }}
+      targetPort: postgres
+      protocol: TCP
+      name: postgres
+  selector:
+    {{- include "certctl.postgresSelectorLabels" . | nindent 4 }}
+{{- end }}

deploy/helm/certctl/templates/postgres-statefulset.yaml

@@ -0,0 +1,79 @@
+{{- if .Values.postgresql.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "certctl.fullname" . }}-postgres
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  serviceName: {{ include "certctl.fullname" . }}-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "certctl.postgresSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "certctl.postgresSelectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        {{- toYaml .Values.postgresql.securityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: postgres
+          image: {{ include "certctl.postgresImage" . }}
+          imagePullPolicy: {{ .Values.postgresql.image.pullPolicy }}
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-postgres
+                  key: database
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-postgres
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-postgres
+                  key: password
+            - name: POSTGRES_INITDB_ARGS
+              value: "--encoding=UTF8"
+          livenessProbe:
+            {{- toYaml .Values.postgresql.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.postgresql.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.postgresql.resources | nindent 12 }}
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+              subPath: postgres
+            - name: postgres-init
+              mountPath: /docker-entrypoint-initdb.d
+      volumes:
+        - name: postgres-init
+          emptyDir: {}
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        {{- if .Values.postgresql.storage.storageClass }}
+        storageClassName: {{ .Values.postgresql.storage.storageClass }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.postgresql.storage.size }}
+{{- end }}

deploy/helm/certctl/templates/server-configmap.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "certctl.fullname" . }}-server
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+data:
+  log-level: {{ .Values.server.logging.level | quote }}
+  auth-type: {{ .Values.server.auth.type | quote }}
+  keygen-mode: {{ .Values.server.keygen.mode | quote }}
+  rate-limit-rps: {{ .Values.server.rateLimiting.rps | quote }}
+  rate-limit-burst: {{ .Values.server.rateLimiting.burst | quote }}
+  {{- if .Values.server.cors.origins }}
+  cors-origins: {{ .Values.server.cors.origins | quote }}
+  {{- end }}
+  {{- if .Values.server.networkScan.enabled }}
+  network-scan-interval: {{ .Values.server.networkScan.interval | quote }}
+  {{- end }}
+  {{- if .Values.server.est.enabled }}
+  est-issuer-id: {{ .Values.server.est.issuerID | quote }}
+  {{- if .Values.server.est.profileID }}
+  est-profile-id: {{ .Values.server.est.profileID | quote }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.server.smtp.enabled }}
+  smtp-host: {{ .Values.server.smtp.host | quote }}
+  smtp-port: {{ .Values.server.smtp.port | quote }}
+  smtp-username: {{ .Values.server.smtp.username | quote }}
+  smtp-from-address: {{ .Values.server.smtp.fromAddress | quote }}
+  {{- end }}
+  {{- if .Values.server.issuer.acme.enabled }}
+  acme-directory-url: {{ .Values.server.issuer.acme.directoryURL | quote }}
+  acme-email: {{ .Values.server.issuer.acme.email | quote }}
+  acme-challenge-type: {{ .Values.server.issuer.acme.challengeType | quote }}
+  {{- end }}

deploy/helm/certctl/templates/server-deployment.yaml

@@ -0,0 +1,196 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "certctl.fullname" . }}-server
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+spec:
+  {{- if gt (int .Values.server.replicas) 1 }}
+  replicas: {{ .Values.server.replicas }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "certctl.serverSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "certctl.serverSelectorLabels" . | nindent 8 }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/server-configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/server-secret.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: {{ include "certctl.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.server.securityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: server
+          image: {{ include "certctl.serverImage" . }}
+          imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.server.port }}
+              protocol: TCP
+          env:
+            - name: CERTCTL_SERVER_HOST
+              value: "0.0.0.0"
+            - name: CERTCTL_SERVER_PORT
+              value: "{{ .Values.server.port }}"
+            - name: CERTCTL_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: database-url
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-postgres
+                  key: password
+            - name: CERTCTL_LOG_LEVEL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: log-level
+            - name: CERTCTL_LOG_FORMAT
+              value: "json"
+            - name: CERTCTL_AUTH_TYPE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: auth-type
+            {{- if eq .Values.server.auth.type "api-key" }}
+            - name: CERTCTL_AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: api-key
+            {{- end }}
+            - name: CERTCTL_KEYGEN_MODE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: keygen-mode
+            - name: CERTCTL_RATE_LIMIT_RPS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: rate-limit-rps
+            - name: CERTCTL_RATE_LIMIT_BURST
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: rate-limit-burst
+            {{- if .Values.server.cors.origins }}
+            - name: CERTCTL_CORS_ORIGINS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: cors-origins
+            {{- end }}
+            {{- if .Values.server.networkScan.enabled }}
+            - name: CERTCTL_NETWORK_SCAN_ENABLED
+              value: "true"
+            - name: CERTCTL_NETWORK_SCAN_INTERVAL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: network-scan-interval
+            {{- end }}
+            {{- if .Values.server.est.enabled }}
+            - name: CERTCTL_EST_ENABLED
+              value: "true"
+            - name: CERTCTL_EST_ISSUER_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: est-issuer-id
+            {{- if .Values.server.est.profileID }}
+            - name: CERTCTL_EST_PROFILE_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: est-profile-id
+            {{- end }}
+            {{- end }}
+            {{- if .Values.server.smtp.enabled }}
+            - name: CERTCTL_SMTP_HOST
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-host
+            - name: CERTCTL_SMTP_PORT
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-port
+            - name: CERTCTL_SMTP_USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-username
+            - name: CERTCTL_SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-password
+            - name: CERTCTL_SMTP_FROM_ADDRESS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-from-address
+            {{- end }}
+            {{- if .Values.server.issuer.acme.enabled }}
+            - name: CERTCTL_ACME_DIRECTORY_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: acme-directory-url
+            - name: CERTCTL_ACME_EMAIL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: acme-email
+            - name: CERTCTL_ACME_CHALLENGE_TYPE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: acme-challenge-type
+            {{- end }}
+            {{- with .Values.server.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          livenessProbe:
+            {{- toYaml .Values.server.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.server.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.server.resources | nindent 12 }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            {{- if .Values.server.volumeMounts }}
+            {{- toYaml .Values.server.volumeMounts | nindent 12 }}
+            {{- end }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        {{- if .Values.server.volumes }}
+        {{- toYaml .Values.server.volumes | nindent 8 }}
+        {{- end }}
+      {{- if .Values.nodeAffinity }}
+      affinity:
+        nodeAffinity:
+          {{- toYaml .Values.nodeAffinity | nindent 10 }}
+      {{- else if .Values.podAntiAffinity }}
+      affinity:
+        podAntiAffinity:
+          {{- toYaml .Values.podAntiAffinity | nindent 10 }}
+      {{- else if .Values.podAffinity }}
+      affinity:
+        podAffinity:
+          {{- toYaml .Values.podAffinity | nindent 10 }}
+      {{- end }}

deploy/helm/certctl/templates/server-secret.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "certctl.fullname" . }}-server
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+type: Opaque
+stringData:
+  database-url: postgres://{{ .Values.postgresql.auth.username }}:$(POSTGRES_PASSWORD)@{{ include "certctl.fullname" . }}-postgres:5432/{{ .Values.postgresql.auth.database }}?sslmode=disable
+  {{- if and (eq .Values.server.auth.type "api-key") .Values.server.auth.apiKey }}
+  api-key: {{ .Values.server.auth.apiKey | quote }}
+  {{- end }}
+  {{- if .Values.server.smtp.enabled }}
+  smtp-password: {{ .Values.server.smtp.password | quote }}
+  {{- end }}

deploy/helm/certctl/templates/server-service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "certctl.fullname" . }}-server
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+  {{- with .Values.server.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.server.service.type }}
+  ports:
+    - port: {{ .Values.server.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "certctl.serverSelectorLabels" . | nindent 4 }}

deploy/helm/certctl/templates/serviceaccount.yaml

@@ -0,0 +1,44 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "certctl.serviceAccountName" . }}
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- if .Values.rbac.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "certctl.fullname" . }}
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+rules:
+{{- if .Values.kubernetesSecrets.enabled }}
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "create", "update", "patch"]
+{{- else }}
+  []
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "certctl.fullname" . }}
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "certctl.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "certctl.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

deploy/helm/certctl/values.yaml

@@ -0,0 +1,441 @@
+# Default values for certctl Helm chart
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# Namespace override (optional)
+namespace: ""
+
+# Global configuration
+commonLabels: {}
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+# ==============================================================================
+# Certctl Server Configuration
+# ==============================================================================
+server:
+  # Number of replicas (for HA deployments)
+  replicas: 1
+
+  # Image configuration
+  image:
+    repository: ghcr.io/shankar0123/certctl
+    tag: "" # defaults to Chart.appVersion
+    pullPolicy: IfNotPresent
+
+  # Server port
+  port: 8443
+
+  # Resource requests and limits
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+  # Pod security context
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    readOnlyRootFilesystem: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
+  # Liveness and readiness probes
+  livenessProbe:
+    httpGet:
+      path: /health
+      port: http
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+
+  readinessProbe:
+    httpGet:
+      path: /readyz
+      port: http
+    initialDelaySeconds: 5
+    periodSeconds: 5
+    timeoutSeconds: 3
+    failureThreshold: 2
+
+  # Service type (ClusterIP, LoadBalancer, NodePort)
+  service:
+    type: ClusterIP
+    port: 8443
+    annotations: {}
+
+  # Authentication configuration
+  auth:
+    type: api-key  # Options: api-key, none (for demo only)
+    apiKey: ""     # REQUIRED in production - set via --set or values override
+
+  # Logging configuration
+  logging:
+    level: info  # debug, info, warn, error
+    format: json  # json or text
+
+  # SMTP configuration for email notifications (optional)
+  smtp:
+    enabled: false
+    host: ""
+    port: 587
+    username: ""
+    password: ""
+    fromAddress: ""
+    useTLS: true
+
+  # Certificate digest digest (periodic email summary)
+  digest:
+    enabled: false
+    interval: "24h"
+    recipients: []
+    # Example:
+    # - admin@example.com
+    # - ops@example.com
+
+  # Enrollment over Secure Transport (EST) configuration
+  est:
+    enabled: false
+    issuerID: "iss-local"
+    profileID: ""
+
+  # Rate limiting configuration
+  rateLimiting:
+    rps: 100      # Requests per second
+    burst: 200    # Burst capacity
+
+  # Network scanning configuration
+  networkScan:
+    enabled: false
+    interval: "6h"
+
+  # Certificate key generation mode
+  keygen:
+    mode: agent   # Options: agent (production), server (demo with warning)
+
+  # CORS configuration
+  cors:
+    origins: ""   # Comma-separated list, empty means deny all cross-origin requests
+
+  # Issuer connectors configuration
+  issuer:
+    local:
+      enabled: true
+      # For sub-CA mode, provide these paths:
+      # caCertPath: /path/to/ca.crt
+      # caKeyPath: /path/to/ca.key
+
+    acme:
+      enabled: false
+      directoryURL: ""
+      email: ""
+      challengeType: "http-01"  # Options: http-01, dns-01, dns-persist-01
+      # DNS configuration (for dns-01 or dns-persist-01)
+      # dnsPresentScript: /path/to/dns-present.sh
+      # dnsCleanupScript: /path/to/dns-cleanup.sh
+      # dnsPropagationWait: "30s"
+      # dnsPersistIssuerDomain: "validation.example.com"
+      # EAB configuration (for ZeroSSL, Google Trust Services, etc.)
+      # eabKid: ""
+      # eabHmac: ""
+
+    stepca:
+      enabled: false
+      # rootCAPath: /path/to/root_ca.crt
+      # intermediateCAPath: /path/to/intermediate_ca.crt
+      # provisionerName: ""
+      # provisionerPassword: ""
+
+    openssl:
+      enabled: false
+      # signScript: /path/to/sign.sh
+      # revokeScript: /path/to/revoke.sh
+      # crlScript: /path/to/crl.sh
+      # timeoutSeconds: 30
+
+  # Notifier connectors configuration
+  notifiers:
+    slack:
+      enabled: false
+      # webhookUrl: ""
+      # channel: ""
+      # username: ""
+      # iconEmoji: ""
+
+    teams:
+      enabled: false
+      # webhookUrl: ""
+
+    pagerduty:
+      enabled: false
+      # routingKey: ""
+      # severity: warning
+
+    opsgenie:
+      enabled: false
+      # apiKey: ""
+      # priority: P3
+
+  # Additional environment variables
+  # Will be passed as-is to the server container
+  env: {}
+  # Example:
+  # CERTCTL_SCHEDULER_RENEWAL_CHECK_INTERVAL: "1h"
+  # CERTCTL_DATABASE_MAX_CONNS: "25"
+
+  # Additional volume mounts for custom configurations
+  # volumeMounts: []
+  # - name: ca-cert
+  #   mountPath: /etc/ssl/certs/ca.crt
+  #   subPath: ca.crt
+
+  # Additional volumes
+  # volumes: []
+  # - name: ca-cert
+  #   secret:
+  #     secretName: ca-cert
+
+# ==============================================================================
+# PostgreSQL Configuration
+# ==============================================================================
+postgresql:
+  # Enable/disable PostgreSQL (set to false if using external database)
+  enabled: true
+
+  # Image configuration
+  image:
+    repository: postgres
+    tag: "16-alpine"
+    pullPolicy: IfNotPresent
+
+  # Authentication
+  auth:
+    database: certctl
+    username: certctl
+    password: ""  # REQUIRED - set via --set or values override
+
+  # Storage configuration
+  storage:
+    size: 10Gi
+    storageClass: ""  # Uses default StorageClass if empty
+    # deleteOnTermination: false  # Keep data on Helm uninstall
+
+  # Resource requests and limits
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+  # Pod security context
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 999
+    runAsGroup: 999
+    fsGroup: 999
+
+  # Liveness and readiness probes
+  livenessProbe:
+    exec:
+      command:
+        - /bin/sh
+        - -c
+        - pg_isready -U certctl -d certctl
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+
+  readinessProbe:
+    exec:
+      command:
+        - /bin/sh
+        - -c
+        - pg_isready -U certctl -d certctl
+    initialDelaySeconds: 5
+    periodSeconds: 5
+    timeoutSeconds: 3
+    failureThreshold: 2
+
+  # Service configuration
+  service:
+    type: ClusterIP
+    port: 5432
+
+  # PostgreSQL-specific settings
+  postgresqlConfig: {}
+  # Example:
+  # max_connections: "200"
+  # shared_buffers: "256MB"
+
+# ==============================================================================
+# Certctl Agent Configuration
+# ==============================================================================
+agent:
+  # Enable/disable agent deployment
+  enabled: true
+
+  # Deployment strategy: DaemonSet (recommended) or Deployment
+  kind: DaemonSet  # Options: DaemonSet, Deployment
+
+  # Image configuration
+  image:
+    repository: ghcr.io/shankar0123/certctl-agent
+    tag: ""  # defaults to Chart.appVersion
+    pullPolicy: IfNotPresent
+
+  # Number of replicas (for Deployment kind; ignored for DaemonSet)
+  replicas: 1
+
+  # Resource requests and limits
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+
+  # Pod security context
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    readOnlyRootFilesystem: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
+  # Agent name (can be overridden per pod via StatefulSet ordinals)
+  name: ""  # If empty, uses release name
+
+  # Key storage directory
+  keyDir: /var/lib/certctl/keys
+
+  # Certificate discovery directories (comma-separated)
+  discoveryDirs: ""
+  # Example: "/etc/ssl/certs,/etc/pki/tls"
+
+  # Node selector for agent pods (for DaemonSet)
+  nodeSelector: {}
+  # Example:
+  # node-role.kubernetes.io/worker: "true"
+
+  # Tolerations for agent pods
+  tolerations: []
+  # Example:
+  # - key: node-role
+  #   operator: Equal
+  #   value: worker
+  #   effect: NoSchedule
+
+  # Affinity rules
+  affinity: {}
+
+  # Additional environment variables
+  env: {}
+
+# ==============================================================================
+# Ingress Configuration
+# ==============================================================================
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+    - host: certctl.local
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+    # - secretName: certctl-tls
+    #   hosts:
+    #     - certctl.local
+
+# ==============================================================================
+# Service Account Configuration
+# ==============================================================================
+serviceAccount:
+  create: true
+  annotations: {}
+  name: ""  # defaults to release name if empty
+
+# ==============================================================================
+# RBAC Configuration
+# ==============================================================================
+rbac:
+  create: true
+
+# ==============================================================================
+# Kubernetes Secrets Target Connector
+# ==============================================================================
+kubernetesSecrets:
+  # Enable RBAC rules for managing TLS Secrets
+  enabled: false
+
+# ==============================================================================
+# Pod Disruption Budget (for HA deployments)
+# ==============================================================================
+podDisruptionBudget:
+  enabled: false
+  minAvailable: 1
+  # maxUnavailable: 1
+
+# ==============================================================================
+# Monitoring Configuration
+# ==============================================================================
+monitoring:
+  enabled: false
+  # Prometheus ServiceMonitor
+  serviceMonitor:
+    enabled: false
+    interval: 30s
+    scrapeTimeout: 10s
+    # labels: {}
+    # selector: {}
+
+# ==============================================================================
+# Advanced Configuration
+# ==============================================================================
+
+# Node affinity for server pods
+nodeAffinity: {}
+
+# Pod affinity for server pods
+podAffinity: {}
+
+# Pod anti-affinity for server pods (for HA)
+podAntiAffinity: {}
+# Example:
+# podAntiAffinity:
+#   preferredDuringSchedulingIgnoredDuringExecution:
+#     - weight: 100
+#       podAffinityTerm:
+#         labelSelector:
+#           matchExpressions:
+#             - key: app.kubernetes.io/name
+#               operator: In
+#               values:
+#                 - certctl
+#         topologyKey: kubernetes.io/hostname
+
+# Custom labels for all resources
+customLabels: {}
+
+# Custom annotations for all resources
+customAnnotations: {}

deploy/helm/examples/values-acme-dns01.yaml

@@ -0,0 +1,77 @@
+# Certctl with ACME DNS-01 Challenge (Let's Encrypt)
+# Enables automatic certificate issuance from Let's Encrypt
+# using DNS-01 verification (wildcard-capable)
+
+server:
+  auth:
+    type: api-key
+    apiKey: "CHANGE_ME"
+
+  issuer:
+    local:
+      enabled: true
+
+    acme:
+      enabled: true
+      directoryURL: https://acme-v02.api.letsencrypt.org/directory
+      email: admin@example.com
+      challengeType: dns-01
+      dnsPresentScript: /scripts/dns-present.sh
+      dnsCleanupScript: /scripts/dns-cleanup.sh
+      dnsPropagationWait: 30s
+      # For DNS-PERSIST-01 (standing validation record, no per-renewal updates):
+      # challengeType: dns-persist-01
+      # dnsPersistIssuerDomain: validation.example.com
+
+  # Mount DNS scripts as ConfigMap
+  volumes:
+    - name: dns-scripts
+      configMap:
+        name: dns-scripts
+        defaultMode: 0755
+
+  volumeMounts:
+    - name: dns-scripts
+      mountPath: /scripts
+      readOnly: true
+
+postgresql:
+  enabled: true
+  storage:
+    size: 20Gi
+
+agent:
+  enabled: true
+  kind: DaemonSet
+
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: certctl.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+
+---
+# You'll need to create the DNS scripts ConfigMap separately:
+#
+# kubectl create configmap dns-scripts \
+#   --from-file=dns-present.sh=./scripts/dns-present.sh \
+#   --from-file=dns-cleanup.sh=./scripts/dns-cleanup.sh
+#
+# Example dns-present.sh (Cloudflare):
+#   #!/bin/bash
+#   DOMAIN=$1
+#   TOKEN=$2
+#
+#   curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
+#     -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
+#     -d "{\"type\":\"TXT\",\"name\":\"_acme-challenge.${DOMAIN}\",\"content\":\"${TOKEN}\"}"
+#
+# Example dns-cleanup.sh (Cloudflare):
+#   #!/bin/bash
+#   DOMAIN=$1
+#
+#   curl -X DELETE "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{record_id}" \
+#     -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}"

deploy/helm/examples/values-dev.yaml

@@ -0,0 +1,99 @@
+# Certctl Development Configuration
+# Lightweight setup for development and testing
+# - Single server replica
+# - Small PostgreSQL storage
+# - Minimal resource limits
+# - No ingress or monitoring
+# - Demo auth mode (no API key required)
+
+server:
+  replicas: 1
+
+  image:
+    repository: ghcr.io/shankar0123/certctl
+    pullPolicy: IfNotPresent  # Use latest tag
+
+  port: 8443
+
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+
+  auth:
+    type: none  # Demo mode - no authentication
+
+  logging:
+    level: debug
+    format: json
+
+  service:
+    type: LoadBalancer  # Easy external access for dev
+
+  issuer:
+    local:
+      enabled: true
+
+  rateLimiting:
+    rps: 100
+    burst: 200
+
+postgresql:
+  enabled: true
+
+  image:
+    repository: postgres
+    tag: "16-alpine"
+    pullPolicy: IfNotPresent
+
+  auth:
+    database: certctl
+    username: certctl
+    password: "dev-password-change-me"
+
+  storage:
+    size: 5Gi
+    storageClass: ""  # Use default storage class
+
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+
+agent:
+  enabled: true
+  kind: Deployment
+  replicas: 1
+
+  image:
+    repository: ghcr.io/shankar0123/certctl-agent
+    pullPolicy: IfNotPresent
+
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+    limits:
+      cpu: 100m
+      memory: 128Mi
+
+ingress:
+  enabled: false
+
+serviceAccount:
+  create: true
+
+rbac:
+  create: true
+
+monitoring:
+  enabled: false
+
+customLabels:
+  environment: development

deploy/helm/examples/values-external-db.yaml

@@ -0,0 +1,50 @@
+# Certctl with External PostgreSQL Database
+# Use this when PostgreSQL is managed externally:
+# - AWS RDS
+# - Cloud SQL (Google Cloud)
+# - Azure Database for PostgreSQL
+# - Self-managed PostgreSQL server
+
+server:
+  replicas: 2
+
+  auth:
+    type: api-key
+    apiKey: "CHANGE_ME"
+
+  issuer:
+    local:
+      enabled: true
+
+  # Pass external database URL via environment variable
+  env:
+    CERTCTL_DATABASE_URL: "postgres://certctl:CHANGE_ME@postgres.example.com:5432/certctl?sslmode=require"
+
+# Disable internal PostgreSQL
+postgresql:
+  enabled: false
+
+agent:
+  enabled: true
+  kind: DaemonSet
+
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: certctl.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+
+# For AWS RDS with IAM authentication:
+# env:
+#   CERTCTL_DATABASE_URL: "postgres://certctl:CHANGE_ME@mydb.123456789.us-east-1.rds.amazonaws.com:5432/certctl?sslmode=require"
+
+# For Google Cloud SQL:
+# env:
+#   CERTCTL_DATABASE_URL: "postgres://certctl:CHANGE_ME@/certctl?host=/cloudsql/PROJECT:REGION:INSTANCE&sslmode=require"
+
+# For Azure Database:
+# env:
+#   CERTCTL_DATABASE_URL: "postgres://certctl@servername:CHANGE_ME@servername.postgres.database.azure.com:5432/certctl?sslmode=require"

deploy/helm/examples/values-prod-ha.yaml

@@ -0,0 +1,159 @@
+# Certctl Production HA Configuration
+# High availability deployment with:
+# - 3 server replicas with pod anti-affinity
+# - Large PostgreSQL storage
+# - Resource limits for production
+# - Prometheus monitoring
+# - Network policies enforcement
+
+namespace: certctl
+
+server:
+  replicas: 3
+
+  image:
+    repository: ghcr.io/shankar0123/certctl
+    tag: "2.1.0"
+    pullPolicy: IfNotPresent
+
+  port: 8443
+
+  resources:
+    requests:
+      cpu: 250m
+      memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 512Mi
+
+  auth:
+    type: api-key
+    apiKey: "CHANGE_ME_IN_PRODUCTION"  # Use --set or sealed-secrets
+
+  logging:
+    level: info
+    format: json
+
+  service:
+    type: ClusterIP
+    annotations:
+      prometheus.io/scrape: "true"
+      prometheus.io/port: "8443"
+      prometheus.io/path: "/api/v1/metrics/prometheus"
+
+  issuer:
+    local:
+      enabled: true
+    acme:
+      enabled: true
+      directoryURL: https://acme-v02.api.letsencrypt.org/directory
+      email: admin@example.com
+      challengeType: dns-01
+
+  rateLimiting:
+    rps: 500
+    burst: 1000
+
+postgresql:
+  enabled: true
+
+  image:
+    repository: postgres
+    tag: "16-alpine"
+    pullPolicy: IfNotPresent
+
+  auth:
+    database: certctl
+    username: certctl
+    password: "CHANGE_ME_IN_PRODUCTION"  # Use --set or sealed-secrets
+
+  storage:
+    size: 100Gi
+    storageClass: "fast-ssd"  # Use your high-performance storage class
+
+  resources:
+    requests:
+      cpu: 500m
+      memory: 512Mi
+    limits:
+      cpu: 2000m
+      memory: 2Gi
+
+agent:
+  enabled: true
+  kind: DaemonSet
+
+  image:
+    repository: ghcr.io/shankar0123/certctl-agent
+    tag: "2.1.0"
+    pullPolicy: IfNotPresent
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 256Mi
+
+  discoveryDirs: "/etc/ssl/certs,/etc/pki/tls,/etc/ssl"
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+  hosts:
+    - host: certctl.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: certctl-tls
+      hosts:
+        - certctl.example.com
+
+serviceAccount:
+  create: true
+  annotations:
+    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT:role/certctl-role  # For IRSA on AWS
+
+rbac:
+  create: true
+
+podDisruptionBudget:
+  enabled: true
+  minAvailable: 2
+
+monitoring:
+  enabled: true
+  serviceMonitor:
+    enabled: true
+    interval: 30s
+    scrapeTimeout: 10s
+
+# Pod anti-affinity for HA
+podAntiAffinity:
+  requiredDuringSchedulingIgnoredDuringExecution:
+    - labelSelector:
+        matchExpressions:
+          - key: app.kubernetes.io/name
+            operator: In
+            values:
+              - certctl
+          - key: app.kubernetes.io/component
+            operator: In
+            values:
+              - server
+      topologyKey: kubernetes.io/hostname
+
+customLabels:
+  environment: production
+  team: platform
+  cost-center: ops
+
+customAnnotations:
+  slack-alerts: "#ops"
+  backup-policy: daily

deploy/test/nginx-entrypoint.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Generate a self-signed placeholder certificate so NGINX can boot
+# before the certctl agent deploys a real certificate.
+# Once the agent deploys, it overwrites these files and reloads NGINX.
+
+CERT_DIR="/etc/nginx/certs"
+mkdir -p "$CERT_DIR"
+
+# Make cert directory world-writable so the certctl-agent container
+# (which shares this volume) can overwrite the placeholder certs.
+chmod 777 "$CERT_DIR"
+
+if [ ! -f "$CERT_DIR/cert.pem" ]; then
+    echo "Generating self-signed placeholder certificate..."
+    apk add --no-cache openssl > /dev/null 2>&1
+    openssl req -x509 -nodes -days 1 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+        -keyout "$CERT_DIR/key.pem" \
+        -out "$CERT_DIR/cert.pem" \
+        -subj "/CN=placeholder.certctl.test" \
+        2>/dev/null
+    # Make placeholder certs writable by the agent container
+    chmod 666 "$CERT_DIR/cert.pem" "$CERT_DIR/key.pem"
+    echo "Placeholder certificate generated."
+fi
+
+# Start NGINX in foreground
+exec nginx -g "daemon off;"

deploy/test/nginx.conf

@@ -0,0 +1,42 @@
+# NGINX configuration for certctl test environment.
+# The agent deploys certificates to /etc/nginx/certs/ and reloads NGINX.
+# On startup, NGINX uses a self-signed placeholder so it can boot before any cert is deployed.
+
+# Generate a self-signed placeholder on container start (see entrypoint in compose).
+# Once the agent deploys a real cert, it overwrites these files and reloads.
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    # HTTP → redirect to HTTPS (optional, for realism)
+    server {
+        listen 80;
+        server_name _;
+        return 301 https://$host$request_uri;
+    }
+
+    # HTTPS server — serves whatever cert the agent has deployed
+    server {
+        listen 443 ssl;
+        server_name _;
+
+        ssl_certificate     /etc/nginx/certs/cert.pem;
+        ssl_certificate_key /etc/nginx/certs/key.pem;
+
+        # Modern TLS settings
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers off;
+
+        location / {
+            default_type text/plain;
+            return 200 'certctl test environment — NGINX is serving TLS\n';
+        }
+
+        location /health {
+            default_type text/plain;
+            return 200 'ok\n';
+        }
+    }
+}

deploy/test/pebble-config.json

@@ -0,0 +1,16 @@
+{
+  "pebble": {
+    "listenAddress": "0.0.0.0:14000",
+    "managementListenAddress": "0.0.0.0:15000",
+    "certificate": "test/certs/localhost/cert.pem",
+    "privateKey": "test/certs/localhost/key.pem",
+    "httpPort": 80,
+    "tlsPort": 443,
+    "ocspResponderURL": "",
+    "externalAccountBindingRequired": false,
+    "retryAfter": {
+      "authz": 3,
+      "order": 5
+    }
+  }
+}

deploy/test/run-test.sh

@@ -0,0 +1,946 @@
+#!/usr/bin/env bash
+# =============================================================================
+# certctl End-to-End Test Script
+# =============================================================================
+#
+# Automates the full lifecycle test from docs/test-env.md:
+#   1. Bring up all 7 containers (build from source)
+#   2. Wait for every service to be healthy
+#   3. Verify pre-seeded data (agents, issuers, targets, profiles)
+#   4. Issue a certificate via Local CA → deploy to NGINX → verify TLS
+#   5. Issue a certificate via ACME/Pebble → verify
+#   6. Issue a certificate via step-ca → verify
+#   7. Test revocation + CRL
+#   8. Test discovery
+#   9. Test renewal (re-issue step-ca cert, check version history)
+#  10. EST enrollment (RFC 7030) — cacerts + simpleenroll
+#  11. S/MIME issuance — emailProtection EKU + adaptive KeyUsage
+#  12. API spot checks + print summary
+#
+# Usage:
+#   cd certctl/deploy
+#   ./test/run-test.sh          # full run (build + test)
+#   ./test/run-test.sh --no-build   # skip docker build, reuse existing containers
+#   ./test/run-test.sh --no-teardown # leave containers running after test
+#
+# Requirements: docker, curl, openssl, jq (or python3 for json parsing)
+# =============================================================================
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Config
+# ---------------------------------------------------------------------------
+COMPOSE_FILE="docker-compose.test.yml"
+API_URL="http://localhost:8443"
+API_KEY="test-key-2026"
+NGINX_TLS="localhost:8444"
+AUTH_HEADER="Authorization: Bearer ${API_KEY}"
+
+# Flags
+BUILD=true
+TEARDOWN=true
+for arg in "$@"; do
+  case "$arg" in
+    --no-build)    BUILD=false ;;
+    --no-teardown) TEARDOWN=false ;;
+  esac
+done
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+BOLD='\033[1m'
+NC='\033[0m' # No Color
+
+PASS=0
+FAIL=0
+SKIP=0
+
+pass() {
+  PASS=$((PASS + 1))
+  echo -e "  ${GREEN}PASS${NC} $1"
+}
+
+fail() {
+  FAIL=$((FAIL + 1))
+  echo -e "  ${RED}FAIL${NC} $1"
+  if [ -n "${2:-}" ]; then
+    echo -e "       ${RED}$2${NC}"
+  fi
+}
+
+skip() {
+  SKIP=$((SKIP + 1))
+  echo -e "  ${YELLOW}SKIP${NC} $1"
+}
+
+info() {
+  echo -e "${CYAN}==>${NC} $1"
+}
+
+header() {
+  echo ""
+  echo -e "${BOLD}─── $1 ───${NC}"
+}
+
+# API helper: GET endpoint, return JSON body. Exits 1 on HTTP error.
+api_get() {
+  local path="$1"
+  curl -sf -H "${AUTH_HEADER}" "${API_URL}${path}" 2>/dev/null
+}
+
+# API helper: POST with optional JSON body
+api_post() {
+  local path="$1"
+  local body="${2:-}"
+  if [ -n "$body" ]; then
+    curl -sf -X POST -H "${AUTH_HEADER}" -H "Content-Type: application/json" \
+      -d "$body" "${API_URL}${path}" 2>/dev/null
+  else
+    curl -sf -X POST -H "${AUTH_HEADER}" "${API_URL}${path}" 2>/dev/null
+  fi
+}
+
+# Wait for an HTTP endpoint to return 200. Retries with backoff.
+wait_for_http() {
+  local url="$1"
+  local label="$2"
+  local max_wait="${3:-120}"
+  local elapsed=0
+  local interval=3
+
+  while [ $elapsed -lt $max_wait ]; do
+    if curl -sf -H "${AUTH_HEADER}" "$url" >/dev/null 2>&1; then
+      return 0
+    fi
+    sleep $interval
+    elapsed=$((elapsed + interval))
+  done
+  return 1
+}
+
+# Extract a field from JSON using python3 (no jq dependency)
+json_field() {
+  python3 -c "import sys,json; d=json.load(sys.stdin); print($1)" 2>/dev/null
+}
+
+# Wait for a job to reach a terminal state (Completed or Failed)
+# Usage: wait_for_job <cert_id> <max_seconds>
+# Returns 0 if Completed, 1 if Failed/timeout
+wait_for_jobs_done() {
+  local cert_id="$1"
+  local max_wait="${2:-180}"
+  local elapsed=0
+  local interval=5
+
+  while [ $elapsed -lt $max_wait ]; do
+    local jobs_json
+    jobs_json=$(api_get "/api/v1/jobs" 2>/dev/null || echo '{"data":[]}')
+
+    # Check if all jobs for this cert are in terminal state
+    # API returns jobs under "data" key (not "jobs")
+    local pending
+    pending=$(echo "$jobs_json" | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+jobs = data.get('data') or data.get('jobs') or []
+active = [j for j in jobs if j.get('certificate_id') == '$cert_id'
+          and j.get('status') not in ('Completed', 'Failed', 'Cancelled')]
+print(len(active))
+" 2>/dev/null || echo "99")
+
+    if [ "$pending" = "0" ]; then
+      # Check how many jobs exist and their terminal states
+      local job_counts
+      job_counts=$(echo "$jobs_json" | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+jobs = data.get('data') or data.get('jobs') or []
+mine = [j for j in jobs if j.get('certificate_id') == '$cert_id']
+completed = len([j for j in mine if j.get('status') == 'Completed'])
+failed = len([j for j in mine if j.get('status') in ('Failed', 'Cancelled')])
+print(f'{len(mine)} {completed} {failed}')
+" 2>/dev/null || echo "0 0 0")
+      local total_jobs completed_jobs failed_jobs
+      total_jobs=$(echo "$job_counts" | cut -d' ' -f1)
+      completed_jobs=$(echo "$job_counts" | cut -d' ' -f2)
+      failed_jobs=$(echo "$job_counts" | cut -d' ' -f3)
+
+      if [ "$completed_jobs" -gt 0 ]; then
+        return 0  # At least one job completed successfully
+      fi
+      if [ "$total_jobs" -gt 0 ] && [ "$failed_jobs" -gt 0 ]; then
+        return 1  # All jobs are in terminal state but none completed — all failed
+      fi
+    fi
+
+    sleep $interval
+    elapsed=$((elapsed + interval))
+  done
+  return 1
+}
+
+# Get the TLS cert subject from NGINX for a given SNI
+get_tls_subject() {
+  local sni="$1"
+  echo | openssl s_client -connect "$NGINX_TLS" -servername "$sni" 2>/dev/null \
+    | openssl x509 -noout -subject 2>/dev/null \
+    | sed 's/subject=//' | sed 's/^ *//'
+}
+
+get_tls_issuer() {
+  local sni="$1"
+  echo | openssl s_client -connect "$NGINX_TLS" -servername "$sni" 2>/dev/null \
+    | openssl x509 -noout -issuer 2>/dev/null \
+    | sed 's/issuer=//' | sed 's/^ *//'
+}
+
+# Get the TLS cert SANs from NGINX for a given SNI
+# Modern CAs (including Let's Encrypt / Pebble) put domains only in SAN, not Subject CN.
+get_tls_san() {
+  local sni="$1"
+  echo | openssl s_client -connect "$NGINX_TLS" -servername "$sni" 2>/dev/null \
+    | openssl x509 -noout -ext subjectAltName 2>/dev/null \
+    | grep -i "DNS:" | sed 's/^ *//'
+}
+
+# Check if NGINX is serving a cert that matches the given domain (checks Subject then SAN)
+check_tls_identity() {
+  local domain="$1"
+  local subject issuer san
+  subject=$(get_tls_subject "$domain")
+  issuer=$(get_tls_issuer "$domain")
+  san=$(get_tls_san "$domain")
+  if echo "$subject" | grep -qi "$domain" || echo "$san" | grep -qi "$domain"; then
+    echo "MATCH"
+    echo "Subject: $subject"
+    echo "SAN: $san"
+    echo "Issuer: $issuer"
+  else
+    echo "NO_MATCH"
+    echo "Subject: $subject"
+    echo "SAN: $san"
+    echo "Issuer: $issuer"
+  fi
+}
+
+# SQL exec in the postgres container
+psql_exec() {
+  docker exec certctl-test-postgres psql -U certctl -d certctl -tAc "$1" 2>/dev/null
+}
+
+# ---------------------------------------------------------------------------
+# Cleanup trap
+# ---------------------------------------------------------------------------
+cleanup() {
+  if [ "$TEARDOWN" = true ]; then
+    info "Tearing down test environment..."
+    docker compose -f "$COMPOSE_FILE" down -v >/dev/null 2>&1 || true
+  else
+    info "Leaving containers running (--no-teardown)"
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# PHASE 0: Environment Check
+# ---------------------------------------------------------------------------
+header "Phase 0: Environment Check"
+
+# Make sure we're in the deploy directory
+if [ ! -f "$COMPOSE_FILE" ]; then
+  echo -e "${RED}ERROR: $COMPOSE_FILE not found.${NC}"
+  echo "Run this script from the certctl/deploy directory:"
+  echo "  cd certctl/deploy && ./test/run-test.sh"
+  exit 1
+fi
+
+for cmd in docker curl openssl python3; do
+  if command -v "$cmd" >/dev/null 2>&1; then
+    pass "$cmd available"
+  else
+    fail "$cmd not found" "Install $cmd and try again"
+    exit 1
+  fi
+done
+
+if docker compose version >/dev/null 2>&1; then
+  pass "docker compose available"
+else
+  fail "docker compose not available" "Install Docker Compose v2+"
+  exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 1: Start the Stack
+# ---------------------------------------------------------------------------
+header "Phase 1: Start Test Environment"
+
+# Teardown any previous run
+info "Cleaning up previous test environment..."
+docker compose -f "$COMPOSE_FILE" down -v >/dev/null 2>&1 || true
+
+# Set the cleanup trap AFTER the initial teardown
+trap cleanup EXIT
+
+if [ "$BUILD" = true ]; then
+  info "Building and starting containers (this takes 2-5 minutes on first run)..."
+  docker compose -f "$COMPOSE_FILE" up --build -d 2>&1 | tail -5
+else
+  info "Starting containers (--no-build)..."
+  docker compose -f "$COMPOSE_FILE" up -d 2>&1 | tail -5
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 2: Wait for Services
+# ---------------------------------------------------------------------------
+header "Phase 2: Waiting for Services"
+
+info "Waiting for PostgreSQL..."
+if docker compose -f "$COMPOSE_FILE" exec -T postgres pg_isready -U certctl -d certctl >/dev/null 2>&1 ||
+   wait_for_http "${API_URL}/health" "postgres" 60; then
+  pass "PostgreSQL ready"
+else
+  fail "PostgreSQL not ready after 60s"
+fi
+
+info "Waiting for certctl server..."
+if wait_for_http "${API_URL}/health" "server" 120; then
+  pass "certctl server healthy"
+  # Show trust setup + connector init for debugging
+  echo "  --- Server startup (trust setup) ---"
+  docker logs certctl-test-server 2>&1 | grep -E "trust|Added|Extract|provisioner|Pre-launch|key file|WARNING|CERTCTL_" | head -15
+  echo "  ---"
+else
+  fail "certctl server not healthy after 120s"
+  echo ""
+  echo "Server logs:"
+  docker logs certctl-test-server --tail 30
+  exit 1
+fi
+
+info "Waiting for NGINX..."
+if wait_for_http "http://localhost:8080" "nginx" 30; then
+  pass "NGINX healthy"
+else
+  # NGINX might not respond to plain curl on /health without the right path
+  # Check docker health instead
+  if docker inspect certctl-test-nginx --format='{{.State.Health.Status}}' 2>/dev/null | grep -q healthy; then
+    pass "NGINX healthy (docker healthcheck)"
+  else
+    skip "NGINX health check inconclusive (will verify via TLS later)"
+  fi
+fi
+
+# Give the agent a few seconds to register and send first heartbeat
+info "Waiting for agent heartbeat (up to 45s)..."
+AGENT_READY=false
+for i in $(seq 1 15); do
+  AGENT_STATUS=$(api_get "/api/v1/agents/agent-test-01" 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null || echo "")
+  if [ "$AGENT_STATUS" = "online" ]; then
+    AGENT_READY=true
+    break
+  fi
+  sleep 3
+done
+if [ "$AGENT_READY" = true ]; then
+  pass "Agent online"
+else
+  skip "Agent not yet online (may be slow to heartbeat — continuing)"
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 3: Verify Pre-Seeded Data
+# ---------------------------------------------------------------------------
+header "Phase 3: Verify Pre-Seeded Data"
+
+# Agents
+AGENT_COUNT=$(api_get "/api/v1/agents" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total',0))" 2>/dev/null || echo 0)
+if [ "$AGENT_COUNT" -ge 2 ]; then
+  pass "Agents: $AGENT_COUNT found (agent-test-01 + server-scanner)"
+else
+  fail "Agents: expected >= 2, got $AGENT_COUNT"
+fi
+
+# Issuers
+ISSUER_COUNT=$(api_get "/api/v1/issuers" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total',0))" 2>/dev/null || echo 0)
+if [ "$ISSUER_COUNT" -ge 3 ]; then
+  pass "Issuers: $ISSUER_COUNT found (iss-local, iss-acme-staging, iss-stepca)"
+else
+  fail "Issuers: expected >= 3, got $ISSUER_COUNT" "Check seed_test.sql loaded correctly"
+fi
+
+# Targets
+TARGET_COUNT=$(api_get "/api/v1/targets" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total',0))" 2>/dev/null || echo 0)
+if [ "$TARGET_COUNT" -ge 1 ]; then
+  pass "Targets: $TARGET_COUNT found (target-test-nginx)"
+else
+  fail "Targets: expected >= 1, got $TARGET_COUNT" "seed_test.sql may have failed after iss-local"
+fi
+
+# Profile
+PROFILE_RESP=$(api_get "/api/v1/profiles" 2>/dev/null || echo '{"total":0}')
+PROFILE_COUNT=$(echo "$PROFILE_RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total',0))" 2>/dev/null || echo 0)
+if [ "$PROFILE_COUNT" -ge 2 ]; then
+  pass "Profiles: $PROFILE_COUNT found (prof-test-tls, prof-test-smime)"
+else
+  fail "Profiles: expected >= 1, got $PROFILE_COUNT"
+fi
+
+# Bail if seed data is broken
+if [ "$ISSUER_COUNT" -lt 3 ] || [ "$TARGET_COUNT" -lt 1 ]; then
+  echo ""
+  echo -e "${RED}Seed data is incomplete. Cannot continue.${NC}"
+  echo "Check PostgreSQL logs: docker logs certctl-test-postgres"
+  exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 4: Local CA Issuance
+# ---------------------------------------------------------------------------
+header "Phase 4: Local CA Certificate Issuance"
+
+info "Creating certificate record mc-local-test..."
+CREATE_RESP=$(api_post "/api/v1/certificates" '{
+  "id": "mc-local-test",
+  "name": "local-test-cert",
+  "common_name": "local.certctl.test",
+  "sans": ["local.certctl.test"],
+  "issuer_id": "iss-local",
+  "owner_id": "owner-test-admin",
+  "team_id": "team-test-ops",
+  "renewal_policy_id": "rp-default",
+  "certificate_profile_id": "prof-test-tls",
+  "environment": "development"
+}' 2>/dev/null || echo "ERROR")
+
+if echo "$CREATE_RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d.get('id')=='mc-local-test'" 2>/dev/null; then
+  pass "Certificate record created"
+else
+  fail "Certificate creation failed" "$CREATE_RESP"
+fi
+
+info "Linking certificate to NGINX target..."
+psql_exec "INSERT INTO certificate_target_mappings (certificate_id, target_id) VALUES ('mc-local-test', 'target-test-nginx') ON CONFLICT DO NOTHING;"
+pass "Target mapping inserted"
+
+info "Triggering issuance..."
+RENEW_RESP=$(api_post "/api/v1/certificates/mc-local-test/renew" 2>/dev/null || echo "ERROR")
+if echo "$RENEW_RESP" | grep -q "renewal_triggered\|status"; then
+  pass "Issuance triggered"
+else
+  fail "Trigger failed" "$RENEW_RESP"
+fi
+
+# Verify a job was created (this is the bug fix check)
+sleep 2
+JOB_COUNT=$(api_get "/api/v1/jobs" | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+jobs = [j for j in (data.get('data') or data.get('jobs') or []) if j.get('certificate_id') == 'mc-local-test']
+print(len(jobs))
+" 2>/dev/null || echo "0")
+
+if [ "$JOB_COUNT" -gt 0 ]; then
+  pass "Job created ($JOB_COUNT jobs for mc-local-test)"
+else
+  fail "No jobs created — TriggerRenewalWithActor bug still present"
+fi
+
+info "Waiting for issuance + deployment (up to 180s)..."
+if wait_for_jobs_done "mc-local-test" 180; then
+  pass "All jobs completed"
+else
+  fail "Jobs did not complete within 180s"
+  echo "  Current jobs:"
+  api_get "/api/v1/jobs" 2>/dev/null | python3 -m json.tool 2>/dev/null | head -30
+fi
+
+info "Reloading NGINX to pick up deployed certificate..."
+docker exec certctl-test-nginx nginx -s reload 2>/dev/null || true
+sleep 3
+
+info "Verifying TLS certificate on NGINX..."
+TLS_CHECK=$(check_tls_identity "local.certctl.test")
+TLS_RESULT=$(echo "$TLS_CHECK" | head -1)
+if [ "$TLS_RESULT" = "MATCH" ]; then
+  pass "NGINX serving cert for local.certctl.test"
+  echo "$TLS_CHECK" | tail -n +2 | while read -r line; do echo -e "       $line"; done
+else
+  fail "NGINX not serving expected cert" "$(echo "$TLS_CHECK" | tail -n +2 | tr '\n' ', ')"
+fi
+
+# Check cert status in API
+CERT_STATUS=$(api_get "/api/v1/certificates/mc-local-test" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null || echo "unknown")
+if [ "$CERT_STATUS" = "Active" ]; then
+  pass "Certificate status: Active"
+else
+  skip "Certificate status: $CERT_STATUS (expected Active — may need more time)"
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 5: ACME (Pebble) Issuance
+# ---------------------------------------------------------------------------
+header "Phase 5: ACME (Pebble) Certificate Issuance"
+
+info "Creating certificate record mc-acme-test..."
+CREATE_RESP=$(api_post "/api/v1/certificates" '{
+  "id": "mc-acme-test",
+  "name": "acme-test-cert",
+  "common_name": "acme.certctl.test",
+  "sans": ["acme.certctl.test"],
+  "issuer_id": "iss-acme-staging",
+  "owner_id": "owner-test-admin",
+  "team_id": "team-test-ops",
+  "renewal_policy_id": "rp-default",
+  "certificate_profile_id": "prof-test-tls",
+  "environment": "staging"
+}' 2>/dev/null || echo "ERROR")
+
+if echo "$CREATE_RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d.get('id')=='mc-acme-test'" 2>/dev/null; then
+  pass "Certificate record created"
+else
+  fail "Certificate creation failed" "$CREATE_RESP"
+fi
+
+info "Linking to target and triggering issuance..."
+psql_exec "INSERT INTO certificate_target_mappings (certificate_id, target_id) VALUES ('mc-acme-test', 'target-test-nginx') ON CONFLICT DO NOTHING;"
+RENEW_RESP=$(api_post "/api/v1/certificates/mc-acme-test/renew" 2>/dev/null || echo "ERROR")
+if echo "$RENEW_RESP" | grep -q "renewal_triggered\|status"; then
+  pass "Issuance triggered"
+else
+  fail "Trigger failed" "$RENEW_RESP"
+fi
+
+info "Waiting for ACME issuance + deployment (up to 180s)..."
+if wait_for_jobs_done "mc-acme-test" 180; then
+  pass "All jobs completed"
+
+  info "Reloading NGINX to pick up deployed certificate..."
+  docker exec certctl-test-nginx nginx -s reload 2>/dev/null || true
+  sleep 3
+
+  TLS_CHECK=$(check_tls_identity "acme.certctl.test")
+  TLS_RESULT=$(echo "$TLS_CHECK" | head -1)
+  if [ "$TLS_RESULT" = "MATCH" ]; then
+    pass "NGINX serving cert for acme.certctl.test"
+    echo "$TLS_CHECK" | tail -n +2 | while read -r line; do echo -e "       $line"; done
+  else
+    fail "NGINX not serving expected ACME cert" "$(echo "$TLS_CHECK" | tail -n +2 | tr '\n' ', ')"
+  fi
+else
+  fail "ACME jobs did not complete within 180s"
+  info "Checking ACME job status..."
+  api_get "/api/v1/jobs" 2>/dev/null | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for j in data.get('data', []):
+    if j.get('certificate_id') == 'mc-acme-test':
+        print(f\"  Job {j['id']}: type={j['type']} status={j['status']} error={j.get('last_error','')}\")" 2>/dev/null || true
+  echo "  Server logs (last 20 lines):"
+  docker logs certctl-test-server --tail 20 2>&1 | grep -i "acme\|error\|fail\|CSR" | head -10 || true
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 6: step-ca Issuance
+# ---------------------------------------------------------------------------
+header "Phase 6: step-ca (Private CA) Certificate Issuance"
+
+info "Creating certificate record mc-stepca-test..."
+CREATE_RESP=$(api_post "/api/v1/certificates" '{
+  "id": "mc-stepca-test",
+  "name": "stepca-test-cert",
+  "common_name": "stepca.certctl.test",
+  "sans": ["stepca.certctl.test"],
+  "issuer_id": "iss-stepca",
+  "owner_id": "owner-test-admin",
+  "team_id": "team-test-ops",
+  "renewal_policy_id": "rp-default",
+  "certificate_profile_id": "prof-test-tls",
+  "environment": "staging"
+}' 2>/dev/null || echo "ERROR")
+
+if echo "$CREATE_RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d.get('id')=='mc-stepca-test'" 2>/dev/null; then
+  pass "Certificate record created"
+else
+  fail "Certificate creation failed" "$CREATE_RESP"
+fi
+
+info "Linking to target and triggering issuance..."
+psql_exec "INSERT INTO certificate_target_mappings (certificate_id, target_id) VALUES ('mc-stepca-test', 'target-test-nginx') ON CONFLICT DO NOTHING;"
+RENEW_RESP=$(api_post "/api/v1/certificates/mc-stepca-test/renew" 2>/dev/null || echo "ERROR")
+if echo "$RENEW_RESP" | grep -q "renewal_triggered\|status"; then
+  pass "Issuance triggered"
+else
+  fail "Trigger failed" "$RENEW_RESP"
+fi
+
+info "Waiting for step-ca issuance + deployment (up to 120s)..."
+if wait_for_jobs_done "mc-stepca-test" 120; then
+  pass "All jobs completed"
+else
+  fail "Jobs did not complete in time"
+  info "Checking step-ca job status..."
+  api_get "/api/v1/jobs" 2>/dev/null | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for j in data.get('data', []):
+    if j.get('certificate_id') == 'mc-stepca-test':
+        print(f\"  Job {j['id']}: type={j['type']} status={j['status']} error={j.get('last_error','')}\")" 2>/dev/null || true
+  echo "  Server logs (step-ca related):"
+  docker logs certctl-test-server --tail 30 2>&1 | grep -i "stepca\|step-ca\|provisioner\|jwe\|decrypt\|CSR.*fail\|error" | head -10 || true
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 7: Revocation
+# ---------------------------------------------------------------------------
+header "Phase 7: Revocation"
+
+info "Revoking mc-local-test (reason: superseded)..."
+REVOKE_RESP=$(api_post "/api/v1/certificates/mc-local-test/revoke" '{"reason": "superseded"}' 2>/dev/null || echo "ERROR")
+if echo "$REVOKE_RESP" | grep -qi "revoked\|status"; then
+  pass "Certificate revoked"
+else
+  fail "Revocation failed" "$REVOKE_RESP"
+fi
+
+info "Checking DER CRL under /.well-known/pki (RFC 5280 §5, RFC 8615)..."
+# The JSON CRL endpoint (`GET /api/v1/crl`) was removed in M-006. RFC 5280
+# defines only the DER wire format, now served unauthenticated at
+# `/.well-known/pki/crl/{issuer_id}`. Fetch without the Bearer header to
+# prove the endpoint is reachable by relying parties with no API key.
+CRL_TMP=$(mktemp)
+CRL_HEADERS=$(mktemp)
+CRL_HTTP_CODE=$(curl -s -o "$CRL_TMP" -D "$CRL_HEADERS" -w "%{http_code}" "${API_URL}/.well-known/pki/crl/iss-local" 2>/dev/null || echo "000")
+CRL_SIZE=$(wc -c < "$CRL_TMP" | tr -d ' ')
+CRL_CONTENT_TYPE=$(awk 'tolower($1)=="content-type:" { sub(/\r$/,"",$2); print tolower($2) }' "$CRL_HEADERS" | head -n1)
+rm -f "$CRL_TMP" "$CRL_HEADERS"
+
+if [ "$CRL_HTTP_CODE" = "200" ] && [ "$CRL_CONTENT_TYPE" = "application/pkix-crl" ] && [ "$CRL_SIZE" -gt 0 ]; then
+  pass "DER CRL served unauthenticated (HTTP 200, Content-Type application/pkix-crl, ${CRL_SIZE} bytes)"
+else
+  fail "DER CRL fetch failed: HTTP=$CRL_HTTP_CODE Content-Type=$CRL_CONTENT_TYPE size=$CRL_SIZE"
+fi
+
+CERT_STATUS=$(api_get "/api/v1/certificates/mc-local-test" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null || echo "unknown")
+if [ "$CERT_STATUS" = "Revoked" ]; then
+  pass "Certificate status updated to Revoked"
+else
+  fail "Certificate status: $CERT_STATUS (expected Revoked)"
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 8: Discovery
+# ---------------------------------------------------------------------------
+header "Phase 8: Certificate Discovery"
+
+info "Checking discovered certificates..."
+DISC_RESP=$(api_get "/api/v1/discovered-certificates" 2>/dev/null || echo '{"total":0}')
+DISC_TOTAL=$(echo "$DISC_RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total',0))" 2>/dev/null || echo 0)
+if [ "$DISC_TOTAL" -ge 1 ]; then
+  pass "Discovered $DISC_TOTAL certificate(s) on filesystem"
+else
+  skip "No discovered certificates yet (agent scan may not have run)"
+fi
+
+SUMMARY_RESP=$(api_get "/api/v1/discovery-summary" 2>/dev/null || echo '{}')
+echo -e "       Discovery summary: $SUMMARY_RESP"
+
+# ---------------------------------------------------------------------------
+# PHASE 9: Renewal (re-issue ACME cert)
+# ---------------------------------------------------------------------------
+header "Phase 9: Renewal"
+
+# Try mc-stepca-test first (mc-local-test was revoked in Phase 7).
+# Fall back to mc-acme-test if step-ca cert isn't Active.
+RENEWAL_CERT=""
+for candidate in mc-stepca-test mc-acme-test; do
+  STATUS=$(api_get "/api/v1/certificates/$candidate" 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null || echo "unknown")
+  if [ "$STATUS" = "Active" ]; then
+    RENEWAL_CERT="$candidate"
+    break
+  fi
+done
+
+if [ -z "$RENEWAL_CERT" ]; then
+  skip "Cannot test renewal — no certificate in Active state"
+else
+  info "Using $RENEWAL_CERT for renewal test..."
+  info "Triggering renewal on $RENEWAL_CERT..."
+  RENEW_RESP=$(api_post "/api/v1/certificates/$RENEWAL_CERT/renew" 2>/dev/null || echo "ERROR")
+  if echo "$RENEW_RESP" | grep -q "renewal_triggered\|status"; then
+    pass "Renewal triggered"
+  else
+    skip "Renewal trigger returned: $RENEW_RESP"
+  fi
+
+  info "Waiting for renewal to complete (up to 180s)..."
+  if wait_for_jobs_done "$RENEWAL_CERT" 180; then
+    pass "Renewal jobs completed"
+
+    info "Reloading NGINX to pick up renewed certificate..."
+    docker exec certctl-test-nginx nginx -s reload 2>/dev/null || true
+    sleep 3
+
+    # Verify version history shows multiple versions
+    VERSIONS=$(api_get "/api/v1/certificates/$RENEWAL_CERT/versions" 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d) if isinstance(d, list) else d.get('total', 0))" 2>/dev/null || echo 0)
+    if [ "$VERSIONS" -ge 2 ]; then
+      pass "Certificate has $VERSIONS versions (original + renewal)"
+    else
+      skip "Expected 2+ versions, got $VERSIONS"
+    fi
+  else
+    skip "Renewal jobs did not complete within 180s"
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 10: EST Enrollment (RFC 7030)
+# ---------------------------------------------------------------------------
+header "Phase 10: EST Enrollment (RFC 7030)"
+
+# Test cacerts endpoint — should return PKCS#7 with CA cert chain
+info "Testing EST cacerts endpoint..."
+EST_CACERTS_RESP=$(curl -sf -H "${AUTH_HEADER}" "${API_URL}/.well-known/est/cacerts" 2>/dev/null || echo "ERROR")
+if [ "$EST_CACERTS_RESP" != "ERROR" ] && [ -n "$EST_CACERTS_RESP" ]; then
+  # Response should be base64-encoded PKCS#7
+  if echo "$EST_CACERTS_RESP" | base64 -d >/dev/null 2>&1; then
+    pass "EST cacerts returns valid base64 PKCS#7 response"
+  else
+    fail "EST cacerts returned non-base64 data"
+  fi
+else
+  fail "EST cacerts endpoint failed" "$EST_CACERTS_RESP"
+fi
+
+# Test csrattrs endpoint
+info "Testing EST csrattrs endpoint..."
+EST_CSRATTRS_STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -H "${AUTH_HEADER}" "${API_URL}/.well-known/est/csrattrs" 2>/dev/null || echo "000")
+if [ "$EST_CSRATTRS_STATUS" = "200" ] || [ "$EST_CSRATTRS_STATUS" = "204" ]; then
+  pass "EST csrattrs returns $EST_CSRATTRS_STATUS"
+else
+  fail "EST csrattrs returned $EST_CSRATTRS_STATUS (expected 200 or 204)"
+fi
+
+# Test simpleenroll — generate CSR, POST as base64-encoded DER
+info "Testing EST simpleenroll with generated CSR..."
+EST_KEY_FILE=$(mktemp /tmp/est-key-XXXXXX.pem)
+EST_CSR_PEM_FILE=$(mktemp /tmp/est-csr-XXXXXX.pem)
+EST_CSR_DER_FILE=$(mktemp /tmp/est-csr-XXXXXX.der)
+trap "rm -f $EST_KEY_FILE $EST_CSR_PEM_FILE $EST_CSR_DER_FILE" EXIT
+
+# Generate ECDSA key + CSR
+openssl ecparam -genkey -name prime256v1 -noout -out "$EST_KEY_FILE" 2>/dev/null
+openssl req -new -key "$EST_KEY_FILE" -out "$EST_CSR_PEM_FILE" -subj "/CN=est-device.certctl.test" 2>/dev/null
+openssl req -in "$EST_CSR_PEM_FILE" -out "$EST_CSR_DER_FILE" -outform DER 2>/dev/null
+
+# base64-encode the DER CSR (EST wire format)
+EST_CSR_B64=$(base64 < "$EST_CSR_DER_FILE" | tr -d '\n')
+
+EST_ENROLL_RESP=$(curl -sf \
+  -X POST \
+  -H "${AUTH_HEADER}" \
+  -H "Content-Type: application/pkcs10" \
+  -d "$EST_CSR_B64" \
+  "${API_URL}/.well-known/est/simpleenroll" 2>/dev/null || echo "ERROR")
+
+if [ "$EST_ENROLL_RESP" != "ERROR" ] && [ -n "$EST_ENROLL_RESP" ]; then
+  # Response should be base64-encoded PKCS#7 containing the issued cert
+  if echo "$EST_ENROLL_RESP" | base64 -d >/dev/null 2>&1; then
+    pass "EST simpleenroll issued certificate via PKCS#7 response"
+  else
+    fail "EST simpleenroll returned non-base64 data"
+  fi
+else
+  fail "EST simpleenroll failed" "$(curl -s -X POST -H "${AUTH_HEADER}" -H "Content-Type: application/pkcs10" -d "$EST_CSR_B64" "${API_URL}/.well-known/est/simpleenroll" 2>&1 | head -5)"
+fi
+
+# Test simplereenroll (should work identically)
+info "Testing EST simplereenroll..."
+EST_REENROLL_STATUS=$(curl -sf -o /dev/null -w "%{http_code}" \
+  -X POST \
+  -H "${AUTH_HEADER}" \
+  -H "Content-Type: application/pkcs10" \
+  -d "$EST_CSR_B64" \
+  "${API_URL}/.well-known/est/simplereenroll" 2>/dev/null || echo "000")
+
+if [ "$EST_REENROLL_STATUS" = "200" ]; then
+  pass "EST simplereenroll works (status 200)"
+else
+  fail "EST simplereenroll returned $EST_REENROLL_STATUS (expected 200)"
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 11: S/MIME Certificate Issuance
+# ---------------------------------------------------------------------------
+header "Phase 11: S/MIME Certificate Issuance"
+
+info "Creating S/MIME certificate record..."
+SMIME_RESP=$(api_post "/api/v1/certificates" '{
+  "id": "mc-smime-test",
+  "name": "smime-test-cert",
+  "common_name": "testuser@certctl.test",
+  "sans": ["testuser@certctl.test"],
+  "issuer_id": "iss-local",
+  "owner_id": "owner-test-admin",
+  "team_id": "team-test-ops",
+  "renewal_policy_id": "rp-default",
+  "certificate_profile_id": "prof-test-smime",
+  "environment": "staging"
+}' 2>/dev/null || echo "ERROR")
+
+if echo "$SMIME_RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d.get('id')=='mc-smime-test'" 2>/dev/null; then
+  pass "S/MIME certificate record created"
+else
+  fail "S/MIME certificate creation failed" "$SMIME_RESP"
+fi
+
+info "Linking S/MIME cert to target (needed for agent work routing)..."
+psql_exec "INSERT INTO certificate_target_mappings (certificate_id, target_id) VALUES ('mc-smime-test', 'target-test-nginx') ON CONFLICT DO NOTHING;"
+
+info "Triggering S/MIME issuance..."
+SMIME_RENEW=$(api_post "/api/v1/certificates/mc-smime-test/renew" 2>/dev/null || echo "ERROR")
+if echo "$SMIME_RENEW" | grep -q "renewal_triggered\|status"; then
+  pass "S/MIME issuance triggered"
+else
+  fail "S/MIME trigger failed" "$SMIME_RENEW"
+fi
+
+info "Waiting for S/MIME issuance (up to 120s)..."
+if wait_for_jobs_done "mc-smime-test" 120; then
+  pass "S/MIME jobs completed"
+
+  # Fetch the issued cert and verify EKU
+  info "Verifying S/MIME certificate EKU..."
+  SMIME_VERSIONS=$(api_get "/api/v1/certificates/mc-smime-test/versions" 2>/dev/null || echo "[]")
+  SMIME_PEM=$(echo "$SMIME_VERSIONS" | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+versions = data if isinstance(data, list) else data.get('data', [])
+if versions:
+    print(versions[-1].get('pem_chain', versions[-1].get('pem', '')))
+" 2>/dev/null || echo "")
+
+  if [ -n "$SMIME_PEM" ]; then
+    # Parse the cert and check for emailProtection EKU
+    SMIME_EKU=$(echo "$SMIME_PEM" | openssl x509 -noout -text 2>/dev/null | grep -A2 "Extended Key Usage" || echo "")
+    if echo "$SMIME_EKU" | grep -qi "emailProtection\|E-mail Protection"; then
+      pass "S/MIME cert has emailProtection EKU"
+    else
+      fail "S/MIME cert missing emailProtection EKU" "Got: $SMIME_EKU"
+    fi
+
+    # Check KeyUsage flags (S/MIME should have Digital Signature + Content Commitment)
+    SMIME_KU=$(echo "$SMIME_PEM" | openssl x509 -noout -text 2>/dev/null | awk '/X509v3 Key Usage:/{getline; print; exit}')
+    if echo "$SMIME_KU" | grep -qi "Digital Signature"; then
+      pass "S/MIME cert has Digital Signature KeyUsage"
+    else
+      fail "S/MIME cert missing Digital Signature KeyUsage" "Got: $SMIME_KU"
+    fi
+
+    # Check that email SAN is present
+    SMIME_SAN=$(echo "$SMIME_PEM" | openssl x509 -noout -ext subjectAltName 2>/dev/null || echo "")
+    if echo "$SMIME_SAN" | grep -qi "email:testuser@certctl.test"; then
+      pass "S/MIME cert has email SAN"
+    else
+      # Some implementations use rfc822Name instead of email:
+      if echo "$SMIME_SAN" | grep -qi "testuser@certctl.test"; then
+        pass "S/MIME cert has email SAN (rfc822Name)"
+      else
+        skip "S/MIME email SAN not found in cert (may be in CN only)"
+        echo "       SAN content: $SMIME_SAN"
+      fi
+    fi
+  else
+    skip "Could not extract S/MIME cert PEM for EKU verification"
+  fi
+else
+  fail "S/MIME issuance did not complete within 120s"
+  info "Checking S/MIME job status..."
+  api_get "/api/v1/jobs" 2>/dev/null | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for j in data.get('data', []):
+    if j.get('certificate_id') == 'mc-smime-test':
+        print(f\"  Job {j['id']}: type={j['type']} status={j['status']} error={j.get('last_error','')}\")" 2>/dev/null || true
+fi
+
+# ---------------------------------------------------------------------------
+# PHASE 12: API Spot Checks
+# ---------------------------------------------------------------------------
+header "Phase 12: API Spot Checks"
+
+# Health
+if api_get "/health" >/dev/null 2>&1; then
+  pass "GET /health returns 200"
+else
+  fail "GET /health failed"
+fi
+
+# Metrics
+METRICS_RESP=$(api_get "/api/v1/metrics" 2>/dev/null || echo "ERROR")
+if echo "$METRICS_RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); assert 'gauge' in d" 2>/dev/null; then
+  pass "GET /api/v1/metrics returns valid JSON"
+else
+  fail "Metrics endpoint broken"
+fi
+
+# Stats summary
+STATS_RESP=$(api_get "/api/v1/stats/summary" 2>/dev/null || echo "ERROR")
+if echo "$STATS_RESP" | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then
+  pass "GET /api/v1/stats/summary returns valid JSON"
+else
+  fail "Stats summary endpoint broken"
+fi
+
+# Audit trail
+AUDIT_RESP=$(api_get "/api/v1/audit" 2>/dev/null || echo '{"total":0}')
+AUDIT_TOTAL=$(echo "$AUDIT_RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total',0))" 2>/dev/null || echo 0)
+if [ "$AUDIT_TOTAL" -gt 0 ]; then
+  pass "Audit trail: $AUDIT_TOTAL events recorded"
+else
+  fail "Audit trail empty"
+fi
+
+# Jobs summary
+JOBS_RESP=$(api_get "/api/v1/jobs" 2>/dev/null || echo '{"total":0}')
+JOBS_TOTAL=$(echo "$JOBS_RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total',0))" 2>/dev/null || echo 0)
+pass "Total jobs created: $JOBS_TOTAL"
+
+# Prometheus
+PROM_RESP=$(curl -sf -H "${AUTH_HEADER}" "${API_URL}/api/v1/metrics/prometheus" 2>/dev/null || echo "")
+if echo "$PROM_RESP" | grep -q "certctl_certificate_total"; then
+  pass "Prometheus metrics endpoint working"
+else
+  fail "Prometheus metrics endpoint broken"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+header "Test Summary"
+
+TOTAL=$((PASS + FAIL + SKIP))
+echo ""
+echo -e "  ${GREEN}Passed: $PASS${NC}"
+echo -e "  ${RED}Failed: $FAIL${NC}"
+echo -e "  ${YELLOW}Skipped: $SKIP${NC}"
+echo -e "  Total:  $TOTAL"
+echo ""
+
+if [ "$FAIL" -eq 0 ]; then
+  echo -e "${GREEN}${BOLD}All tests passed.${NC}"
+  exit 0
+else
+  echo -e "${RED}${BOLD}$FAIL test(s) failed.${NC}"
+  echo ""
+  echo "Useful debug commands:"
+  echo "  docker logs certctl-test-server --tail 50"
+  echo "  docker logs certctl-test-agent --tail 50"
+  echo "  docker compose -f $COMPOSE_FILE ps"
+  exit 1
+fi

deploy/test/setup-trust.sh

@@ -0,0 +1,140 @@
+#!/bin/sh
+# This script runs inside the certctl-server container at startup.
+# It fetches CA certificates from Pebble and step-ca, adds them to the
+# system trust store, then starts the certctl server.
+#
+# Why: The ACME connector and step-ca connector use Go's default http.Client
+# with no InsecureSkipVerify. They rely on the system trust store to verify
+# TLS connections. Pebble and step-ca both use self-signed root CAs that
+# aren't in Alpine's default CA bundle, so we must add them manually.
+#
+# This script runs as root (user: "0:0" in docker-compose) so that
+# update-ca-certificates can write to /etc/ssl/certs/.
+
+set -e
+
+echo "=== certctl trust store setup ==="
+
+# --- Pebble CA cert (fetched from management API) ---
+# Pebble's management API serves the root CA at /roots/0.
+# We use -k because we can't verify Pebble's TLS cert yet (chicken-and-egg).
+echo "Fetching Pebble root CA from management API..."
+PEBBLE_CA=""
+for i in 1 2 3 4 5 6 7 8 9 10; do
+    if PEBBLE_CA=$(curl -sk https://pebble:15000/roots/0 2>/dev/null); then
+        if [ -n "$PEBBLE_CA" ]; then
+            echo "$PEBBLE_CA" > /usr/local/share/ca-certificates/pebble-ca.crt
+            echo "  Added: Pebble test CA"
+            break
+        fi
+    fi
+    echo "  Waiting for Pebble (attempt $i/10)..."
+    sleep 2
+done
+
+if [ -z "$PEBBLE_CA" ]; then
+    echo "  WARNING: Could not fetch Pebble CA. ACME issuance will fail."
+fi
+
+# --- step-ca root cert (from shared volume) ---
+# The step-ca container writes its root CA to /home/step/certs/root_ca.crt.
+# We mount the step-ca data volume at /stepca-data inside this container.
+STEPCA_ROOT="/stepca-data/certs/root_ca.crt"
+echo "Waiting for step-ca root cert..."
+for i in 1 2 3 4 5 6 7 8 9 10; do
+    if [ -f "$STEPCA_ROOT" ]; then
+        cp "$STEPCA_ROOT" /usr/local/share/ca-certificates/step-ca-root.crt
+        echo "  Added: step-ca root CA"
+        break
+    fi
+    echo "  Waiting for step-ca root cert (attempt $i/10)..."
+    sleep 2
+done
+
+if [ ! -f "$STEPCA_ROOT" ]; then
+    echo "  WARNING: step-ca root cert not found at $STEPCA_ROOT"
+    echo "  step-ca issuance may fail until the cert is available."
+fi
+
+# --- step-ca provisioner key (extracted from ca.json) ---
+# When step-ca auto-bootstraps via DOCKER_STEPCA_INIT_* env vars, the
+# encrypted provisioner key (JWE) is NOT written as a separate file.
+# Instead, it's embedded in ca.json under:
+#   authority.provisioners[0].encryptedKey
+# We extract it here and write to /tmp so the certctl server can read it.
+# The stepca_data volume is mounted :ro, so we can't write there.
+STEPCA_CA_JSON="/stepca-data/config/ca.json"
+STEPCA_KEY_EXTRACTED="/tmp/step-ca-provisioner-key"
+echo "Extracting step-ca provisioner key from ca.json..."
+for i in 1 2 3 4 5 6 7 8 9 10; do
+    if [ -f "$STEPCA_CA_JSON" ]; then
+        # Extract the encryptedKey value using grep+sed (no jq in Alpine base)
+        # The field looks like: "encryptedKey": "eyJhbGciOi..."
+        ENCRYPTED_KEY=$(grep -o '"encryptedKey":"[^"]*"' "$STEPCA_CA_JSON" | head -1 | sed 's/"encryptedKey":"//;s/"$//')
+        if [ -z "$ENCRYPTED_KEY" ]; then
+            # Try with spaces around colon (JSON formatting varies)
+            ENCRYPTED_KEY=$(grep -o '"encryptedKey" *: *"[^"]*"' "$STEPCA_CA_JSON" | head -1 | sed 's/"encryptedKey" *: *"//;s/"$//')
+        fi
+        if [ -n "$ENCRYPTED_KEY" ]; then
+            # Check if it's JWE compact serialization (dot-separated) or JSON serialization
+            case "$ENCRYPTED_KEY" in
+                \{*)
+                    # Already JSON serialization — write as-is
+                    echo "$ENCRYPTED_KEY" > "$STEPCA_KEY_EXTRACTED"
+                    ;;
+                *)
+                    # JWE compact serialization: header.encrypted_key.iv.ciphertext.tag
+                    # Convert to JSON serialization expected by Go decryptProvisionerKey()
+                    JWE_PROTECTED=$(echo "$ENCRYPTED_KEY" | cut -d. -f1)
+                    JWE_ENCKEY=$(echo "$ENCRYPTED_KEY" | cut -d. -f2)
+                    JWE_IV=$(echo "$ENCRYPTED_KEY" | cut -d. -f3)
+                    JWE_CT=$(echo "$ENCRYPTED_KEY" | cut -d. -f4)
+                    JWE_TAG=$(echo "$ENCRYPTED_KEY" | cut -d. -f5)
+                    printf '{"protected":"%s","encrypted_key":"%s","iv":"%s","ciphertext":"%s","tag":"%s"}' \
+                        "$JWE_PROTECTED" "$JWE_ENCKEY" "$JWE_IV" "$JWE_CT" "$JWE_TAG" > "$STEPCA_KEY_EXTRACTED"
+                    ;;
+            esac
+            echo "  Extracted provisioner key to $STEPCA_KEY_EXTRACTED"
+            echo "  Key file size: $(wc -c < "$STEPCA_KEY_EXTRACTED") bytes"
+            echo "  Key starts with: $(head -c 40 "$STEPCA_KEY_EXTRACTED")..."
+            # Override the env var so the server reads from the extracted file
+            export CERTCTL_STEPCA_KEY_PATH="$STEPCA_KEY_EXTRACTED"
+            break
+        else
+            echo "  ca.json found but encryptedKey not found in it (attempt $i/10)"
+        fi
+    else
+        echo "  Waiting for step-ca ca.json (attempt $i/10)..."
+    fi
+    sleep 2
+done
+
+if [ ! -f "$STEPCA_KEY_EXTRACTED" ]; then
+    echo "  WARNING: Could not extract step-ca provisioner key"
+    echo "  Listing /stepca-data/config/ for debugging:"
+    ls -la /stepca-data/config/ 2>/dev/null || echo "  /stepca-data/config/ does not exist"
+    echo "  step-ca issuance will fail."
+fi
+
+# --- Update system trust store ---
+echo "Updating system CA trust store..."
+update-ca-certificates 2>/dev/null || true
+
+echo "Trust store updated."
+
+# --- Debug: verify configuration before starting server ---
+echo "=== Pre-launch verification ==="
+echo "  CERTCTL_STEPCA_KEY_PATH=$CERTCTL_STEPCA_KEY_PATH"
+if [ -f "$CERTCTL_STEPCA_KEY_PATH" ]; then
+    echo "  step-ca key file exists ($(wc -c < "$CERTCTL_STEPCA_KEY_PATH") bytes)"
+    echo "  step-ca key preview: $(head -c 60 "$CERTCTL_STEPCA_KEY_PATH")..."
+else
+    echo "  WARNING: step-ca key file NOT FOUND at $CERTCTL_STEPCA_KEY_PATH"
+fi
+echo "  CERTCTL_ACME_DIRECTORY_URL=$CERTCTL_ACME_DIRECTORY_URL"
+echo "  CERTCTL_ACME_INSECURE=$CERTCTL_ACME_INSECURE"
+echo "  Pebble CA cert: $(ls -la /usr/local/share/ca-certificates/pebble-ca.crt 2>/dev/null || echo 'NOT FOUND')"
+echo "  step-ca root cert: $(ls -la /usr/local/share/ca-certificates/step-ca-root.crt 2>/dev/null || echo 'NOT FOUND')"
+echo "  System CA count: $(ls /etc/ssl/certs/*.pem 2>/dev/null | wc -l) PEM files"
+echo "=== Starting certctl server ==="
+exec /app/server

docs/architecture.md

@@ -45,7 +45,7 @@ New to certificates? Read the [Concepts Guide](concepts.md) first.
 ### Design Principles
 
 1. **Private Key Isolation** — Agents generate ECDSA P-256 keys locally and submit CSRs only. Private keys never touch the control plane. Server-side keygen available via `CERTCTL_KEYGEN_MODE=server` for demo only.
-2. **Pull-Only Deployment** — The server never initiates outbound connections to agents or targets. Agents poll for work. For network appliances and agentless targets, a proxy agent in the same network zone executes deployments via the target's API. This keeps the control plane firewalled off and limits credential scope to the proxy agent's zone.
+2. **Pull-Only Deployment** — The server never initiates outbound connections to agents or targets. Agents poll for work and receive only jobs assigned to their targets (routed via `agent_id` on jobs or through target→agent relationships). For network appliances and agentless targets, a proxy agent in the same network zone executes deployments via the target's API. This keeps the control plane firewalled off and limits credential scope to the proxy agent's zone.
 3. **Sub-CA Capable** — The Local CA can operate as a subordinate CA under an enterprise root (e.g., ADCS). Load a pre-signed CA cert+key from disk and all issued certs chain to the enterprise trust hierarchy. Self-signed mode remains the default for development/demos.
 4. **GUI as Primary Interface** — The web dashboard is the operational control plane, not a secondary viewer. Every backend feature ships with its corresponding GUI surface.
 5. **Decoupled Operations** — Agents operate autonomously; the control plane coordinates but doesn't block agent function
@@ -61,7 +61,7 @@ flowchart TB
         API["REST API\n(Go net/http, :8443)"]
         SVC["Service Layer"]
         REPO["Repository Layer\n(database/sql + lib/pq)"]
-        SCHED["Background Scheduler\n6 loops"]
+        SCHED["Background Scheduler\n7 loops"]
         DASH["Web Dashboard\n(React SPA)"]
     end
 
@@ -80,15 +80,30 @@ flowchart TB
         CA2["ACME\n(HTTP-01 + DNS-01 + DNS-PERSIST-01)\n(EAB, ZeroSSL auto-EAB)"]
         CA3["step-ca\n(/sign API)"]
         CA4["OpenSSL / Custom CA\n(script-based)"]
-        CA6["Vault PKI\n(planned)"]
+        CA6["Vault PKI\n(token auth, /sign API)"]
+        CA7["DigiCert CertCentral\n(async order model)"]
+        CA8["Sectigo SCM\n(async order model)"]
+        CA9["Google CAS\n(OAuth2, sync)"]
+        CA10["AWS ACM PCA\n(sync issuance)"]
+        CA11["Entrust\n(mTLS, sync/async)"]
+        CA12["GlobalSign Atlas\n(mTLS + API key)"]
+        CA13["EJBCA\n(mTLS or OAuth2)"]
     end
 
     subgraph "Target Systems"
         T1["NGINX\n(file write + reload)"]
         T4["Apache httpd\n(file write + reload)"]
         T5["HAProxy\n(combined PEM + reload)"]
-        T2["F5 BIG-IP\n(proxy agent + iControl REST, planned)"]
-        T3["IIS\n(agent-local PowerShell, planned)"]
+        T6["Traefik\n(file provider)"]
+        T7["Caddy\n(admin API / file)"]
+        T8["Envoy\n(file-based SDS)"]
+        T9["Postfix/Dovecot\n(file + service reload)"]
+        T2["F5 BIG-IP\n(proxy agent + iControl REST)"]
+        T3["IIS\n(WinRM + local)"]
+        T10["SSH\n(SFTP + reload)"]
+        T11["WinCertStore\n(PowerShell import)"]
+        T12["Java Keystore\n(keytool pipeline)"]
+        T13["Kubernetes Secrets\n(K8s API)"]
     end
 
     DASH --> API
@@ -96,7 +111,7 @@ flowchart TB
     SVC --> REPO
     REPO --> PG
     SCHED --> SVC
-    SVC -->|"Issue/Renew"| CA1 & CA2 & CA3
+    SVC -->|"Issue/Renew"| CA1 & CA2 & CA3 & CA4 & CA6 & CA7 & CA8 & CA9 & CA10
 
     A1 & A2 & A3 -->|"CSR + Heartbeat"| API
     API -->|"Cert + Chain\n(NO private key)"| A1 & A2 & A3
@@ -116,7 +131,7 @@ The server exposes a REST API under `/api/v1/` and optionally serves the web das
 
 ### Agents
 
-Lightweight Go processes that run on or near your infrastructure. Agents generate ECDSA P-256 private keys locally, create CSRs, and submit them to the control plane for signing — private keys never leave agent infrastructure. Agents also handle certificate deployment to target systems (NGINX, Apache httpd, HAProxy fully implemented; F5 BIG-IP, IIS interface only with V2 implementations planned) and report job status. They communicate with the control plane via HTTP and authenticate with API keys.
+Lightweight Go processes that run on or near your infrastructure. Agents generate ECDSA P-256 private keys locally, create CSRs, and submit them to the control plane for signing — private keys never leave agent infrastructure. Agents also handle certificate deployment to target systems (NGINX, Apache httpd, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, IIS, F5 BIG-IP, SSH, Windows Certificate Store, Java Keystore, Kubernetes Secrets) and report job status. They communicate with the control plane via HTTP and authenticate with API keys.
 
 The agent runs two background loops: a heartbeat (every 60 seconds) to signal it's alive, and a work poll (every 30 seconds) to check for actionable jobs via `GET /api/v1/agents/{id}/work`. Jobs may be `AwaitingCSR` (agent needs to generate key + submit CSR) or `Deployment` (agent needs to deploy a certificate). Private keys are stored in `CERTCTL_KEY_DIR` (default `/var/lib/certctl/keys`) with 0600 permissions.
 
@@ -128,7 +143,7 @@ The agent runs two background loops: a heartbeat (every 60 seconds) to signal it
 
 The web dashboard is the primary operational interface for certctl. It is built with Vite + React + TypeScript and uses TanStack Query for server state management (caching, background refetching, optimistic updates).
 
-**Current views** (21 pages): certificate inventory (list with multi-select bulk operations + "New Certificate" creation modal + detail with deployment status timeline, inline policy/profile editor, version history, deploy, revoke, archive, and trigger renewal actions), agent fleet (list + detail with system info + OS/architecture grouping with charts), job queue (status, retry, cancel, approve/reject for AwaitingApproval jobs), notification inbox (threshold alert grouping, mark-as-read), audit trail (time range, actor, action filters + CSV/JSON export), policy management (rules with enable/disable toggle + delete + violations), issuers (list with test connection + delete), targets (list with 3-step configuration wizard + delete), owners (list with team resolution + delete), teams (list with delete), agent groups (list with dynamic match criteria badges + enable/disable + delete), certificate profiles (list with crypto constraints), short-lived credentials dashboard (TTL countdown, profile filtering, auto-refresh), discovered certificates triage (claim/dismiss unmanaged certs discovered by agents or network scans), network scan targets management (CRUD for network scan targets + Scan Now button), summary dashboard with charts (expiration heatmap, renewal success rate, status distribution, issuance rate), and login page.
+**Current views** (24 pages): certificate inventory (list with multi-select bulk operations + "New Certificate" creation modal + detail with deployment status timeline, inline policy/profile editor, version history, deploy, revoke, archive, and trigger renewal actions), agent fleet (list + detail with system info + OS/architecture grouping with charts), job queue (list + detail with verification section, timeline, audit events; approve/reject for AwaitingApproval jobs), notification inbox (threshold alert grouping, mark-as-read), audit trail (time range, actor, action filters + CSV/JSON export), policy management (rules with enable/disable toggle + delete + violations), issuers (catalog with 10 type cards + 3-step create wizard + detail with test connection), targets (list with 3-step configuration wizard + detail with deployment history), owners (list with team resolution + delete), teams (list with delete), agent groups (list with dynamic match criteria badges + enable/disable + delete), certificate profiles (list with crypto constraints), short-lived credentials dashboard (TTL countdown, profile filtering, auto-refresh), discovered certificates triage (claim/dismiss unmanaged certs discovered by agents or network scans), network scan targets management (CRUD + Scan Now button), summary dashboard with charts (expiration heatmap, renewal success rate, status distribution, issuance rate), digest preview and send, observability (health, metrics, Prometheus config), and login page.
 
 The dashboard includes an **ErrorBoundary component** for graceful error recovery — if a view crashes, the boundary catches the error and displays a user-friendly message instead of breaking the entire dashboard. It also includes a **demo mode** that activates when the API is unreachable — it renders realistic mock data for screenshots and offline presentations.
 
@@ -381,7 +396,11 @@ sequenceDiagram
     Note over A: Agent deploys using locally-held private key
 ```
 
-**Profile enforcement:** If the certificate is assigned to a profile (`certificate_profile_id`), the profile's `allowed_key_algorithms` and `max_validity_days` constraints are checked during CSR validation. A CSR with a disallowed key type or a validity period exceeding the profile maximum is rejected before reaching the issuer connector.
+**Profile enforcement (M11c):** Crypto policy enforcement is wired into all four issuance paths: renewal (server-side and agent CSR), agent fallback CSR signing, EST enrollment (RFC 7030), and SCEP enrollment (RFC 8894). At each path, the service layer resolves the certificate's profile and calls `ValidateCSRAgainstProfile()` to check the CSR key algorithm and minimum key size against the profile's `allowed_key_algorithms` rules. A CSR with a disallowed key type or insufficient key size is rejected before reaching the issuer connector.
+
+**MaxTTL enforcement:** When a profile specifies `max_ttl_seconds`, the value is forwarded through the service-layer `IssuerConnector` interface to the connector layer via `MaxTTLSeconds` on `IssuanceRequest` and `RenewalRequest`. Each issuer connector enforces the cap according to its capabilities: the Local CA caps `NotAfter` directly, Vault overrides its TTL string, step-ca caps `NotAfter` with zero-value handling, and OpenSSL logs an advisory warning (script-based signing can't enforce server-side). For CAs that control validity themselves (ACME, DigiCert, Sectigo, Google CAS, AWS ACM PCA), MaxTTLSeconds passes through but the CA makes the final decision.
+
+**Key metadata persistence:** Certificate versions record `key_algorithm` and `key_size` extracted from the CSR during issuance. This metadata enables post-hoc auditing — operators can verify that all issued certificates comply with the key requirements in effect at the time of issuance.
 
 #### Server-Side Key Generation (Demo Only)
 
@@ -413,8 +432,8 @@ The agent deploys certificates using target connectors. Each connector knows how
 - **NGINX**: Writes cert/chain/key files to disk, validates config with `nginx -t`, reloads with `nginx -s reload` or `systemctl reload nginx`
 - **Apache httpd**: Writes separate cert/chain/key files, validates with `apachectl configtest`, graceful reload
 - **HAProxy**: Builds a combined PEM file (cert + chain + key), optionally validates config, reloads via systemctl or signal
-- **F5 BIG-IP** (planned): A proxy agent in the same network zone calls the iControl REST API to upload certificate and update SSL profile bindings. The server assigns the work; the proxy agent executes it.
-- **IIS** (planned, dual-mode): (1) Agent-local (recommended) — a Windows agent on the IIS box runs PowerShell `Import-PfxCertificate` + `Set-WebBinding` directly. (2) Proxy agent WinRM — for agentless IIS targets, a nearby Windows agent reaches the IIS box via WinRM.
+- **F5 BIG-IP**: A proxy agent in the same network zone calls the iControl REST API to upload certificate/key files, install crypto objects, and update the SSL client profile within an atomic transaction. The server assigns the work; the proxy agent executes it.
+- **IIS** (implemented, dual-mode): (1) Agent-local (recommended) — a Windows agent on the IIS box runs PowerShell `Import-PfxCertificate` + `Set-WebBinding` directly with PFX conversion and SHA-1 thumbprint computation. (2) Proxy agent WinRM — for agentless IIS targets, a nearby Windows agent reaches the IIS box via WinRM.
 
 The agent handles both the certificate (public) and the private key (read from local key store at `CERTCTL_KEY_DIR`). The control plane never sees the private key and never initiates outbound connections to agents or targets (pull-only model).
 
@@ -444,13 +463,17 @@ sequenceDiagram
     API-->>U: 200 OK
 ```
 
-The revocation is recorded in the `certificate_revocations` table (separate from the certificate status update) for CRL generation. The DER-encoded CRL at `GET /api/v1/crl/{issuer_id}` is generated on-demand by querying this table and signing with the issuing CA's key. The OCSP responder at `GET /api/v1/ocsp/{issuer_id}/{serial}` checks both the certificate status and the revocations table to return signed good/revoked/unknown responses.
+The revocation is recorded in the `certificate_revocations` table (separate from the certificate status update) for CRL generation. The DER-encoded CRL at `GET /.well-known/pki/crl/{issuer_id}` (RFC 5280 §5, RFC 8615) is generated on-demand by querying this table and signing with the issuing CA's key. The OCSP responder at `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (RFC 6960) checks both the certificate status and the revocations table to return signed good/revoked/unknown responses. Both endpoints are served unauthenticated — relying parties (TLS clients, hardware appliances, browsers) must be able to reach them without a certctl API key — and carry the IANA-registered media types `application/pkix-crl` and `application/ocsp-response` respectively.
 
 Short-lived certificates (those with profile TTL < 1 hour) return "good" from OCSP and are excluded from CRL — their rapid expiry is treated as sufficient revocation.
 
+#### Bulk Revocation
+
+For compliance events requiring fleet-wide revocation (key compromise, CA distrust, mass decommission), certctl supports bulk revocation by filter criteria. The `POST /api/v1/certificates/bulk-revoke` endpoint accepts filter parameters (profile_id, owner_id, agent_id, issuer_id) and creates individual revocation jobs for each matching certificate. Bulk revocation reuses the same 7-step single-cert flow for each certificate — no new issuer notification or audit mechanics. The operation is idempotent: revoking an already-revoked certificate is a no-op. Partial failures are tolerated — if one certificate fails to revoke (e.g., issuer unavailable), the operation continues for remaining certs and returns a summary. A single `bulk_revocation_initiated` audit event logs the operation with filter criteria, operator actor, and summary (total requested, succeeded, failed counts). Audit events for individual certificate revocations record the operator identity separately. The GUI bulk revoke button on the certificates list filters by visible selections and displays an affected-cert count modal before confirmation.
+
 ### 4. Automatic Renewal
 
-The control plane runs a scheduler with six background loops:
+The control plane runs a scheduler with seven background loops:
 
 ```mermaid
 flowchart LR
@@ -461,6 +484,7 @@ flowchart LR
         N["Notification Processor\n⏱ every 1m"]
         SL["Short-Lived Expiry\n⏱ every 30s"]
         NS["Network Scanner\n⏱ every 6h"]
+        DG["Certificate Digest\n⏱ every 24h"]
     end
 
     R -->|"Find expiring certs\nCreate renewal jobs"| DB[("PostgreSQL")]
@@ -469,6 +493,7 @@ flowchart LR
     N -->|"Send pending notifications\nEmail / Webhook / Slack"| DB
     SL -->|"Expire short-lived certs\nMark as Expired"| DB
     NS -->|"Probe TLS endpoints\nStore discovered certs"| DB
+    DG -->|"Generate & send HTML digest\nEmail to recipients"| DB
 ```
 
 | Loop | Interval | Timeout | Purpose |
@@ -478,7 +503,10 @@ flowchart LR
 | Agent health check | 2 minutes | 1 minute | Marks agents as offline if heartbeat is stale |
 | Notification processor | 1 minute | 1 minute | Sends pending notifications via configured channels |
 | Short-lived expiry | 30 seconds | 30 seconds | Marks expired short-lived certificates (profile TTL < 1 hour) |
-| Network scanner | 6 hours | 30 minutes | Probes TLS endpoints on configured CIDR ranges, stores discovered certs (M21, opt-in via `CERTCTL_NETWORK_SCAN_ENABLED`) |
+| Network scanner | 6 hours | 30 minutes | Probes TLS endpoints on configured CIDR ranges, stores discovered certs (M21, opt-in via `CERTCTL_NETWORK_SCAN_ENABLED`). CIDR size validated at API level — max /20 (4096 IPs) per range. |
+| Certificate digest | 24 hours | 5 minutes | Generates HTML email with certificate stats, expiration timeline, job health, agent count. Does NOT run on startup — waits for first scheduled tick. Configurable interval and recipients via `CERTCTL_DIGEST_INTERVAL` and `CERTCTL_DIGEST_RECIPIENTS`. Falls back to certificate owner emails if no explicit recipients configured. |
+
+Each loop uses `sync/atomic.Bool` idempotency guards to prevent concurrent tick execution — if a loop iteration is still running when the next tick fires, the tick is skipped with a warning log. All loops (including short-lived expiry check) run immediately on startup before entering their ticker interval, ensuring no gap between scheduler start and first execution. The certificate digest loop is the exception — it does NOT run on startup, only on scheduled ticks. Graceful shutdown uses `sync.WaitGroup` with `WaitForCompletion()` to drain all in-flight work before process exit.
 
 Each operation has a context timeout to prevent indefinite hangs if external services become unresponsive.
 
@@ -499,9 +527,16 @@ flowchart TB
         II["IssuerConnector Interface\nIssueCertificate() | RenewCertificate()\nRevokeCertificate() | GetOrderStatus()"]
         II --> LC["Local CA"]
         II --> ACME["ACME v2"]
-        II --> SC["step-ca"]
+        II --> SCA["step-ca"]
         II --> OC["OpenSSL / Custom CA"]
-        II --> VP["Vault PKI (planned)"]
+        II --> VP["Vault PKI"]
+        II --> DC["DigiCert CertCentral"]
+        II --> SG["Sectigo SCM"]
+        II --> GC["Google CAS"]
+        II --> AP2["AWS ACM PCA"]
+        II --> EN["Entrust"]
+        II --> GS["GlobalSign Atlas"]
+        II --> EJ["EJBCA"]
     end
 
     subgraph "Target Connectors"
@@ -512,8 +547,14 @@ flowchart TB
         TI --> HP["HAProxy"]
         TI --> TF["Traefik"]
         TI --> CD["Caddy"]
-        TI --> F5["F5 BIG-IP (interface only)"]
-        TI --> IIS["IIS (interface only)"]
+        TI --> EV["Envoy"]
+        TI --> PO["Postfix/Dovecot"]
+        TI --> IIS["IIS"]
+        TI --> F5["F5 BIG-IP"]
+        TI --> SSH["SSH"]
+        TI --> WCS["WinCertStore"]
+        TI --> JKS["Java Keystore"]
+        TI --> K8S["K8s Secrets"]
     end
 
     subgraph "Notifier Connectors"
@@ -565,7 +606,11 @@ type Connector interface {
 }
 ```
 
-Built-in issuers: **Local CA** (self-signed or sub-CA mode using `crypto/x509`), **ACME v2** (HTTP-01, DNS-01, and DNS-PERSIST-01 challenges, compatible with Let's Encrypt, ZeroSSL, Sectigo, Google Trust Services, and any ACME-compliant CA), **step-ca** (Smallstep private CA via native /sign API with JWK provisioner auth), and **OpenSSL/Custom CA** (script-based signing delegating to user-provided shell scripts). The ACME connector uses `golang.org/x/crypto/acme`, generates an ECDSA P-256 account key, handles account registration with ToS acceptance and optional External Account Binding (EAB) for CAs that require it (ZeroSSL, Google Trust Services, SSL.com), order creation, challenge solving (HTTP-01 via built-in server, DNS-01 via script-based hooks, DNS-PERSIST-01 via standing TXT records with auto-fallback to DNS-01), order finalization, and DER-to-PEM chain conversion. For ZeroSSL, EAB credentials are auto-fetched from ZeroSSL's public API when the directory URL is detected as ZeroSSL and no EAB credentials are provided — zero-friction onboarding with no dashboard visit required. The interface also includes `GetCACertPEM(ctx)` for CA chain distribution (used by the EST server's `/cacerts` endpoint).
+Built-in issuers (9 connectors): **Local CA** (self-signed or sub-CA mode using `crypto/x509`), **ACME v2** (HTTP-01, DNS-01, and DNS-PERSIST-01 challenges, compatible with Let's Encrypt, ZeroSSL, Sectigo, Google Trust Services, and any ACME-compliant CA), **step-ca** (Smallstep private CA via native /sign API with JWK provisioner auth), **OpenSSL/Custom CA** (script-based signing delegating to user-provided shell scripts), **Vault PKI** (HashiCorp Vault's PKI secrets engine via /sign API with token auth), **DigiCert** (commercial CA via CertCentral REST API with async order processing), **Sectigo SCM** (async order model with 3-header auth), **Google CAS** (Cloud Certificate Authority Service with OAuth2 service account auth), and **AWS ACM Private CA** (synchronous issuance via ACM PCA API). The ACME connector uses `golang.org/x/crypto/acme`, generates an ECDSA P-256 account key, handles account registration with ToS acceptance and optional External Account Binding (EAB) for CAs that require it (ZeroSSL, Google Trust Services, SSL.com), order creation, challenge solving (HTTP-01 via built-in server, DNS-01 via script-based hooks, DNS-PERSIST-01 via standing TXT records with auto-fallback to DNS-01), order finalization, and DER-to-PEM chain conversion. For ZeroSSL, EAB credentials are auto-fetched from ZeroSSL's public API when the directory URL is detected as ZeroSSL and no EAB credentials are provided — zero-friction onboarding with no dashboard visit required.
+
+**ACME Renewal Information (ARI, RFC 9773):** The ACME connector supports CA-directed renewal timing via the `GetRenewalInfo()` method. Instead of using fixed thresholds (e.g., renew 30 days before expiry), the CA tells certctl when to renew by providing a `suggestedWindow` with start and end times. This is useful for distributing renewal load during maintenance windows and coordinating mass-revocation scenarios. Enable with `CERTCTL_ACME_ARI_ENABLED=true`. Cert ID is computed as `base64url(SHA-256(DER cert))` per RFC 9773. If the CA doesn't support ARI (404 from the ARI endpoint), certctl automatically falls back to threshold-based renewal — no operator intervention required. Errors from the CA are logged as warnings.
+
+The interface also includes `GetCACertPEM(ctx)` for CA chain distribution (used by the EST server's `/cacerts` endpoint).
 
 ### Target Connector
 
@@ -581,11 +626,11 @@ type Connector interface {
 
 The `DeploymentRequest` struct carries the full material needed by the target system: the signed certificate, the CA chain, the agent-generated private key, target-specific configuration, and arbitrary metadata. The key field is populated by the agent from its local key store (`CERTCTL_KEY_DIR`) — it never originates from the control plane.
 
-Built-in targets: **NGINX** (writes cert/chain/key files, validates with `nginx -t`, reloads), **Apache httpd** (writes cert/chain/key files, validates with `apachectl configtest`, graceful reload), **HAProxy** (combined PEM file with cert+chain+key, validates config, reloads via systemctl/signal), **Traefik** (file provider — writes cert/key to watched directory, Traefik auto-reloads), **Caddy** (dual-mode: admin API hot-reload or file-based), **F5 BIG-IP** (interface only — proxy agent + iControl REST, implementation planned), **IIS** (interface only — dual-mode: agent-local PowerShell primary + proxy agent WinRM for agentless targets, implementation planned).
+Built-in targets (14 connector types): **NGINX** (writes cert/chain/key files, validates with `nginx -t`, reloads), **Apache httpd** (writes cert/chain/key files, validates with `apachectl configtest`, graceful reload), **HAProxy** (combined PEM file with cert+chain+key, validates config, reloads via systemctl/signal), **Traefik** (file provider — writes cert/key to watched directory, Traefik auto-reloads), **Caddy** (dual-mode: admin API hot-reload or file-based), **Envoy** (file-based with optional SDS JSON config), **F5 BIG-IP** (proxy agent + iControl REST, transaction-based atomic SSL profile updates), **IIS** (dual-mode: agent-local PowerShell + proxy agent WinRM for agentless targets), **Postfix/Dovecot** (file write + service reload), **SSH** (agentless deployment via SSH/SFTP), **Windows Certificate Store** (PowerShell-based cert import, dual-mode local/WinRM), **Java Keystore** (PEM → PKCS#12 → keytool pipeline, JKS and PKCS12 formats), **Kubernetes Secrets** (deploys as `kubernetes.io/tls` Secrets via injectable K8sClient interface, in-cluster or kubeconfig auth).
 
 After deployment, agents can perform **post-deployment TLS verification**: the agent probes the live TLS endpoint using `crypto/tls.DialWithDialer` and compares the SHA-256 fingerprint of the served certificate against what was deployed. Results are reported via `POST /api/v1/jobs/{id}/verify` and stored on the job record. Verification is best-effort — failures don't block or rollback deployments.
 
-Additional cloud, network, and Kubernetes target connectors are planned for future releases.
+The SSH connector enables agentless deployment to any Linux/Unix server via SSH/SFTP, using the proxy agent pattern. The Kubernetes Secrets connector deploys certificates as `kubernetes.io/tls` Secrets via an injectable K8sClient interface supporting both in-cluster and out-of-cluster auth.
 
 ### Notifier Connector
 
@@ -638,10 +683,50 @@ type ESTService interface {
 }
 ```
 
-**Issuer connector extension:** EST required adding `GetCACertPEM(ctx) (string, error)` to the issuer connector interface so the `/cacerts` endpoint can serve the CA chain. The Local CA connector returns its CA certificate PEM; ACME, step-ca, and OpenSSL connectors return errors (they don't expose a static CA chain — their chains are per-issuance).
+**Issuer connector extension:** EST required adding `GetCACertPEM(ctx) (string, error)` to the issuer connector interface so the `/cacerts` endpoint can serve the CA chain. The Local CA returns its CA certificate PEM; Vault PKI fetches via `GET /v1/{mount}/ca/pem`; Google CAS fetches via API; AWS ACM PCA retrieves via `GetCertificateAuthorityCertificate`. ACME, step-ca, OpenSSL, DigiCert, and Sectigo connectors return errors (they don't expose a static CA chain — their chains are per-issuance).
 
 **Audit:** Every EST enrollment is recorded in the audit trail with `protocol: "EST"`, the CN, SANs, issuer ID, serial number, and optional profile ID.
 
+### SCEP Server (RFC 8894)
+
+The SCEP (Simple Certificate Enrollment Protocol) server provides certificate enrollment for MDM platforms and network devices. It runs at `/scep` with operation-based dispatch via query parameters per RFC 8894.
+
+**Architecture:** SCEP follows the exact same layering as EST — a handler-level protocol that delegates certificate issuance to an existing `IssuerConnector`. The `SCEPService` bridges the `SCEPHandler` to whichever issuer connector is configured via `CERTCTL_SCEP_ISSUER_ID`.
+
+```
+Client (MDM, network device, SCEP client)
+    │
+    ▼
+SCEPHandler (handler layer)
+    │  PKCS#7 envelope parsing, CSR extraction, challenge password extraction
+    ▼
+SCEPService (service layer)
+    │  Challenge password validation, CSR validation, CN/SAN extraction, audit recording
+    ▼
+IssuerConnector (connector layer via IssuerConnectorAdapter)
+    │  Certificate signing (Local CA, step-ca, etc.)
+    ▼
+Signed certificate returned as PKCS#7 certs-only
+```
+
+**Wire format:** SCEP clients wrap CSRs in PKCS#7 SignedData envelopes. The handler parses the outer ASN.1 ContentInfo → SignedData → EncapsulatedContentInfo to extract the CSR bytes. Fallback paths handle base64-encoded PKCS#7 and raw CSR submissions (for simpler clients). Responses use PKCS#7 certs-only via the shared `internal/pkcs7` package (same as EST). Single certs are returned as raw DER for `GetCACert`, chains as PKCS#7.
+
+**Authentication:** SCEP uses challenge passwords embedded in CSR attributes (OID 1.2.840.113549.1.9.7) rather than TLS client certificates. The server validates the challenge password against `CERTCTL_SCEP_CHALLENGE_PASSWORD`. When no challenge password is configured, any value is accepted.
+
+**Interface:** The `SCEPHandler` defines an `SCEPService` interface (dependency inversion):
+
+```go
+type SCEPService interface {
+    GetCACaps(ctx context.Context) string
+    GetCACert(ctx context.Context) (string, error)
+    PKCSReq(ctx context.Context, csrPEM string, challengePassword string, transactionID string) (*domain.SCEPEnrollResult, error)
+}
+```
+
+**Shared PKCS#7 package:** Both EST and SCEP handlers share a common `internal/pkcs7` package for building PKCS#7 certs-only responses and PEM-to-DER chain conversion, eliminating code duplication between the two enrollment protocols.
+
+**Audit:** Every SCEP enrollment is recorded in the audit trail with `protocol: "SCEP"`, the CN, SANs, issuer ID, serial number, transaction ID, and optional profile ID.
+
 ## Security Model
 
 ### Private Key Management
@@ -709,7 +794,9 @@ Audit events cannot be modified or deleted. They support filtering by actor, act
 
 ### API Audit Log
 
-In addition to application-level audit events, certctl records every HTTP API call via middleware. The audit middleware captures method, path, actor (extracted from auth context), SHA-256 request body hash (truncated to 16 characters), response status code, and request latency. Health and readiness probes are excluded to avoid noise.
+In addition to application-level audit events, certctl records every HTTP API call via middleware. The audit middleware captures method, URL path (excluding query parameters — see security note below), actor (extracted from auth context), SHA-256 request body hash (truncated to 16 characters), response status code, and request latency. Health and readiness probes are excluded to avoid noise.
+
+**Security: Query Parameter Exclusion** — The audit middleware intentionally records `r.URL.Path` only (not `r.URL.String()` or `r.RequestURI`). Query strings may contain cursor tokens, API keys passed as params, or other sensitive filter values. Since the audit trail is append-only with no deletion capability, any sensitive data recorded would persist permanently.
 
 Audit recording is async (via goroutine) so it never blocks the HTTP response. If audit persistence fails, the error is logged immediately — the API call still succeeds. The middleware sits after the auth middleware in the stack so the actor identity is available from context.
 
@@ -721,6 +808,34 @@ All shell-facing inputs (connector scripts, domain names, ACME tokens) are valid
 
 All incoming HTTP request bodies are capped by `http.MaxBytesReader` middleware (default 1MB, configurable via `CERTCTL_MAX_BODY_SIZE`). Requests exceeding the limit receive a 413 Request Entity Too Large response. The middleware is positioned before authentication in the chain so oversized payloads are rejected early, before any auth processing or database work occurs. Requests without bodies (GET, HEAD, nil body) skip the limit check.
 
+### Config Encryption at Rest
+
+Dynamic issuer and target configurations (rows with `source='database'`) contain credentials — ACME EAB HMACs, Vault tokens, DigiCert/Sectigo API keys, SSH private keys, WinRM passwords, F5 BIG-IP passwords, and similar. These are sealed at rest in PostgreSQL via `internal/crypto/encryption.go` using AES-256-GCM with a key derived from the operator passphrase `CERTCTL_CONFIG_ENCRYPTION_KEY` through PBKDF2-SHA256 (100,000 rounds, 32-byte output).
+
+**v2 wire format (current, M-8 remediation, CWE-916 / CWE-329):**
+
+```
+magic(0x02) || salt(16) || nonce(12) || ciphertext+tag
+```
+
+Every call to `EncryptIfKeySet` draws 16 fresh bytes from `crypto/rand` as the PBKDF2 salt, so the derived AES-256 key is distinct per ciphertext and per re-encryption. The salt is stored alongside the ciphertext; decryption reads the magic byte, splits out the salt, re-derives the key, and verifies the AEAD tag.
+
+**v1 legacy format (read-only):**
+
+```
+nonce(12) || ciphertext+tag
+```
+
+Pre-M-8 blobs were sealed with a package-level fixed salt `"certctl-config-encryption-v1"`. `DecryptIfKeySet` preserves the v1 read path unchanged — a blob whose first byte is not `0x02`, or whose v2 AEAD verification fails (including the 1/256 case where a v1 nonce happens to begin with `0x02`), falls through to a v1 attempt against the legacy fixed salt. v1 blobs are never written by the post-M-8 code path; they re-seal as v2 naturally on the next UPDATE through the normal service CRUD flow. No operator migration ceremony is required.
+
+**Fail-closed behavior (C-2 sentinel, CWE-311):** both `EncryptIfKeySet` and `DecryptIfKeySet` return `ErrEncryptionKeyRequired` when invoked with an empty passphrase. The server refuses to start if any `source='database'` rows already exist without `CERTCTL_CONFIG_ENCRYPTION_KEY` set.
+
+**Low-level primitives preserved byte-identical.** `Encrypt`, `Decrypt`, and `DeriveKey` are kept bit-stable so v1 fixtures on disk remain decryptable unchanged and so callers outside the config-encryption path (none today, but the symbols are exported) do not see a breaking change. The new per-ciphertext salt path is reached via the helper `deriveKeyWithSalt(passphrase, salt)`.
+
+**Passphrase plumbing.** Services (`IssuerService`, `TargetService`, `IssuerRegistry`) hold the operator passphrase as a raw `string` and delegate PBKDF2 to the crypto package per ciphertext. This replaces the pre-M-8 design that pre-derived a single `[]byte` key at service construction and reused it for every row, which was the direct consequence of the fixed-salt KDF.
+
+**Coverage gate.** CI enforces `internal/crypto/...` coverage ≥ 85% (observed 86.7%) — the encryption primitives are a security-critical gate, and the v2 format plus v1 fallback plus C-2 sentinel paths all need exhaustive coverage to avoid silent regressions.
+
 ### CORS
 
 CORS uses a **deny-by-default** posture: when `CERTCTL_CORS_ORIGINS` is empty, no CORS headers are set and only same-origin requests can read responses. Operators must explicitly configure allowed origins. This prevents accidental exposure of the API to cross-origin requests in production.
@@ -740,7 +855,7 @@ The HTTP middleware stack processes requests in the following order (see `cmd/se
 
 ### Concurrency Safety
 
-The background scheduler uses `sync/atomic.Bool` idempotency guards on all 6 loops — if a tick fires while the previous iteration is still running, it skips. A `sync.WaitGroup` tracks all in-flight goroutines. `WaitForCompletion(timeout)` blocks during shutdown until all work finishes or the timeout expires, preventing state corruption from mid-flight database operations during process exit.
+The background scheduler uses `sync/atomic.Bool` idempotency guards on all 7 loops — if a tick fires while the previous iteration is still running, it skips. A `sync.WaitGroup` tracks all in-flight goroutines. `WaitForCompletion(timeout)` blocks during shutdown until all work finishes or the timeout expires, preventing state corruption from mid-flight database operations during process exit.
 
 ### Logging
 
@@ -759,10 +874,12 @@ All endpoints are under `/api/v1/` and follow consistent patterns:
 
 Resources: certificates, issuers, targets, agents, jobs, policies, profiles, teams, owners, agent-groups, audit, notifications, discovered-certificates, discovery-scans, network-scan-targets, stats, metrics.
 
-The full API is documented in an OpenAPI 3.1 specification at `api/openapi.yaml` with 97 endpoints across 20 resource domains (95 under `/api/v1/` + `/.well-known/est/` plus `/health` and `/ready`; includes auth, 7 discovery endpoints from M18b, 6 network scan endpoints from M21, Prometheus metrics from M22, and 4 EST enrollment endpoints from M23), all request/response schemas, and pagination conventions. See the [OpenAPI Guide](openapi.md) for usage with Swagger UI and SDK generation.
+The full API is documented in an OpenAPI 3.1 specification at `api/openapi.yaml` with 97 operations across `/api/v1/` and `/.well-known/est/` (includes auth, 7 discovery endpoints, 6 network scan endpoints, Prometheus metrics, 4 EST enrollment endpoints, 2 digest endpoints, 2 verification endpoints, 2 export endpoints), all request/response schemas, and pagination conventions. The server also registers `/health` and `/ready` outside the OpenAPI spec, bringing the total route count to 107. See the [OpenAPI Guide](openapi.md) for usage with Swagger UI and SDK generation.
 
 Jobs support additional action endpoints: `POST /api/v1/jobs/{id}/cancel`, `POST /api/v1/jobs/{id}/approve`, `POST /api/v1/jobs/{id}/reject`.
 
+**Bulk Operations:** `POST /api/v1/certificates/bulk-revoke` — Bulk revocation by filter criteria (profile_id, owner_id, agent_id, issuer_id). Creates individual revocation jobs for matching certificates, with partial-failure tolerance and a summary audit event.
+
 **Enhanced Query Features (M20):** Certificate list endpoints support additional query capabilities beyond basic pagination:
 
 - **Sorting**: `?sort=notAfter` (ascending) or `?sort=-createdAt` (descending). Whitelist: notAfter, expiresAt, createdAt, updatedAt, commonName, name, status, environment.
@@ -772,7 +889,9 @@ Jobs support additional action endpoints: `POST /api/v1/jobs/{id}/cancel`, `POST
 - **Additional filters**: `?agent_id=`, `?profile_id=` (in addition to existing status, environment, owner_id, team_id, issuer_id).
 - **Deployments**: `GET /api/v1/certificates/{id}/deployments` returns deployment targets for a certificate.
 
-Certificate revocation: `POST /api/v1/certificates/{id}/revoke` with optional `{"reason": "keyCompromise"}`. Supports RFC 5280 reason codes (unspecified, keyCompromise, caCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, privilegeWithdrawn). Returns the updated certificate status. Best-effort issuer notification — the revocation succeeds even if the issuer connector is unavailable. A JSON-formatted CRL is available at `GET /api/v1/crl`, and a DER-encoded X.509 CRL signed by the issuing CA at `GET /api/v1/crl/{issuer_id}`. An embedded OCSP responder serves signed responses at `GET /api/v1/ocsp/{issuer_id}/{serial}`. Short-lived certificates (profile TTL < 1 hour) are exempt from CRL/OCSP — expiry is sufficient revocation.
+Certificate revocation: `POST /api/v1/certificates/{id}/revoke` with optional `{"reason": "keyCompromise"}`. Supports RFC 5280 reason codes (unspecified, keyCompromise, caCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, privilegeWithdrawn). Returns the updated certificate status. Best-effort issuer notification — the revocation succeeds even if the issuer connector is unavailable. The DER-encoded X.509 CRL signed by the issuing CA is served unauthenticated at `GET /.well-known/pki/crl/{issuer_id}` (RFC 5280 §5 + RFC 8615, `Content-Type: application/pkix-crl`). The embedded OCSP responder serves signed responses unauthenticated at `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (RFC 6960, `Content-Type: application/ocsp-response`). Both endpoints are accessible to relying parties with no certctl API credentials, as RFC-compliant PKI consumers expect. Short-lived certificates (profile TTL < 1 hour) are exempt from CRL/OCSP — expiry is sufficient revocation.
+
+Certificate export (M27): `GET /api/v1/certificates/{id}/export/pem` returns PEM-encoded certificate and chain, and `POST /api/v1/certificates/{id}/export/pkcs12` returns a PKCS#12 bundle (binary). Private keys are never exported — they remain on agents. All exports are audited with actor, timestamp, and format.
 
 Health checks live outside the API prefix: `GET /health` and `GET /ready`.
 
@@ -785,7 +904,7 @@ flowchart LR
     AI["AI Assistant\n(Claude, Cursor)"] -->|"stdio"| MCP["MCP Server\ncmd/mcp-server/"]
     MCP -->|"HTTP + Bearer token"| API["certctl REST API\n:8443"]
 
-    subgraph "78 MCP Tools"
+    subgraph "MCP Tools"
         T1["Certificate CRUD"]
         T2["Agent Management"]
         T3["Job Operations"]
@@ -799,7 +918,7 @@ flowchart LR
 
 The MCP server is a stateless HTTP proxy — every MCP tool call translates to an HTTP request to the certctl REST API. It adds no new state, no new dependencies, and no new attack surface beyond what the API already exposes. Configuration is minimal: `CERTCTL_SERVER_URL` and `CERTCTL_API_KEY` environment variables.
 
-The 78 tools are organized across 16 resource domains with typed input structs and `jsonschema` struct tags for automatic LLM-friendly schema generation. Binary response support handles DER CRL and OCSP endpoints.
+The tools are organized across 16 resource domains with typed input structs and `jsonschema` struct tags for automatic LLM-friendly schema generation. Binary response support handles DER CRL and OCSP endpoints.
 
 ## CLI Tool
 
@@ -829,7 +948,9 @@ flowchart TB
 **Credentials & Configuration:**
 Database and API credentials are managed via environment variables defined in a `.env` file. Copy `deploy/.env.example` to `deploy/.env` for local development and customize credentials for production. The agent key directory (`CERTCTL_KEY_DIR`) is persisted as a named Docker volume (`agent_keys`) at `/var/lib/certctl/keys` for reliable key storage across container restarts.
 
-### Production (Kubernetes)
+### Production (Kubernetes with Helm)
+
+A production-ready Helm chart is available under `deploy/helm/certctl/` with full support for multi-replica deployments, persistent PostgreSQL, agent DaemonSet, optional Ingress, and security best practices.
 
 ```mermaid
 flowchart TB
@@ -855,11 +976,26 @@ flowchart TB
     DS --> DEP
 ```
 
+**Helm Installation:**
+
+```bash
+# Add the chart (if published) or install from local directory
+helm install certctl deploy/helm/certctl/ \
+  --set server.auth.apiKey="your-secure-key" \
+  --set postgresql.auth.password="your-db-password" \
+  --set ingress.enabled=true \
+  --set ingress.hosts[0].host="certctl.example.com"
+```
+
+The Helm chart includes: server Deployment with configurable replicas, liveness/readiness probes, security context (non-root, read-only rootfs), PostgreSQL StatefulSet with persistent volumes, optional Ingress with TLS, ServiceAccount with configurable RBAC, and agent DaemonSet running one agent per node. All certctl configuration options are exposed in `values.yaml` — issuers, targets, notifiers, scheduler intervals, discovery settings, and SMTP for digest emails.
+
+See `deploy/helm/certctl/values.yaml` for the full configuration reference and `deploy/helm/certctl/Chart.yaml` for version and appVersion details.
+
 For production, you would also add an ingress controller, TLS termination for the certctl API itself, and external PostgreSQL (RDS, Cloud SQL, etc.).
 
-## Discovery Data Flow (M18b + M21)
+## Discovery Data Flow (M18b + M21 + M50)
 
-Certificate discovery enables operators to build a complete inventory of existing certificates before managing them with certctl. There are two discovery modes that feed into the same pipeline:
+Certificate discovery enables operators to build a complete inventory of existing certificates before managing them with certctl. There are three discovery modes that feed into the same pipeline:
 
 ```mermaid
 flowchart TB
@@ -868,6 +1004,7 @@ flowchart TB
         SCAN["Filesystem Scanner\n(CERTCTL_DISCOVERY_DIRS)"]
         SERVER["certctl-server\n(network discovery)"]
         NETSCAN["TLS Scanner\n(CIDR ranges + ports)"]
+        CLOUD["Cloud Discovery\n(AWS SM / Azure KV / GCP SM)"]
     end
 
     EXTRACT["Extract Metadata\n(CN, SANs, serial, issuer, expiry, fingerprint)"]
@@ -883,6 +1020,7 @@ flowchart TB
     SCAN --> EXTRACT
     SERVER -->|"Scheduler loop\n(every 6h)"| NETSCAN
     NETSCAN -->|"crypto/tls.Dial\n50 goroutines"| EXTRACT
+    CLOUD -->|"Scheduler loop\n(every 6h)"| EXTRACT
     EXTRACT --> SERVICE
     SERVICE --> REPO
     REPO -->|"Dedup by fingerprint\n+ agent_id + source_path"| DB
@@ -909,7 +1047,16 @@ flowchart TB
 5. **Sentinel agent** — Results submitted using `server-scanner` as virtual agent ID, with `source_path` set to `ip:port` and `source_format` set to `network`
 6. **Same pipeline** — Feeds into the same `DiscoveryService.ProcessDiscoveryReport()` as filesystem discovery — same dedup, same audit trail, same triage workflow
 
-**Common triage workflow (both sources):**
+**Cloud Secret Manager Discovery (M50):**
+
+1. **Pluggable sources** — Each cloud provider implements the `DiscoverySource` interface (Name, Type, Discover, ValidateConfig). Three built-in sources: AWS Secrets Manager, Azure Key Vault, GCP Secret Manager
+2. **CloudDiscoveryService orchestrator** — Iterates registered sources, calls `Discover()` on each, feeds reports into `ProcessDiscoveryReport()`. Errors from one source don't prevent other sources from running
+3. **Scheduler integration** — 9th scheduler loop (6h default), runs immediately on startup, `atomic.Bool` idempotency guard
+4. **Sentinel agents** — Each source uses its own sentinel agent ID (`cloud-aws-sm`, `cloud-azure-kv`, `cloud-gcp-sm`) for dedup and triage filtering
+5. **Source path format** — `aws-sm://{region}/{secret}`, `azure-kv://{cert-name}/{version}`, `gcp-sm://{project}/{secret}`
+6. **No new schema** — Reuses existing `discovered_certificates` and `discovery_scans` tables. Sentinel agent IDs leverage existing `(fingerprint_sha256, agent_id, source_path)` dedup constraint
+
+**Common triage workflow (all sources):**
 
 1. **Storage** — Records stored in `discovered_certificates` table with status = "Unmanaged"
 2. **Audit** — `discovery_scan_completed` event logged with agent ID, cert count, scan timestamp
@@ -922,29 +1069,53 @@ flowchart TB
 
 This data flow is pull-based and non-blocking. Agents discover at their own pace; the server stores results for later review. There's no pressure to claim or dismiss; operators can leave certificates in "Unmanaged" status indefinitely.
 
+## Continuous TLS Health Monitoring (M48)
+
+Beyond one-time discovery, certctl continuously monitors TLS endpoints for certificate health using a shared TLS probing package and a state-machine-driven health check service. Endpoints transition between states (Healthy → Degraded → Down) based on consecutive failures, and `cert_mismatch` status alerts when a deployed certificate is unexpectedly replaced.
+
+**Architecture:** Probing is extracted into a shared `internal/tlsprobe/` package used by both the network scanner (M21) and the health monitor. The `HealthCheckService` manages 8 API endpoints for CRUD operations and state transitions. A dedicated 8th scheduler loop runs every 60 seconds (configurable via `CERTCTL_HEALTH_CHECK_INTERVAL`). Individual health check targets have their own check intervals (default 300 seconds) — the scheduler queries only endpoints due for check via `ListDueForCheck()`. Results are stored with historical tracking for 30 days (configurable via `CERTCTL_HEALTH_CHECK_HISTORY_RETENTION`). State transitions trigger notifications (critical for down endpoints, warning for degraded, high for cert_mismatch).
+
+**State Machine:** Healthy → Degraded (configurable threshold, default 2 consecutive failures) → Down (default 5 failures). The `cert_mismatch` status is special — it fires whenever the observed certificate fingerprint differs from the expected (deployed) fingerprint, catching silent rollbacks and unauthorized cert replacements. Recovery from degraded/down transitions back to healthy and resets the failure counter.
+
+**API:** 8 endpoints for list (with filters: status, certificate_id, network_scan_target_id, enabled), get, create, update, delete, history (with limit param), acknowledge (incident marking), and summary (aggregate status counts).
+
+**Auto-Create:** When a deployment job completes with successful verification (M25), the system automatically creates a health check with the deployed certificate's fingerprint as the expected value. Network scan targets can also opt-in to auto-create health checks for discovered endpoints.
+
+**Configuration:**
+
+| Env Var | Default | Description |
+|---|---|---|
+| `CERTCTL_HEALTH_CHECK_ENABLED` | `false` | Enable/disable the feature |
+| `CERTCTL_HEALTH_CHECK_INTERVAL` | `60s` | Scheduler tick interval |
+| `CERTCTL_HEALTH_CHECK_DEFAULT_INTERVAL` | `300s` | Default per-endpoint check interval (5 min) |
+| `CERTCTL_HEALTH_CHECK_DEFAULT_TIMEOUT` | `5000ms` | TLS connection timeout per probe |
+| `CERTCTL_HEALTH_CHECK_MAX_CONCURRENT` | `20` | Max concurrent TLS probes |
+| `CERTCTL_HEALTH_CHECK_HISTORY_RETENTION` | `30 days` | Purge probe history older than this |
+| `CERTCTL_HEALTH_CHECK_AUTO_CREATE` | `true` | Auto-create checks from deployments |
+
 ## Testing Strategy
 
-certctl uses a layered testing approach aligned with the handler → service → repository architecture, with 1050+ tests across six layers (service, handler, integration, connector, frontend, and scheduler). The goal is high-confidence regression prevention at the service and handler layers, where the most complex business logic lives, combined with integration tests that exercise the full request path from HTTP to database.
+certctl is extensively tested across eight layers with CI-enforced coverage gates that act as regression floors. The goal is high-confidence regression prevention at the service and handler layers (where the most complex business logic lives), combined with integration tests that exercise the full request path from HTTP to database.
 
-**Service layer unit tests** (`internal/service/*_test.go`) — ~238 test functions across 15 files with mock repositories. These test all business logic in isolation: certificate CRUD with validation, certificate revocation (success, already-revoked, archived, invalid reason, all RFC 5280 reason codes, issuer notification, notification service integration, OCSP/CRL generation), agent lifecycle (registration, heartbeat, CSR submission with both keygen modes), job state machine (creation, processing, cancellation, retry logic), policy evaluation (all 5 rule types, violation creation), renewal and issuance flow (server-side and agent-side keygen paths), notification deduplication (threshold tag matching, channel routing), team/owner/agent group CRUD with pagination and audit recording, issuer service CRUD with connection testing, and the issuer connector adapter (type translation between connector and service layers including revocation). Mock repositories are simple structs with function fields, avoiding heavy mocking frameworks — this keeps tests readable and avoids coupling to mock library APIs.
+**Service layer unit tests** (`internal/service/*_test.go`) — Mock-based tests across all service files covering certificate CRUD, revocation (all RFC 5280 reason codes, OCSP/CRL generation, bulk revocation by filter with partial-failure tolerance), agent lifecycle, job state machine, policy evaluation, renewal/issuance flow (both keygen modes), notification deduplication, team/owner/agent group CRUD, issuer service CRUD with connection testing, and the issuer connector adapter. Mock repositories are simple structs with function fields — no heavy mocking frameworks.
 
-**Handler layer tests** (`internal/api/handler/*_test.go`) — ~257 test functions across 11 files using Go's `httptest` package. Every handler file has a corresponding test file: certificates (50 tests including revocation, DER CRL, and OCSP), agents (28 tests), jobs (21 tests including approve/reject), notifications (11 tests), policies (19 tests), profiles (18 tests), issuers (17 tests), targets (17 tests), agent groups (12 tests), teams (26 tests), and owners (21 tests). Each test file follows the same pattern: a mock service struct with function fields, `httptest.NewRecorder` for capturing responses, and a shared `contextWithRequestID()` helper. Tests cover the happy path, input validation (missing fields, invalid JSON, empty IDs, name length limits), error propagation from the service layer, method-not-allowed responses, and pagination parameters.
+**Handler layer tests** (`internal/api/handler/*_test.go`) — Every handler file has a corresponding test file using Go's `httptest` package: certificates (including revocation, bulk revocation by profile/owner/agent/issuer, DER CRL, OCSP), agents, jobs (including approve/reject), notifications, policies, profiles, issuers, targets, agent groups, teams, owners, discovery, network scan, verification, export, EST, digest, stats, and metrics. Tests cover the happy path, input validation, error propagation, method-not-allowed, pagination, and bulk operation partial-failure scenarios.
 
-**Integration tests** (`internal/integration/`) — Two test files exercising the full stack from HTTP request through router, handler, service, and postgres repository layers. `lifecycle_test.go` has 11 subtests covering the complete certificate lifecycle: team/owner creation, certificate creation, issuer verification, renewal trigger, job verification, agent registration, CSR submission, deployment, and status reporting. `negative_test.go` has 14 subtests covering error paths, 19 M11b endpoint tests, and 8 revocation endpoint tests (M15a+M15b): nonexistent resource lookups (404s), invalid request bodies (malformed JSON, missing required fields), invalid CSR submission, heartbeat for nonexistent agents, wrong HTTP methods on list endpoints, empty list responses, renewal on nonexistent certificates, expired certificate lifecycle, team/owner/agent group CRUD validation, revocation success, already-revoked rejection, not-found revocation, JSON CRL retrieval, DER CRL retrieval, OCSP response retrieval, and short-lived cert exemption. Both use a shared `setupTestServer()` that builds a fully-wired server with real postgres repositories and the Local CA issuer connector. A third file, `e2e_test.go`, contains 8 cross-milestone test functions with 48+ subtests that exercise features across milestones end-to-end: M10 agent metadata via heartbeat, M11 profiles/teams/owners/agent-groups CRUD, M12 issuer registry verification, M13 GUI operation endpoints, M14 stats and metrics, M15 revocation and CRL, M16 notification channels, and M20 enhanced query API (sorting, cursor pagination, sparse fields, time-range filters).
+**Integration tests** (`internal/integration/`) — Three test files exercising the full stack from HTTP request through router, handler, service, and repository layers. `lifecycle_test.go` covers the complete certificate lifecycle (team/owner creation through deployment and status reporting). `negative_test.go` covers error paths, endpoint validation, and revocation scenarios. `e2e_test.go` exercises cross-milestone features end-to-end (agent metadata, profiles, issuer registry, GUI operations, stats, revocation, notifications, enhanced query API).
 
-**Frontend tests** (`web/src/api/client.test.ts`, `web/src/api/utils.test.ts`) — 86 Vitest tests covering the API client, stats/metrics endpoints, and utility functions. The API client tests mock `globalThis.fetch` and verify all endpoint functions (certificates, agents, jobs, policies, issuers, targets, notifications, audit, stats, metrics, health) send correct HTTP methods, URLs, headers, and request bodies. They also test API key management (store/retrieve/clear), auth header propagation, 401 event dispatching, and error handling (server messages, error fields, status text fallback). The stats/metrics endpoint tests verify correct query parameter handling and response shape validation. The utility tests use `vi.useFakeTimers()` for deterministic date testing and cover `formatDate`, `formatDateTime`, `timeAgo`, `daysUntil`, and `expiryColor`. The test environment uses jsdom with `@testing-library/jest-dom` matchers.
+**Go integration tests** (`deploy/test/integration_test.go`) — Runs against the live Docker Compose test environment with real CA backends (Local CA, Pebble ACME, step-ca). Covers health checks, agent heartbeat, issuance, renewal, revocation, CRL/OCSP, EST enrollment, S/MIME, discovery, network scanning, and deployment verification using `crypto/x509` for cert parsing and `crypto/tls` for live TLS verification.
 
-**CLI tests** (`internal/cli/client_test.go`) — 14 tests covering all 10 CLI subcommands with httptest mock servers, PEM parsing for bulk import, auth header verification, and JSON/table output formatting.
+**Frontend tests** (`web/src/api/`) — Vitest tests covering the full API client (all endpoint functions with fetch mocking), stats/metrics endpoints, utility functions, and auth flows. Test environment uses jsdom with `@testing-library/jest-dom` matchers.
 
-**CI pipeline** (`.github/workflows/ci.yml`) — Two parallel jobs: Go (build, vet, race detection, static analysis, vulnerability scanning, test with coverage, coverage threshold enforcement) and Frontend (TypeScript type check, Vitest test suite, Vite production build). The Go job runs `go test -race` on service, handler, middleware, and scheduler packages to catch data races. It runs `golangci-lint` with 11 linters (errcheck, govet, staticcheck, unused, gosimple, ineffassign, typecheck, gocritic, gosec, bodyclose, noctx) configured in `.golangci.yml`. It runs `govulncheck ./...` to scan dependencies for known CVEs. Coverage thresholds are enforced per-layer: service 60%, handler 60%, domain 40%, middleware 50%. These thresholds act as regression floors — they can only go up. Connector tests are included via `./internal/connector/issuer/...` and `./internal/connector/target/...` (covers Local CA, ACME, step-ca, NGINX, Apache, HAProxy, Traefik, and Caddy packages with unit tests for certificate signing logic, DNS solver, issuer validation, and deployment flows). The Frontend job runs `npx vitest run` between the TypeScript check and production build steps.
+**Connector tests** (`internal/connector/`) — Issuer connectors (Local CA self-signed/sub-CA modes, ACME DNS-01/DNS-PERSIST-01, step-ca, OpenSSL, Vault PKI, DigiCert, Sectigo, Google CAS, AWS ACM PCA — all with httptest mock servers or injectable interface mocks). Target connectors (NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, IIS with mock PowerShell executor, F5 BIG-IP with mock iControl client, Postfix/Dovecot, SSH with mock SSH client, Windows Certificate Store with mock PowerShell executor, Java Keystore with mock command executor, Kubernetes Secrets with mock K8s client, shared certutil package). Notifier connectors (Slack, Teams, PagerDuty, OpsGenie).
 
-**Connector tests** (`internal/connector/`) — 57 test functions covering issuer, target, and notifier connectors. The Local CA connector has tests for self-signed and sub-CA modes (RSA, ECDSA, config validation, non-CA cert rejection). The ACME DNS solver has 10 tests for script-based DNS-01 and DNS-PERSIST-01 challenges (6 DNS-01 tests + 4 DNS-PERSIST-01 tests covering `PresentPersist` success, no-script error, script failure, and wildcard domain handling). The step-ca connector has tests with a mock HTTP server for issuance, renewal, revocation, and error paths. The OpenSSL/Custom CA connector has 14 tests covering config validation, issuance success/failure/timeout, renewal, revocation, and CRL generation. The NGINX target connector has 13 tests covering config validation, certificate deployment (file writing, permissions, validate/reload commands), and deployment validation. Apache httpd and HAProxy connectors each have 3 tests covering config validation, deployment, and validation flows. Traefik and Caddy connectors have tests covering file-based deployment and (for Caddy) dual-mode API/file configuration. Notifier connector tests span 20 tests across Slack (5), Teams (4), PagerDuty (6), and OpsGenie (5) — verifying channel identity, payload formatting, HTTP error handling, connection failures, auth headers, and configuration defaults.
+**Scheduler tests** (`internal/scheduler/scheduler_test.go`) — Idempotency guards (`sync/atomic.Bool`), `WaitForCompletion` success and timeout paths, and multi-loop concurrency safety.
 
-**Scheduler tests** (`internal/scheduler/scheduler_test.go`) — Tests for idempotency guards (`sync/atomic.Bool` CompareAndSwap prevents concurrent loop ticks), `WaitForCompletion` success and timeout paths, and multi-loop idempotency.
+**Fuzz tests** (`internal/validation/`, `internal/domain/`) — Go native fuzz tests for command validation (`ValidateShellCommand`, `ValidateDomainName`, `ValidateACMEToken`) and revocation domain parsing.
 
-**Fuzz tests** (`internal/validation/command_fuzz_test.go`, `internal/domain/revocation_fuzz_test.go`) — Go native fuzz tests (`testing/fuzz`) for command validation functions and revocation domain parsing. These exercise `ValidateShellCommand`, `ValidateDomainName`, and `ValidateACMEToken` with random inputs to discover edge cases.
+**CI pipeline** (`.github/workflows/ci.yml`) — Two parallel jobs. Go: build, vet, `go test -race`, `golangci-lint` (11 linters), `govulncheck`, test with coverage, per-layer coverage threshold enforcement (service 55%, handler 60%, domain 40%, middleware 30%). Frontend: TypeScript type check, Vitest, Vite production build.
 
-**What's not tested and why:** Postgres repository implementations (`internal/repository/postgres/`) require a real database and are tested only through integration tests, not unit tests — a `testcontainers-go` scaffolding for isolated PostgreSQL instances is planned. Target connectors for F5 BIG-IP and IIS are interface stubs (implementation planned for V3). The ACME connector requires a real ACME server (tested manually against Let's Encrypt staging). These are all candidates for future expansion as the test infrastructure matures.
+For detailed test procedures, smoke tests, and the release sign-off checklist, see the [Testing Guide](testing-guide.md). For setting up the Docker Compose test environment with real CA backends, see [Test Environment](test-env.md).
 
 ## What's Next
 
@@ -954,3 +1125,5 @@ certctl uses a layered testing approach aligned with the handler → service →
 - [Compliance Mapping](compliance.md) — SOC 2, PCI-DSS 4.0, and NIST SP 800-57 alignment
 - [MCP Server Guide](mcp.md) — AI-native access to the API
 - [OpenAPI Spec](openapi.md) — Full API reference and SDK generation
+- [Testing Guide](testing-guide.md) — Test procedures and release sign-off
+- [Test Environment](test-env.md) — Docker Compose test environment setup

docs/certctl-for-cert-manager-users.md

@@ -0,0 +1,144 @@
+# certctl for cert-manager Users
+
+You run cert-manager inside Kubernetes and it works well for in-cluster certificates. But you also have VMs, bare-metal servers, network appliances, and legacy systems outside the cluster. cert-manager can't reach those. This guide shows how certctl complements cert-manager to give you unified certificate visibility and automation across your entire infrastructure.
+
+## Not a Replacement
+
+cert-manager is the right tool for in-cluster certs. It's tightly integrated with Kubernetes:
+- Native CRDs (Certificate, ClusterIssuer, Issuer)
+- Automatic cert injection into Ingress and Service objects
+- Controller-driven renewal within the cluster
+
+**certctl does not replace this.** Instead, it extends your certificate management to everything outside Kubernetes: VMs, bare metal, network appliances, Windows servers, and legacy systems.
+
+## The Problem
+
+Your setup:
+- **cert-manager**: handles all certs in Kubernetes (TLS for Ingress, service-to-service, internal services)
+- **Everything else**: NGINX/Apache on VMs, HAProxy load balancers on bare metal, network appliances, Windows servers with IIS — these are managed inconsistently. Maybe Certbot cron jobs, maybe manual renewal, maybe deprecated cert files sitting around.
+
+Result:
+- No unified visibility — you don't know when non-Kubernetes certs expire
+- Renewal failures go unnoticed until the cert is already expired
+- Audit trail fragmented across multiple tools
+- Scaling to hundreds of machines becomes impossible
+
+## The Solution
+
+Deploy certctl control plane once (Docker Compose, Kubernetes Helm chart, or self-hosted). Deploy agents on your VMs, bare metal, and network appliances. One dashboard shows:
+- **All cert-manager certs** via discovery scanning (agents find cert-manager-issued certs copied to target machines, or scan the cluster directly)
+- **All certctl-managed certs** issued by shared issuers (ACME, step-ca, Vault PKI (planned), private CA)
+- **Unified renewal and deployment** across both worlds
+- **Single pane of glass** with expiration timeline, renewal status, deployment verification, audit trail
+
+## How to Set Up
+
+### 1. Install certctl Control Plane
+
+**Option A: Docker Compose** (quickest for evaluation)
+```bash
+cd /opt/certctl
+docker compose up -d
+# Dashboard & API: http://localhost:8443
+```
+
+**Option B: Kubernetes** (recommended for prod)
+```bash
+helm install certctl deploy/helm/certctl/ \
+  --set auth.apiKey=YOUR_SECURE_KEY
+```
+
+### 2. Deploy Agents to Non-Kubernetes Infrastructure
+
+On each VM, bare-metal server, or appliance (via proxy agent):
+```bash
+# Linux amd64
+curl -sSL https://github.com/shankar0123/certctl/releases/download/v2.1.0/certctl-agent-linux-amd64 \
+  -o /usr/local/bin/certctl-agent
+chmod +x /usr/local/bin/certctl-agent
+
+# Config
+sudo tee /etc/certctl/agent.env > /dev/null <<EOF
+CERTCTL_SERVER_URL=http://certctl-control-plane:8443
+CERTCTL_API_KEY=your-api-key
+CERTCTL_DISCOVERY_DIRS=/etc/nginx/certs,/etc/ssl,/etc/letsencrypt/live
+CERTCTL_KEY_DIR=/var/lib/certctl/keys
+EOF
+sudo chmod 600 /etc/certctl/agent.env
+
+# Start
+sudo systemctl start certctl-agent
+```
+
+### 3. Enable Discovery Scanning
+
+Agents scan configured directories and report back all existing certs. In the dashboard:
+- **Discovery** page: all found certs grouped by agent
+- Claim cert-manager certs to link them with Kubernetes metadata
+- Dismiss obsolete certs
+
+### 4. Configure Shared Issuers
+
+Set up the same issuer certctl uses for non-Kubernetes certs:
+- **ACME** (Let's Encrypt, for public certs)
+- **step-ca** (Smallstep, for internal certs)
+- **Vault PKI** (HashiCorp Vault, for enterprise PKI)
+- **Private CA** (your own internal root CA)
+
+No new CA infrastructure needed. If cert-manager already uses your CA, certctl points to the same one.
+
+### 5. Create Policies for Non-Kubernetes Certs
+
+Go to **Policies** → **+ New Policy** to create enforcement rules:
+- **Name:** e.g., "VM Certificate Policy"
+- **Type:** `expiration_window` or `key_algorithm` (enforce renewal thresholds or crypto requirements)
+- **Severity:** `high`
+- **Config:** set your enforcement parameters
+
+Certificates are linked to issuers and profiles when created or claimed from discovery. Policies add guardrails — enforcing key algorithm requirements, expiration windows, and other compliance rules across your fleet.
+
+### 6. View Unified Inventory
+
+**Dashboard** shows:
+- Certificate status heatmap (all 1000 certs: cert-manager + certctl)
+- Renewal job trends (both types)
+- Expiration timeline (30/60/90 days)
+- Agent fleet status (all infrastructure)
+
+**Certificates** page filters by issuer (show me all ACME certs, or all step-ca certs):
+- cert-manager certs discovered from Kubernetes nodes
+- certctl-managed certs on VMs
+- Network appliance certs auto-discovered
+
+## Shared Infrastructure
+
+If cert-manager and certctl both use the same CA:
+- **ACME**: cert-manager uses ClusterIssuer + certctl uses ACME connector → same Let's Encrypt account, transparent coexistence
+- **step-ca**: cert-manager uses external issuer CRD + certctl uses step-ca connector → same provisioner, shared certificate inventory
+- **Vault PKI**: cert-manager uses external issuer CRD + certctl uses Vault connector → same mount, same audit trail
+
+No conflict. They just issue certs through the same CA. certctl's discovery scanning finds cert-manager-issued certs and shows them alongside certctl-managed ones.
+
+## Key Differences from cert-manager
+
+| Feature | cert-manager | certctl |
+|---------|--------------|---------|
+| Target | In-cluster (Kubernetes) | Out-of-cluster (VMs, bare metal, appliances) |
+| Configuration | CRDs (Certificate, ClusterIssuer, Issuer) | API + Dashboard (JSON REST) |
+| Deployment | Injected into Secret objects, mounted by pods | Agent pulls work, deploys via target-specific API (file, service restart, proxy agent) |
+| Renewal | Controller watches Certificate CRDs, triggers renewal when needed | Scheduler checks thresholds, agents poll for work |
+| Audit | Kubernetes event log | Immutable append-only audit trail |
+| Visibility | Per-namespace, per-resource | Fleet-wide, unified inventory |
+
+## Future Integration
+
+On the roadmap (V4): **cert-manager external issuer** — certctl acts as a ClusterIssuer backend for Kubernetes. This would allow cert-manager to request certificates from certctl, which could issue them via any of its connectors (step-ca, Vault, private CA, etc.). Pure integration play; no breaking changes.
+
+For now: cert-manager handles Kubernetes, certctl handles everything else. They coexist seamlessly.
+
+## Next Steps
+
+1. Run through the [Quick Start](./quickstart.md) for a 5-minute demo
+2. Try the [Multi-Issuer example](../examples/multi-issuer/multi-issuer.md) — manages public and internal certs from one dashboard
+3. Explore [Architecture](./architecture.md#agents) for deployment patterns
+4. Check the [Helm Chart](../deploy/helm/certctl/) for production Kubernetes deployment

docs/compliance-nist.md

@@ -72,7 +72,7 @@ certctl implements tiered key storage with different protection profiles based o
 - Configured via: `CERTCTL_CA_CERT_PATH=/path/to/ca.crt` and `CERTCTL_CA_KEY_PATH=/path/to/ca.key`
 
 **NIST Gap: HSM Storage**
-NIST SP 800-57 Part 1 recommends Hardware Security Module (HSM) storage for high-value keys (CA signing keys). certctl V2 uses filesystem storage on the server. HSM support is planned for V5 roadmap, enabling integration with:
+NIST SP 800-57 Part 1 recommends Hardware Security Module (HSM) storage for high-value keys (CA signing keys). certctl V2 uses filesystem storage on the server. HSM support is planned for certctl Pro (V3), enabling integration with:
 - AWS CloudHSM
 - Azure Dedicated HSM
 - Thales Luna, Gemalto SafeNet, YubiHSM (on-premises)
@@ -210,15 +210,17 @@ NIST SP 800-57 Part 1 Section 6.2 addresses secure key distribution to minimize
   - Proxy agent executes deployment via appliance API
 
 **Revocation Distribution**
-- Certificate Revocation List (CRL) via `GET /api/v1/crl/{issuer_id}`
-  - Returns DER-encoded X.509 CRL signed by issuing CA
+- Certificate Revocation List (CRL) via `GET /.well-known/pki/crl/{issuer_id}` (RFC 5280 §5, RFC 8615)
+  - Returns DER-encoded X.509 CRL signed by issuing CA (`Content-Type: application/pkix-crl`)
   - 24-hour validity period
   - Includes all revoked serials, reasons, and revocation timestamps
+  - Served unauthenticated so relying parties without certctl API credentials can fetch it
   - Subject to URL caching; OCSP preferred for real-time revocation
-- OCSP via `GET /api/v1/ocsp/{issuer_id}/{serial}`
-  - Returns DER-encoded OCSP response (OCSPResponse ASN.1 structure)
+- OCSP via `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (RFC 6960)
+  - Returns DER-encoded OCSP response (OCSPResponse ASN.1 structure, `Content-Type: application/ocsp-response`)
   - Signed by issuing CA (or delegated OCSP signing cert)
   - Responds with good/revoked/unknown status
+  - Served unauthenticated — the RFC 6960 relying-party model does not assume API credentials
   - Real-time, more bandwidth-efficient than CRL polling
 
 ## Revocation and Compromise (NIST SP 800-57 Part 3)
@@ -272,20 +274,23 @@ NIST SP 800-57 Part 3 covers revocation (Section 2.5) when keys are suspected co
 - OCSP responder queries revocation table in real-time
 - Short-lived certificate exemption: certs with TTL < 1 hour skip CRL/OCSP (expiry is sufficient revocation)
 
+**Bulk Revocation for Large-Scale Compromise Response** (V2.2) — NIST SP 800-57 Part 3 emphasizes rapid revocation when keys are compromised. `POST /api/v1/certificates/bulk-revoke` revokes all certificates matching filter criteria (profile, owner, agent, issuer) in a single operation. This enables operators to execute fleet-wide revocation for key compromise events affecting multiple certificates. Each bulk revocation creates individual jobs reusing the existing revocation pipeline, ensuring every certificate is recorded in the audit trail with the incident reason.
+
 **Revocation Audit Trail**
 All revocation events logged:
-- Event type: `certificate_revoked`
+- Event type: `certificate_revoked` or `bulk_revocation_initiated` (for fleet operations)
 - Actor: authenticated user or service
-- Reason code: RFC 5280 enum
+- Reason code: RFC 5280 enum (or incident justification for bulk operations)
 - Timestamp: RFC3339
 - Issuer notification status: success or error reason
+- Filter criteria: profile_id, owner_id, agent_id, issuer_id (for bulk revocation)
 
 ## Alignment Summary Table
 
 | NIST SP 800-57 Area | Status | Coverage | Notes |
 |---|---|---|---|
 | **Key Generation** | ✅ Aligned | 100% | Agent-side ECDSA P-256 using crypto/rand; server mode flagged as demo-only |
-| **Key Storage** | ⚠️ Partially Aligned | 80% | Filesystem with 0600 perms; HSM support planned V5 |
+| **Key Storage** | ⚠️ Partially Aligned | 80% | Filesystem with 0600 perms; HSM support planned V3 Pro |
 | **Cryptoperiods** | ✅ Aligned | 100% | Profile-enforced max_ttl; threshold-based renewal alerting |
 | **Key States** | ✅ Aligned | 100% | Full lifecycle tracking with immutable audit trail |
 | **Algorithms** | ✅ Aligned | 100% | NIST-approved algorithms only; post-quantum tracking in progress |
@@ -301,13 +306,14 @@ All revocation events logged:
 - [x] RFC 5280 revocation support
 - [x] Immutable audit trail
 
+### V2.2 (Planned: 2026)
+- Bulk revocation by profile/owner/agent/issuer (fleet-level revocation for incident response)
+
 ### V3 (Planned: 2026)
 - Role-based access control (limit revocation/approval to authorized operators)
-- Bulk revocation by profile/owner/agent (fleet-level revocation policy)
 
-### V5 (Planned: 2027+)
-- HSM support for CA key storage
-- PKCS#11 integration for hardware tokens
+### V3 Pro (Planned)
+- HSM support for CA key storage and agent key storage (TPM 2.0, PKCS#11)
 - FIPS 140-2/3 validated crypto module (BoringCrypto build or external FIPS library)
 - Key destruction API (explicit secure erasure of agent keys)
 - Key escrow / recovery mechanism (backup encrypted private keys for disaster recovery)

docs/compliance-pci-dss.md

@@ -92,9 +92,11 @@ Your QSA will request evidence that your certificate and key management systems
 
 - **Certificate Status Tracking** — Four statuses: Active (deployed, not yet expired), Expiring (within threshold, awaiting renewal), Expired (past not-after date), Revoked (revoked via RFC 5280 revocation API). Dashboard charts show status distribution.
 
-- **Revocation Infrastructure** (M15a, M15b):
-  - CRL endpoint: `GET /api/v1/crl` (JSON format) or `GET /api/v1/crl/{issuer_id}` (DER X.509 CRL, 24h validity, signed by issuing CA)
-  - OCSP responder: `GET /api/v1/ocsp/{issuer_id}/{serial}` (returns DER-encoded OCSP response: good/revoked/unknown)
+- **Revocation Infrastructure** (M15a, M15b, M-006):
+  - Revocation API: `POST /api/v1/certificates/{id}/revoke` with RFC 5280 reason codes
+  - CRL endpoint: `GET /.well-known/pki/crl/{issuer_id}` — DER X.509 CRL, 24h validity, signed by issuing CA, served unauthenticated (RFC 5280 §5, RFC 8615, `Content-Type: application/pkix-crl`)
+  - OCSP responder: `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` — DER-encoded OCSP response (good/revoked/unknown), served unauthenticated (RFC 6960, `Content-Type: application/ocsp-response`)
+  - Bulk revocation (V2.2): `POST /api/v1/certificates/bulk-revoke` with filter criteria (profile, owner, agent, issuer) for fleet-wide incident response
   - Short-lived cert exemption: certs with TTL < 1 hour skip CRL/OCSP (expiry is sufficient revocation)
 
 - **Stats API** (M14) — Real-time visibility:
@@ -107,7 +109,7 @@ Your QSA will request evidence that your certificate and key management systems
 - Discovered certificate report: `GET /api/v1/discovered-certificates` JSON export showing all certs on systems, fingerprints, and status.
 - Managed certificate inventory: `GET /api/v1/certificates` with filters (`?status=Expiring` for upcoming renewals).
 - Expiration alert configuration: policy JSON showing `alert_thresholds_days` for each environment.
-- CRL/OCSP availability proof: HTTP GET requests to `/api/v1/crl` and `/api/v1/ocsp/{issuer}/{serial}` with signed responses.
+- CRL/OCSP availability proof: unauthenticated HTTP GET requests to `/.well-known/pki/crl/{issuer_id}` (DER, `application/pkix-crl`) and `/.well-known/pki/ocsp/{issuer_id}/{serial}` (DER, `application/ocsp-response`) with signed responses.
 - Audit trail for certificate creation/renewal/revocation: `GET /api/v1/audit?type=certificate_issued,certificate_renewed,certificate_revoked`.
 - Dashboard charts showing expiration timeline, renewal success trends, status distribution.
 
@@ -326,11 +328,14 @@ This requirement covers key generation, storage, rotation, and destruction. Cert
   - Issuer notified (best-effort; ACME lacks standard revocation, Local CA skips issuer step).
   - Revocation notifications sent to owner via email/webhook/Slack/Teams/PagerDuty.
 
-- **CRL and OCSP Publication** (M15b) — Revoked certificates published in:
-  - CRL: `GET /api/v1/crl` (JSON format) or `GET /api/v1/crl/{issuer_id}` (DER X.509, signed by CA, 24h validity)
-  - OCSP: `GET /api/v1/ocsp/{issuer_id}/{serial}` (returns revoked status for clients validating certificate chain)
+- **CRL and OCSP Publication** (M15b, M-006) — Revoked certificates published in:
+  - CRL: `GET /.well-known/pki/crl/{issuer_id}` (DER X.509 signed by CA, 24h validity, RFC 5280 §5 + RFC 8615, `Content-Type: application/pkix-crl`)
+  - OCSP: `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (returns revoked status for clients validating certificate chain, RFC 6960, `Content-Type: application/ocsp-response`)
+  - Both endpoints are served unauthenticated so relying parties (browsers, TLS appliances) without certctl API keys can verify revocation — this is the RFC-compliant PKI model.
   - Clients checking certificate status via OCSP or CRL see revoked status within 24 hours.
 
+- **Bulk Revocation for Incident Response** (V2.2) — `POST /api/v1/certificates/bulk-revoke` with filter criteria (profile, owner, agent, issuer) revokes all matching certificates in a single operation. PCI-DSS Req 4 requires rapid response to data transmission security incidents — bulk revocation enables operators to revoke an entire certificate set (e.g., all certs used by a compromised team or endpoint) in minutes rather than hours.
+
 - **Private Key Destruction on Agent** — When certificate renewed or revoked:
   - Agent removes old private key file from `CERTCTL_KEY_DIR` when new certificate deployed.
   - Job status tracking confirms old key is no longer needed.
@@ -338,8 +343,8 @@ This requirement covers key generation, storage, rotation, and destruction. Cert
 
 **Evidence You Can Provide**:
 - Revocation requests: `GET /api/v1/audit?type=certificate_revoked` with RFC 5280 reason codes.
-- CRL publication: HTTP GET `/api/v1/crl` and parse JSON to show revoked serial numbers and timestamps.
-- OCSP responder validation: Query `GET /api/v1/ocsp/{issuer}/{serial}` for a known-revoked cert; response includes `revoked` status.
+- CRL publication: HTTP GET `/.well-known/pki/crl/{issuer_id}` (unauthenticated) returns a DER X.509 CRL — parse with `openssl crl -inform der -noout -text` to show revoked serial numbers, reasons, and timestamps.
+- OCSP responder validation: Query `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (unauthenticated) for a known-revoked cert; response includes `revoked` status and can be parsed with `openssl ocsp` tooling.
 - Audit trail: Certificate status transitions (Active → Revoked) recorded in `audit_events`.
 
 **Operator Responsibility**:
@@ -393,7 +398,7 @@ This requirement covers key generation, storage, rotation, and destruction. Cert
 
 **Operator Responsibility**:
 - **Issue API keys to users/systems** requiring API access (outside certctl; you maintain key registry).
-- **Rotate API keys periodically** (recommendation: annually, or when personnel changes).
+- **Rotate API keys using zero-downtime rotation** — `CERTCTL_AUTH_SECRET` supports comma-separated keys (e.g., `new-key,old-key`). Add the new key, migrate clients, then remove the old key. Recommendation: rotate at least annually, or immediately when personnel changes.
 - **Revoke API keys immediately** when user leaves or token is compromised (set `enabled=false` in API key management — not yet implemented in v1, owner must track manually).
 - **Enforce strong TLS** on control plane: TLS 1.2+, modern ciphers (configure on reverse proxy or `CERTCTL_TLS_*` env vars if operator-controlled).
 - **Protect `.env` and credential files** where API key is defined (restrict file system access, no version control).
@@ -452,7 +457,7 @@ This requirement covers key generation, storage, rotation, and destruction. Cert
 - **Immutable API Audit Log** (M19) — Middleware captures every API call:
   - `audit_events` table (append-only, no UPDATE/DELETE):
     - `method`: HTTP method (GET, POST, PUT, DELETE)
-    - `path`: API endpoint path (e.g., `/api/v1/certificates`)
+    - `path`: API endpoint path only, excluding query parameters (e.g., `/api/v1/certificates` — query strings intentionally omitted to prevent sensitive data persistence in the append-only audit trail)
     - `actor`: authenticated user/service (extracted from API key or context)
     - `body_hash`: SHA-256 hash of request body (truncated to 16 chars, first 8 chars shown in logs)
     - `status_code`: HTTP response status (200, 201, 400, 401, 404, 500, etc.)
@@ -717,12 +722,12 @@ This requirement covers key generation, storage, rotation, and destruction. Cert
 | PCI-DSS Requirement | certctl Feature | API/UI Evidence | Database/Config | Audit Trail | Status |
 |---|---|---|---|---|---|
 | **4.2.1** Strong Crypto | TLS cert issuance, ACME/step-ca/Local CA, RSA 2048+/ECDSA P-256 | `GET /api/v1/certificates` (key_type, key_size) | Certificate profiles | `GET /api/v1/audit?type=certificate_issued` | Available |
-| **4.2.2** Cert Inventory & Validation | Managed cert CRUD, discovery (M18b), expiration alerting, CRL/OCSP | `GET /api/v1/certificates`, `GET /api/v1/discovered-certificates`, `GET /api/v1/crl`, `GET /api/v1/ocsp/{issuer}/{serial}` | `managed_certificates`, `discovered_certificates` tables | `GET /api/v1/audit?type=certificate_*` | Available |
+| **4.2.2** Cert Inventory & Validation | Managed cert CRUD, discovery (M18b), expiration alerting, CRL/OCSP | `GET /api/v1/certificates`, `GET /api/v1/discovered-certificates`, `GET /.well-known/pki/crl/{issuer_id}`, `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (both unauthenticated, RFC 5280 / RFC 6960) | `managed_certificates`, `discovered_certificates` tables | `GET /api/v1/audit?type=certificate_*` | Available |
 | **3.6** Key Documentation | Profiles, owner/team tracking, issuer config, audit trail | `GET /api/v1/profiles`, `GET /api/v1/issuers`, certificate detail with owner/team | Profiles, certificate owner/team fields, issuer config | `GET /api/v1/audit?resource_type=certificate` | Available |
 | **3.7.1** Key Generation | Agent-side ECDSA P-256, server keygen (demo only) | Agent logs, renewal job detail, CSR audit | `CERTCTL_KEYGEN_MODE=agent` (config), job_type=AwaitingCSR | `GET /api/v1/audit?type=certificate_issued` with CSR hash | Available |
 | **3.7.2** Key Storage | Agent `/var/lib/certctl/keys` (0600), env var secrets, .env excluded | Deployment manifest (env var refs), agent key dir listing | `.env` file (git-ignored), `CERTCTL_KEY_DIR`, `CERTCTL_CA_KEY_PATH` | No API audit (keys off-platform) | Available |
 | **3.7.3** Key Rotation | Auto renewal, expiration thresholds, renewal jobs | Dashboard renewal trends, `GET /api/v1/jobs?type=Renewal`, certificate versions | Renewal policies, certificate version history | `GET /api/v1/audit?type=certificate_renewed` | Available |
-| **3.7.4** Key Destruction | Revocation API (RFC 5280), CRL/OCSP, private key cleanup | `POST /api/v1/certificates/{id}/revoke`, `GET /api/v1/crl`, OCSP endpoint | `certificate_revocations` table, CRL publication | `GET /api/v1/audit?type=certificate_revoked` | Available |
+| **3.7.4** Key Destruction | Revocation API (RFC 5280), CRL/OCSP, private key cleanup | `POST /api/v1/certificates/{id}/revoke`, unauthenticated `GET /.well-known/pki/crl/{issuer_id}` and `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` | `certificate_revocations` table, CRL publication | `GET /api/v1/audit?type=certificate_revoked` | Available |
 | **8.3** Strong Authentication | API key (SHA-256 hash, TLS), GUI login, 401 redirect | GUI login screenshot, API key auth header, TLS cert | API key hash in database | `GET /api/v1/audit` showing API calls | Available |
 | **8.6** Acct Management | Credentials out of source, .env excluded, env var config | Code review (no hardcoded secrets), `.gitignore` check | Deployment manifests showing env var refs only | No account lifecycle audit (outside scope) | Available in part |
 | **10.2** Audit Logging | API audit middleware (M19), certificate lifecycle events | `GET /api/v1/audit` with filter/pagination | `audit_events` table (every API call) | Real-time via API | Available |

docs/compliance-soc2.md

@@ -49,6 +49,7 @@ Each section includes:
 - **Configurable CORS** — API restricts cross-origin requests via `CERTCTL_CORS_ORIGINS` allowlist or wildcard. Preflight caching prevents chatty browser auth flows.
 - **Token Bucket Rate Limiting** — Per-IP rate limiting (configurable via `CERTCTL_RATE_LIMIT_RPS` / `CERTCTL_RATE_LIMIT_BURST`) returns 429 Too Many Requests with Retry-After header. Prevents credential stuffing and brute-force attacks.
 - **No Password Storage** — certctl does not store user passwords. API keys are the sole authentication mechanism. Your API key generation, distribution, and rotation policies are your responsibility (see "Operator Responsibility" below).
+- **Zero-Downtime Key Rotation** — `CERTCTL_AUTH_SECRET` accepts comma-separated keys (e.g., `new-key,old-key`). All listed keys are validated with constant-time comparison. Operators can add a new key, migrate clients, then remove the old key — no service restart required for the client migration phase. A single-key warning is logged at startup to encourage rotation configuration.
 
 **Evidence Locations**:
 
@@ -182,13 +183,14 @@ Each section includes:
 
 - **Health Endpoint** — `GET /health` returns 200 OK with service status. Consumed by Docker health checks and Kubernetes probes.
 - **Readiness Endpoint** — `GET /ready` returns 200 OK when the database is connected and migrations are applied.
-- **Background Scheduler Monitoring** — 6 background loops run on a fixed schedule:
+- **Background Scheduler Monitoring** — 7 background loops run on a fixed schedule:
   - Renewal loop: every 1 hour, scans for certificates approaching renewal threshold
   - Job processor loop: every 30 seconds, picks up pending/waiting jobs and advances their state
   - Health check loop: every 2 minutes, pings agents to detect downtime
   - Notification dispatcher loop: every 1 minute, sends queued alerts
   - Short-lived cert expiry loop: every 30 seconds, marks expired short-lived credentials
   - Network scanner loop: every 6 hours, scans enabled TLS endpoints for certificate discovery
+  - Digest emailer loop: every 24 hours, sends scheduled certificate digest email to configured recipients
   Each loop includes error handling and logs failures via structured slog.
 - **Metrics Endpoints** — Two formats for monitoring integration:
   - `GET /api/v1/metrics` — JSON object with gauges, counters, and uptime for custom dashboards
@@ -232,7 +234,7 @@ Each section includes:
 
 **certctl Implementation** (V2):
 
-- **Immutable API Audit Trail** (M19) — Every API call is recorded to `audit_events` table (append-only, no update/delete). Recorded: HTTP method, path, query parameters, actor (user/agent ID), SHA-256 hash of request body (truncated 16 chars for brevity), response status code, latency in milliseconds. Excluded paths (health, ready) are configurable. Audit records are async (non-blocking) and include a timestamp.
+- **Immutable API Audit Trail** (M19) — Every API call is recorded to `audit_events` table (append-only, no update/delete). Recorded: HTTP method, URL path (query parameters intentionally excluded — see security note), actor (user/agent ID), SHA-256 hash of request body (truncated 16 chars for brevity), response status code, latency in milliseconds. Excluded paths (health, ready) are configurable. Audit records are async (non-blocking) and include a timestamp. **Security: Query parameters are excluded from the audit path** because they may contain cursor tokens, API keys, or sensitive filter values; since the audit trail is append-only with no deletion, any sensitive data recorded would persist permanently.
 - **Audit Trail API** — `GET /api/v1/audit?actor=...&action=...&resource_id=...&created_after=...&created_before=...` allows searching for anomalous patterns (e.g., "who accessed certificate XYZ and when?", "did anyone revoke certs at 2 AM?").
 - **Expiration Threshold Alerting** — Certificate renewal policies define alert thresholds (days before expiry): default `[30, 14, 7, 0]`. When a certificate approaches a threshold, a notification is enqueued. Deduplication prevents duplicate alerts for the same cert at the same threshold. Auto status transition: cert moves to `Expiring` status at 30 days, `Expired` at 0 days.
 - **Certificate Status Auto-Transitions** — When a cert is issued, it's `Active`. As expiry approaches, status auto-transitions to `Expiring` (at 30d threshold). At expiry, status becomes `Expired`. Revoked certs move to `Revoked`. These transitions are recorded in the audit trail.
@@ -280,12 +282,13 @@ Each section includes:
   - `certificateHold` — temporary revocation (can be "unhold" by reissue)
   - `privilegeWithdrawn` — access rights revoked
   Revocation is **immediate** (no approval workflow). The certificate is marked `Revoked` in inventory, an audit event is logged, and optional issuer notification is best-effort. All revoked certs are excluded from active deployments.
-- **CRL Endpoint** — `GET /api/v1/crl` returns a JSON-formatted Certificate Revocation List (serial, reason, timestamp for each revoked cert). `GET /api/v1/crl/{issuer_id}` returns a DER-encoded X.509 CRL signed by the issuing CA (useful for legacy clients that don't support OCSP).
-- **OCSP Responder** — `GET /api/v1/ocsp/{issuer_id}/{serial}` returns a signed OCSP response indicating whether a cert is good, revoked, or unknown. Clients (browsers, TLS libraries) query this endpoint to verify cert validity in real-time.
+- **CRL Endpoint** — `GET /.well-known/pki/crl/{issuer_id}` returns a DER-encoded X.509 CRL signed by the issuing CA (RFC 5280 §5, RFC 8615, `Content-Type: application/pkix-crl`), served unauthenticated for relying parties that don't hold certctl API credentials.
+- **OCSP Responder** — `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` returns a signed OCSP response indicating whether a cert is good, revoked, or unknown (RFC 6960, `Content-Type: application/ocsp-response`). Also unauthenticated. Clients (browsers, TLS libraries) query this endpoint to verify cert validity in real-time.
 - **Revocation Notifications** — When a cert is revoked, notifications are sent to:
   - Certificate owner (email)
   - Configured webhooks (if you have a SIEM that subscribes)
   - Slack/Teams channels (if notifiers are configured)
+- **Bulk Revocation for Fleet-Wide Incidents** (V2.2) — `POST /api/v1/certificates/bulk-revoke` with filter criteria (profile, owner, agent, issuer) revokes all matching certificates in a single operation. Essential for incident response: key compromise affecting multiple certs, CA distrust events, decommissioning a team's infrastructure. Each bulk revocation creates individual jobs reusing the existing revocation pipeline, ensuring audit trail and notifications for every certificate.
 - **Short-Lived Cert Exemption** — Certificates with TTL < 1 hour (configured in profile) skip CRL/OCSP publication. Expiry is the revocation mechanism for short-lived certs (e.g., Kubernetes pod certs, session tokens).
 - **Deployment Rollback** — If a revoked cert is still deployed (shouldn't happen, but race conditions exist), operators can manually redeploy a previous version via the GUI. Rollback is audited.
 
@@ -300,7 +303,6 @@ Each section includes:
 
 **V3 Enhancement**:
 
-- **Bulk Revocation** — Revoke all certs issued by a specific profile, owner, or agent in a single API call (useful for large-scale incidents like CA compromise)
 - **Revocation Automation** — Trigger revocation based on external events (e.g., employee termination, security breach alert from CT Log monitoring)
 
 **Operator Responsibility**:
@@ -451,15 +453,15 @@ Each section includes:
 | | Metrics JSON Endpoint | `GET /api/v1/metrics` (gauges, counters, uptime) | ✅ | ✅ | Set thresholds, configure alerting |
 | | Stats API (time-series) | `GET /api/v1/stats/*` (summary, status, expiration, jobs, issuance) | ✅ | ✅ | Integrate into dashboards, SLO tracking |
 | | Structured Logging | `slog` middleware with request IDs | ✅ | ✅ | Aggregate logs to SIEM, define retention policy |
-| | Background Scheduler | 6 loops (renewal 1h, jobs 30s, health 2m, notifications 1m, short-lived 30s, network scan 6h) | ✅ | ✅ | Alert on scheduler loop failures |
+| | Background Scheduler | 7 loops (renewal 1h, jobs 30s, health 2m, notifications 1m, short-lived 30s, network scan 6h, digest 24h) | ✅ | ✅ | Alert on scheduler loop failures |
 | **CC7.2** Anomaly Detection | Immutable API Audit Trail | `internal/api/middleware/audit.go`, `GET /api/v1/audit` | ✅ | Enhanced (SIEM export) | Integrate into SIEM, search for anomalies, archive long-term |
 | | Expiration Threshold Alerting | Configurable per-policy (default 30/14/7/0 days) | ✅ | ✅ | Configure thresholds, integrate notifications |
 | | Status Auto-Transitions | Active → Expiring (30d) → Expired (0d) | ✅ | ✅ | Monitor status changes in audit trail |
 | | Notification Routing | Email, Slack, Teams, PagerDuty, OpsGenie | ✅ | ✅ | Configure notifiers, on-call integration |
 | | Deployment Rollback | Redeploy previous cert version via GUI | ✅ | ✅ | Audit rollback decisions |
 | **CC7.3** Incident Response | Revocation API (RFC 5280 reasons) | `POST /api/v1/certificates/{id}/revoke` | ✅ | Enhanced (bulk revocation) | Establish incident response policy |
-| | CRL Endpoint (JSON + DER) | `GET /api/v1/crl`, `GET /api/v1/crl/{issuer_id}` | ✅ | ✅ | Ensure CRL/OCSP accessible to all clients |
-| | OCSP Responder | `GET /api/v1/ocsp/{issuer_id}/{serial}` | ✅ | ✅ | Test revocation in staging |
+| | CRL Endpoint (DER, RFC 5280 §5) | `GET /.well-known/pki/crl/{issuer_id}` (unauthenticated, `application/pkix-crl`) | ✅ | ✅ | Ensure CRL/OCSP accessible to all clients without API keys |
+| | OCSP Responder (RFC 6960) | `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (unauthenticated, `application/ocsp-response`) | ✅ | ✅ | Test revocation in staging |
 | | Revocation Notifications | Email, webhook, Slack/Teams on revocation | ✅ | ✅ | Integrate into on-call, document justification separately |
 | | Short-Lived Cert Exemption | TTL < 1h skip CRL/OCSP | ✅ | ✅ | Configure profiles appropriately |
 | **CC7.4** Risk Mitigation | Renewal Job Tracking | Job state machine (Pending → Running → Completed/Failed) | ✅ | ✅ | Monitor renewal success rate |

docs/concepts.md

@@ -125,9 +125,9 @@ Agents also report **metadata** about themselves — their operating system, CPU
 
 ### Deployment Targets
 
-Targets are the systems where certificates actually get installed — NGINX web servers, Apache httpd servers, HAProxy load balancers, F5 BIG-IP appliances, Microsoft IIS servers. Each target type has a **connector** that knows how to deploy certificates to that specific system (e.g., writing files and reloading NGINX or Apache config, building a combined PEM for HAProxy).
+Targets are the systems where certificates actually get installed — NGINX web servers, Apache httpd servers, HAProxy load balancers, Traefik reverse proxies, Caddy servers, Envoy gateways, Postfix/Dovecot mail servers, Microsoft IIS servers, and network appliances. Each target type has a **connector** that knows how to deploy certificates to that specific system (e.g., writing files and reloading NGINX or Apache config, building a combined PEM for HAProxy).
 
-For targets where an agent runs directly on the machine (NGINX, Apache, HAProxy, IIS), the agent deploys certificates locally — no remote access needed. For network appliances where you can't install an agent (F5 BIG-IP, Palo Alto, etc.), a **proxy agent** in the same network zone picks up the deployment job and calls the appliance's API. The server never initiates outbound connections to any target.
+For targets where an agent runs directly on the machine (NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, IIS), the agent deploys certificates locally — no remote access needed. For network appliances where you can't install an agent (F5 BIG-IP, Palo Alto, etc.), a **proxy agent** in the same network zone picks up the deployment job and calls the appliance's API. The server never initiates outbound connections to any target.
 
 ## The Certificate Lifecycle
 
@@ -183,6 +183,29 @@ Profiles are managed via the API (`/api/v1/profiles`) and the GUI, and can be as
 
 For policies with `auto_renew` disabled, renewal jobs enter an **AwaitingApproval** state instead of processing immediately. An operator must explicitly approve or reject the renewal via the API or GUI. Approved jobs transition to Pending and are picked up by the scheduler. Rejected jobs are cancelled with an optional reason. This is useful for high-value certificates where you want human oversight before renewal.
 
+### Renewal Timing: Thresholds vs. ARI (RFC 9773)
+
+**Traditional approach (thresholds):** By default, certctl uses static renewal thresholds — renew a certificate at a fixed number of days before expiry (default: 30 days). This simple, predictable model works for most use cases: it avoids unnecessary renewals near expiry and gives you a predictable window to catch failures.
+
+**Advanced approach (ACME ARI):** Some Certificate Authorities support ACME Renewal Information (RFC 9773), which allows the CA to tell certctl the optimal time to renew. Instead of guessing "renew 30 days before expiry," the CA responds with a precise `suggestedWindow` containing start and end times. This is useful when:
+- The CA is performing maintenance and wants to batch renewals in a specific window
+- The CA is coordinating a mass revocation (e.g., due to a compromise) and needs to control renewal timing
+- You want to avoid thundering herd renewal spikes by accepting the CA's suggested timing
+
+**How it works:** Enable with `CERTCTL_ACME_ARI_ENABLED=true` on your ACME issuer. When a certificate approaches expiry, certctl queries the ARI endpoint with the certificate's DER encoding. The CA responds with a suggested renewal window. If the current time is within the window or past the start time, certctl renews immediately. Otherwise, it waits until the window opens.
+
+**Graceful degradation:** If your CA doesn't support ARI (returns 404 from the ARI endpoint), certctl automatically falls back to the traditional threshold-based renewal. No configuration change needed — the fallback is transparent. Errors from the CA are logged as warnings and don't block the renewal process.
+
+### Shorter Certificate Validity (45-Day and 6-Day Certs)
+
+The industry is moving toward shorter certificate lifetimes. The CA/Browser Forum's SC-081v3 ballot mandates a phased reduction: 200-day max (March 2026), 100-day max (March 2027), and 47-day max (March 2029). Let's Encrypt has already begun reducing default validity to 45 days, and offers 6-day "shortlived" certificates via ACME profile selection.
+
+certctl handles shorter-lived certificates correctly out of the box:
+
+- **45-day certs** with the default 31-day renewal window trigger renewal at day 14 — at roughly 1/3 of the cert's lifetime.
+- **6-day "shortlived" certs** are always within the renewal window. ARI (RFC 9773) is the expected renewal path for these — the CA directs timing. Short-lived certs also skip CRL/OCSP since expiry is sufficient revocation (per profile TTL < 1 hour exemption).
+- **ACME profile selection** lets you request specific certificate profiles from your CA. Set `CERTCTL_ACME_PROFILE=shortlived` to get 6-day certificates from Let's Encrypt, or `CERTCTL_ACME_PROFILE=tlsserver` for standard TLS certificates.
+
 ### Certificate Revocation
 
 When a private key is compromised, a certificate is superseded, or a service is decommissioned, you need to revoke the certificate immediately — not wait for it to expire. Revocation tells clients "stop trusting this certificate right now."
@@ -191,9 +214,11 @@ certctl implements revocation using three complementary mechanisms:
 
 **Revocation API**: `POST /api/v1/certificates/{id}/revoke` marks a certificate as revoked in the inventory, records the revocation in a dedicated `certificate_revocations` table, notifies the issuing CA (best-effort — the revocation succeeds even if the CA is unreachable), creates an audit trail entry, and sends notifications. You can specify an RFC 5280 reason code (keyCompromise, superseded, cessationOfOperation, etc.) or let it default to "unspecified."
 
-**Certificate Revocation List (CRL)**: certctl serves both a JSON-formatted CRL at `GET /api/v1/crl` and DER-encoded X.509 CRLs per issuer at `GET /api/v1/crl/{issuer_id}`. The DER CRL is signed by the issuing CA's key and has 24-hour validity — clients can download it periodically to check revocation status offline.
+**Bulk Revocation** (Fleet-Level Incident Response): For large-scale incidents like CA compromise or team infrastructure decommissioning, `POST /api/v1/certificates/bulk-revoke` revokes all certificates matching filter criteria in a single operation. Filter by profile, owner, team, agent group, or issuer to target the affected certificate set. This is essential for incident response — instead of revoking certificates one-by-one, operators can revoke an entire fleet in minutes. Bulk revocation creates individual revocation jobs that reuse the existing revocation pipeline, ensuring every certificate is audited and notifications are sent.
 
-**OCSP Responder**: For real-time revocation checking, certctl includes an embedded OCSP responder at `GET /api/v1/ocsp/{issuer_id}/{serial}`. It returns signed OCSP responses (good, revoked, or unknown) so clients can verify certificate status without downloading the full CRL.
+**Certificate Revocation List (CRL)**: certctl serves DER-encoded X.509 CRLs per issuer at `GET /.well-known/pki/crl/{issuer_id}` (RFC 5280 §5 wire format, RFC 8615 well-known namespace). The endpoint is unauthenticated so any relying party — browser, TLS client, hardware appliance — can fetch it without a certctl API key. The CRL is signed by the issuing CA's key and has 24-hour validity; clients can download it periodically to check revocation status offline. The response carries `Content-Type: application/pkix-crl`.
+
+**OCSP Responder**: For real-time revocation checking, certctl includes an embedded OCSP responder at `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (RFC 6960). Like the CRL endpoint, it is unauthenticated and returns signed OCSP responses (good, revoked, or unknown) with `Content-Type: application/ocsp-response`, so clients can verify certificate status without downloading the full CRL.
 
 Short-lived certificates (those assigned to profiles with TTL under 1 hour) are exempt from CRL and OCSP — their rapid expiry is considered sufficient revocation. This is a deliberate design choice to reduce infrastructure overhead for ephemeral machine-to-machine credentials.
 
@@ -229,7 +254,7 @@ The CLI supports both table and JSON output formats (`--format table` or `--form
 
 ### MCP Server (AI Integration)
 
-certctl includes an MCP (Model Context Protocol) server that exposes 78 MCP tools covering the REST API. This enables AI assistants like Claude, Cursor, and other MCP-compatible tools to interact with your certificate infrastructure using natural language — "show me all expiring certificates," "revoke the VPN cert," or "what agents are offline?"
+certctl includes an MCP (Model Context Protocol) server that exposes the entire REST API as MCP tools. This enables AI assistants like Claude, Cursor, and other MCP-compatible tools to interact with your certificate infrastructure using natural language — "show me all expiring certificates," "revoke the VPN cert," or "what agents are offline?"
 
 The MCP server is a separate binary (`cmd/mcp-server/`) that communicates via stdio transport and acts as a stateless HTTP proxy to the certctl REST API. It requires no additional infrastructure — just point it at your certctl server URL and API key.
 

docs/connectors.md

@@ -11,9 +11,13 @@ Connectors extend certctl to integrate with external systems for certificate iss
    - [Built-in: ACME v2 (Let's Encrypt, Sectigo, ZeroSSL)](#built-in-acme-v2-lets-encrypt-sectigo-zerossl)
    - [Built-in: step-ca (Smallstep Private CA)](#built-in-step-ca-smallstep-private-ca)
    - [OpenSSL / Custom CA](#openssl--custom-ca)
+   - [Built-in: Vault PKI](#built-in-vault-pki)
+   - [Built-in: DigiCert CertCentral](#built-in-digicert-certcentral)
+   - [Built-in: Sectigo SCM](#built-in-sectigo-scm)
+   - [Built-in: Google CAS](#built-in-google-cas)
+   - [Built-in: AWS ACM Private CA](#built-in-aws-acm-private-ca)
    - [Revocation Across Issuers](#revocation-across-issuers)
    - [EST Integration (GetCACertPEM)](#est-integration-getcacertpem)
-   - [Planned Issuers](#planned-issuers)
    - [Building a Custom Issuer](#building-a-custom-issuer)
 3. [Target Connector](#target-connector)
    - [Interface](#interface-1)
@@ -21,9 +25,15 @@ Connectors extend certctl to integrate with external systems for certificate iss
    - [Built-in: Apache httpd](#built-in-apache-httpd)
    - [Built-in: HAProxy](#built-in-haproxy)
    - [Built-in: Traefik](#built-in-traefik)
+   - [Built-in: Envoy](#built-in-envoy)
+   - [Built-in: Postfix / Dovecot](#built-in-postfix--dovecot)
    - [Built-in: Caddy](#built-in-caddy)
-   - [F5 BIG-IP (Interface Only)](#f5-big-ip-interface-only)
-   - [IIS (Interface Only, Dual-Mode)](#iis-interface-only-dual-mode)
+   - [F5 BIG-IP (Implemented)](#f5-big-ip-implemented)
+   - [IIS (Implemented, Dual-Mode)](#iis-implemented-dual-mode)
+   - [SSH (Agentless Deployment)](#ssh-agentless-deployment)
+   - [Windows Certificate Store](#windows-certificate-store)
+   - [Java Keystore (JKS / PKCS#12)](#java-keystore-jks--pkcs12)
+   - [Kubernetes Secrets](#kubernetes-secrets)
 4. [Notifier Connector](#notifier-connector)
    - [Interface](#interface-2)
 5. [Registering a Connector](#registering-a-connector)
@@ -51,8 +61,8 @@ Connectors extend certctl to integrate with external systems for certificate iss
 
 Three types of connectors:
 
-1. **Issuer Connector** — Obtains certificates from CAs (Local CA with sub-CA support, ACME with HTTP-01 + DNS-01 + DNS-PERSIST-01, step-ca, OpenSSL/Custom CA implemented; additional CA integrations planned)
-2. **Target Connector** — Deploys certificates to infrastructure (NGINX, Apache httpd, HAProxy, Traefik, Caddy implemented; F5 via proxy agent, IIS dual-mode interface only; additional cloud and network targets planned)
+1. **Issuer Connector** — Obtains certificates from CAs. 9 built-in: Local CA (self-signed + sub-CA), ACME v2 (HTTP-01, DNS-01, DNS-PERSIST-01, ARI, EAB, profile selection), step-ca, OpenSSL/Custom CA, Vault PKI, DigiCert CertCentral, Sectigo SCM, Google CAS, AWS ACM Private CA
+2. **Target Connector** — Deploys certificates to infrastructure. 14 built-in: NGINX, Apache httpd, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, IIS (local + WinRM), F5 BIG-IP (proxy agent), SSH (agentless), Windows Certificate Store, Java Keystore, Kubernetes Secrets
 3. **Notifier Connector** — Sends alerts about certificate events (Email, Webhooks, Slack, Microsoft Teams, PagerDuty, OpsGenie implemented)
 
 All connectors accept JSON configuration at initialization, support config validation, and are registered in the service layer. Issuer connectors run on the control plane; target connectors run on agents. For network appliances where agents can't be installed, a **proxy agent** in the same network zone handles deployment — the server never initiates outbound connections.
@@ -145,7 +155,11 @@ The Local CA issuer signs certificates using Go's `crypto/x509` library. It supp
 
 **Sub-CA mode:** Loads a CA certificate and private key from disk (`CERTCTL_CA_CERT_PATH` + `CERTCTL_CA_KEY_PATH`). The CA cert is signed by an upstream CA (e.g., ADCS), so all issued certificates chain to the enterprise root trust hierarchy. Clients that already trust the enterprise root automatically trust certctl-issued certs. Supports RSA, ECDSA, and PKCS#8 key formats. If the paths are not set, falls back to self-signed mode. The loaded certificate must have `IsCA=true` and `KeyUsageCertSign`.
 
-**CRL and OCSP support (M15b):** The Local CA supports DER-encoded X.509 CRL generation via `GET /api/v1/crl/{issuer_id}` with 24-hour validity. An embedded OCSP responder at `GET /api/v1/ocsp/{issuer_id}/{serial}` returns signed OCSP responses for issued certificates (good/revoked/unknown status). Certificates with profile TTL < 1 hour automatically skip CRL/OCSP — expiry is treated as sufficient revocation for short-lived credentials.
+**CRL and OCSP support (M15b):** The Local CA supports DER-encoded X.509 CRL generation served unauthenticated at `GET /.well-known/pki/crl/{issuer_id}` (RFC 5280 §5, RFC 8615, `Content-Type: application/pkix-crl`) with 24-hour validity. An embedded OCSP responder at `GET /.well-known/pki/ocsp/{issuer_id}/{serial}` (RFC 6960, `Content-Type: application/ocsp-response`) returns signed OCSP responses for issued certificates (good/revoked/unknown status). Both endpoints are reachable by relying parties with no certctl API credentials, which is how standard TLS clients, browsers, and hardware appliances consume these resources. Certificates with profile TTL < 1 hour automatically skip CRL/OCSP — expiry is treated as sufficient revocation for short-lived credentials.
+
+**Extended Key Usage (EKU) support (M27):** The Local CA respects EKU constraints from certificate profiles and adjusts key usage flags accordingly. For S/MIME certificates (emailProtection EKU), it uses `DigitalSignature | ContentCommitment` instead of the TLS default. For TLS certificates (serverAuth/clientAuth EKU), it uses `DigitalSignature | KeyEncipherment`. This enables support for multiple certificate types — TLS, S/MIME, code signing, timestamping — from a single CA.
+
+**MaxTTL enforcement (M11c):** When a certificate profile defines a maximum TTL, the Local CA caps the `NotAfter` field to `min(validity_days, maxTTL)`. This ensures certificates never exceed the profile's configured lifetime regardless of the issuer's `validity_days` setting.
 
 Configuration:
 ```json
@@ -169,6 +183,8 @@ The ACME connector implements the full ACME v2 protocol using Go's `golang.org/x
 
 **DNS-PERSIST-01 (standing record):** Creates a one-time persistent TXT record at `_validation-persist.<domain>` containing the CA's issuer domain and your ACME account URI. Once set, this record authorizes unlimited future certificate issuances without per-renewal DNS updates. Based on [draft-ietf-acme-dns-persist](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist/) and CA/Browser Forum ballot SC-088v3. If the CA doesn't offer dns-persist-01 yet, the connector falls back to dns-01 automatically.
 
+**ACME Renewal Information (ARI, RFC 9773):** Instead of using fixed renewal thresholds (e.g., renew 30 days before expiry), certctl can ask the CA when it should renew. Enable with `CERTCTL_ACME_ARI_ENABLED=true`. The ARI protocol lets the CA specify a `suggestedWindow` (start and end times) for when you should renew — useful for distributing load during maintenance windows or coordinating mass revocation scenarios. Cert ID is computed as `base64url(SHA-256(DER cert))`. If the CA doesn't support ARI (404 response), certctl automatically falls back to threshold-based renewal with no operator intervention required.
+
 HTTP-01 configuration:
 ```json
 {
@@ -237,6 +253,9 @@ Environment variables for the default ACME connector:
 - `CERTCTL_ACME_DNS_PRESENT_SCRIPT` — Path to DNS record creation script (dns-01 and dns-persist-01)
 - `CERTCTL_ACME_DNS_CLEANUP_SCRIPT` — Path to DNS record cleanup script (dns-01 only, not used by dns-persist-01)
 - `CERTCTL_ACME_DNS_PERSIST_ISSUER_DOMAIN` — CA issuer domain for persistent record (dns-persist-01 only, e.g., `letsencrypt.org`)
+- `CERTCTL_ACME_PROFILE` — Certificate profile for the newOrder request. Let's Encrypt supports `tlsserver` (standard TLS, default) and `shortlived` (6-day certs). Leave empty for the CA's default profile.
+
+**Certificate Profiles:** Let's Encrypt (GA January 2026) supports ACME certificate profile selection. Set `CERTCTL_ACME_PROFILE=shortlived` to request 6-day certificates — ideal for ephemeral workloads where short validity substitutes for revocation. The `tlsserver` profile produces standard TLS certificates. When the profile field is empty (default), the CA uses its default profile, maintaining full backward compatibility.
 
 The connector is registered in the issuer registry under `iss-acme-staging` and `iss-acme-prod`. Use `iss-acme-staging` for Let's Encrypt staging (rate-limit-friendly testing) and `iss-acme-prod` for production certificates.
 
@@ -268,7 +287,9 @@ Environment variables:
 
 The connector is registered in the issuer registry under `iss-stepca`. step-ca also works with the existing ACME connector (point `iss-acme-*` at step-ca's ACME directory URL for ACME-based issuance).
 
-**Note:** step-ca-issued certificates rely on step-ca's own CRL/OCSP infrastructure. certctl's local CRL/OCSP endpoints (`GET /api/v1/crl/{issuer_id}` and `GET /api/v1/ocsp/{issuer_id}/{serial}`) are populated from step-ca's revocation data if available, but clients should validate against step-ca's endpoints for the authoritative status.
+**Note:** step-ca-issued certificates rely on step-ca's own CRL/OCSP infrastructure. certctl's local CRL/OCSP endpoints (`GET /.well-known/pki/crl/{issuer_id}` and `GET /.well-known/pki/ocsp/{issuer_id}/{serial}`, served unauthenticated per RFC 5280 §5 / RFC 6960 / RFC 8615) are populated from step-ca's revocation data if available, but clients should validate against step-ca's endpoints for the authoritative status.
+
+**MaxTTL enforcement (M11c):** When a certificate profile defines a maximum TTL, the step-ca connector caps the `NotAfter` field to ensure the issued certificate does not exceed the profile limit, regardless of the step-ca provisioner's own maximum.
 
 Location: `internal/connector/issuer/stepca/stepca.go`
 
@@ -284,7 +305,7 @@ Script-based issuer connector for organizations with existing CA tooling. Delega
 | `CERTCTL_OPENSSL_CRL_SCRIPT` | No | Script that outputs DER-encoded CRL on stdout |
 | `CERTCTL_OPENSSL_TIMEOUT_SECONDS` | No | Script execution timeout (default: 30s) |
 
-The sign script receives the CSR PEM on stdin and should output the signed certificate PEM on stdout. The connector parses the certificate to extract serial number, validity dates, and chain information.
+The sign script receives the CSR PEM on stdin and should output the signed certificate PEM on stdout. The connector parses the certificate to extract serial number, validity dates, and chain information. Before shell execution, serial numbers are validated as hex-only (`^[0-9a-fA-F]+$`) and revocation reason codes are validated against the RFC 5280 specification to prevent command injection.
 
 ### Revocation Across Issuers
 
@@ -297,29 +318,197 @@ Each issuer handles revocation differently:
 - **step-ca**: Calls step-ca's `/revoke` API endpoint. Clients should check step-ca's own CRL/OCSP for authoritative status.
 - **OpenSSL/Custom CA**: Invokes the configured revoke script (`CERTCTL_OPENSSL_REVOKE_SCRIPT`) with the serial number as an argument.
 
-### EST Integration (GetCACertPEM)
+### EST/SCEP Integration (GetCACertPEM)
 
-The `GetCACertPEM()` method returns the PEM-encoded CA certificate chain, used by the EST server's `/.well-known/est/cacerts` endpoint (RFC 7030) to distribute the CA chain to enrolling devices. Each issuer handles this differently:
+The `GetCACertPEM()` method returns the PEM-encoded CA certificate chain, used by both the EST server's `/.well-known/est/cacerts` endpoint (RFC 7030) and the SCEP server's `GetCACert` operation (RFC 8894) to distribute the CA chain to enrolling devices. Each issuer handles this differently:
 
-- **Local CA**: Returns the CA certificate PEM (self-signed or sub-CA cert). This is the primary EST issuer.
+- **Local CA**: Returns the CA certificate PEM (self-signed or sub-CA cert). This is the primary EST/SCEP issuer.
 - **ACME**: Returns error — ACME CAs provide chains per-issuance, not statically.
 - **step-ca**: Returns error — step-ca serves its own `/root` endpoint for CA distribution.
 - **OpenSSL/Custom CA**: Returns error — custom script-based CAs have no CA cert access through certctl.
 
-Note: EST (Enrollment over Secure Transport) is not a connector — it's a protocol handler (`internal/api/handler/est.go`) that delegates certificate issuance to whichever issuer connector is configured via `CERTCTL_EST_ISSUER_ID`. See the [Architecture Guide](architecture.md#est-server-rfc-7030) for details.
+Note: EST and SCEP are not connectors — they are protocol handlers (`internal/api/handler/est.go` and `internal/api/handler/scep.go`) that delegate certificate issuance to whichever issuer connector is configured via `CERTCTL_EST_ISSUER_ID` or `CERTCTL_SCEP_ISSUER_ID`. Both share a common `internal/pkcs7` package for PKCS#7 response encoding. See the [Architecture Guide](architecture.md#est-server-rfc-7030) for details.
 
-### Planned Issuers
+### Built-in: Vault PKI
 
-The following issuer connectors are planned for future milestones:
+The Vault PKI connector integrates with HashiCorp Vault's PKI secrets engine using its native `/sign` API with token-based authentication. This is ideal for organizations using Vault as their internal certificate authority — synchronous issuance without the complexity of ACME or challenge solving.
 
-- **Vault PKI** — HashiCorp Vault's PKI secrets engine for organizations using Vault as their internal CA (planned for V4.0+).
-- **DigiCert** — Commercial CA integration via DigiCert's REST API (planned).
+**Configuration:**
 
-Note: ADCS (Active Directory Certificate Services) integration is handled via the **sub-CA mode** of the Local CA issuer, not as a separate connector. certctl operates as a subordinate CA with its signing certificate issued by ADCS, so all certctl-issued certs chain to the enterprise ADCS root. See the Local CA section above.
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_VAULT_ADDR` | — | Vault server address (e.g., `https://vault.internal:8200`) |
+| `CERTCTL_VAULT_TOKEN` | — | Vault auth token with permissions on the PKI mount |
+| `CERTCTL_VAULT_MOUNT` | `pki` | PKI secrets engine mount path |
+| `CERTCTL_VAULT_ROLE` | — | PKI role name for certificate signing |
+| `CERTCTL_VAULT_TTL` | `8760h` | Certificate validity period (TTL) |
+
+The connector is registered in the issuer registry under `iss-vault`. Vault issues certificates synchronously via the `/v1/{mount}/sign/{role}` API with `X-Vault-Token` header authentication. The issued certificate is parsed to extract serial number, validity dates, and chain information.
+
+**Note:** CRL and OCSP are managed by Vault itself. Clients should validate certificate status against Vault's own CRL/OCSP endpoints (`GET /v1/{mount}/crl` and Vault's OCSP responder). certctl does not generate local CRL/OCSP for Vault-issued certificates. Revocation is recorded locally but Vault is the authoritative source.
+
+**MaxTTL enforcement (M11c):** When a certificate profile defines a maximum TTL, the Vault connector overrides the TTL string in the signing request to ensure the issued certificate does not exceed the profile limit. This is applied before Vault's own role-level max TTL.
+
+Location: `internal/connector/issuer/vault/vault.go`
+
+### Built-in: DigiCert CertCentral
+
+The DigiCert connector integrates with DigiCert's CertCentral REST API for ordering and managing certificates from DigiCert's commercial CA. It supports both Domain Validated (DV) and Organization/Extended Validated (OV/EV) certificates, with async order processing.
+
+**Configuration:**
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_DIGICERT_API_KEY` | — | DigiCert API key (X-DC-DEVKEY header) |
+| `CERTCTL_DIGICERT_ORG_ID` | — | DigiCert organization ID |
+| `CERTCTL_DIGICERT_PRODUCT_TYPE` | `ssl_basic` | Certificate product (e.g., `ssl_basic`, `ssl_plus`, `ssl_ev`) |
+| `CERTCTL_DIGICERT_BASE_URL` | `https://www.digicert.com/services/v2` | DigiCert API base URL |
+
+The connector submits certificate orders to DigiCert's `/order/certificate/create` API. DV certificates may issue immediately; OV/EV certificates require validation (handled by DigiCert) and poll-based completion. The connector periodically checks order status via `/order/certificate/{order_id}` until the certificate is available.
+
+**Authentication:** API key passed via `X-DC-DEVKEY` header, with organization ID in request body.
+
+**Note:** CRL and OCSP are managed by DigiCert. Clients should validate certificate status against DigiCert's infrastructure. certctl records the revocation locally but does not notify DigiCert for revocation — use DigiCert's dashboard for revocation management.
+
+Location: `internal/connector/issuer/digicert/digicert.go`
+
+### Built-in: Sectigo SCM
+
+The Sectigo connector integrates with Sectigo Certificate Manager's REST API for ordering and managing DV, OV, and EV certificates. Like DigiCert, it uses an async order model: submit an enrollment, receive an sslId, then poll for completion.
+
+**Configuration:**
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_SECTIGO_CUSTOMER_URI` | — | Sectigo customer URI (organization identifier) |
+| `CERTCTL_SECTIGO_LOGIN` | — | API account login |
+| `CERTCTL_SECTIGO_PASSWORD` | — | API account password |
+| `CERTCTL_SECTIGO_ORG_ID` | — | Organization ID (integer) |
+| `CERTCTL_SECTIGO_CERT_TYPE` | — | Certificate type ID (integer, from `/ssl/v1/types`) |
+| `CERTCTL_SECTIGO_TERM` | `365` | Certificate validity in days |
+| `CERTCTL_SECTIGO_BASE_URL` | `https://cert-manager.com/api` | Sectigo API base URL |
+
+The connector submits certificate enrollments to Sectigo's `/ssl/v1/enroll` API. DV certificates may issue immediately; OV/EV certificates require validation (handled by Sectigo) and poll-based completion. The connector periodically checks enrollment status via `/ssl/v1/{sslId}` and downloads the PEM bundle via `/ssl/v1/collect/{sslId}/pem` when issued.
+
+**Authentication:** Three custom headers on every request — `customerUri`, `login`, and `password`.
+
+**Note:** CRL and OCSP are managed by Sectigo. certctl records revocations locally and notifies Sectigo via `/ssl/v1/revoke/{sslId}`.
+
+Location: `internal/connector/issuer/sectigo/sectigo.go`
+
+### Built-in: Google CAS
+
+Google Cloud Certificate Authority Service — managed private CA on GCP. Synchronous issuance via CAS REST API with OAuth2 service account auth.
+
+| Setting | Required | Default | Description |
+|---------|----------|---------|-------------|
+| `CERTCTL_GOOGLE_CAS_PROJECT` | Yes | — | GCP project ID |
+| `CERTCTL_GOOGLE_CAS_LOCATION` | Yes | — | GCP region (e.g., `us-central1`) |
+| `CERTCTL_GOOGLE_CAS_CA_POOL` | Yes | — | CA pool name |
+| `CERTCTL_GOOGLE_CAS_CREDENTIALS` | Yes | — | Path to service account JSON |
+| `CERTCTL_GOOGLE_CAS_TTL` | No | `8760h` | Default certificate TTL |
+
+**Authentication:** OAuth2 service account. The connector reads a service account JSON file, signs a JWT with the private key, and exchanges it for an access token at Google's token endpoint. Tokens are cached and refreshed automatically (5 min before expiry).
+
+**Note:** CRL and OCSP are managed by Google CAS directly. certctl records revocations locally and notifies Google CAS via the revoke endpoint.
+
+Location: `internal/connector/issuer/googlecas/googlecas.go`
+
+### Built-in: AWS ACM Private CA
+
+AWS Certificate Manager Private Certificate Authority — managed private CA on AWS. Synchronous issuance via ACM PCA API with standard AWS credential chain (env vars, IAM roles, instance profiles, SSO).
+
+| Setting | Required | Default | Description |
+|---------|----------|---------|-------------|
+| `CERTCTL_AWS_PCA_REGION` | Yes | — | AWS region (e.g., `us-east-1`) |
+| `CERTCTL_AWS_PCA_CA_ARN` | Yes | — | ARN of the ACM Private CA |
+| `CERTCTL_AWS_PCA_SIGNING_ALGORITHM` | No | `SHA256WITHRSA` | Signing algorithm |
+| `CERTCTL_AWS_PCA_VALIDITY_DAYS` | No | `365` | Certificate validity in days |
+| `CERTCTL_AWS_PCA_TEMPLATE_ARN` | No | — | Optional certificate template ARN |
+
+**Supported signing algorithms:** SHA256WITHRSA, SHA384WITHRSA, SHA512WITHRSA, SHA256WITHECDSA, SHA384WITHECDSA, SHA512WITHECDSA.
+
+**Authentication:** Standard AWS credential chain. The connector uses `aws-sdk-go-v2/config.LoadDefaultConfig()` which supports environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), IAM roles (EC2/ECS), instance profiles, and SSO credentials.
+
+**Note:** CRL and OCSP are managed by AWS ACM PCA directly. certctl records revocations locally and notifies AWS via the RevokeCertificate API with RFC 5280 reason mapping.
+
+Location: `internal/connector/issuer/awsacmpca/awsacmpca.go`
+
+### Built-in: Entrust Certificate Services
+
+Entrust CA Gateway REST API with mutual TLS (mTLS) client certificate authentication. Supports synchronous issuance (200 OK with PEM) and approval-pending flows (201 Accepted with async polling).
+
+| Setting | Required | Default | Description |
+|---------|----------|---------|-------------|
+| `CERTCTL_ENTRUST_API_URL` | Yes | — | Entrust CA Gateway base URL |
+| `CERTCTL_ENTRUST_CLIENT_CERT_PATH` | Yes | — | Path to mTLS client certificate PEM |
+| `CERTCTL_ENTRUST_CLIENT_KEY_PATH` | Yes | — | Path to mTLS client private key PEM |
+| `CERTCTL_ENTRUST_CA_ID` | Yes | — | Certificate Authority ID (from `GET /certificate-authorities`) |
+| `CERTCTL_ENTRUST_PROFILE_ID` | No | — | Optional enrollment profile ID |
+
+**Authentication:** Mutual TLS — the client certificate and key are loaded via `tls.LoadX509KeyPair()` and attached to the HTTP transport. No API key or token required.
+
+**Issuance model:** Enrollment via `POST /v1/certificate-authorities/{caId}/enrollments`. Returns 200 with PEM immediately for auto-approved enrollments, or 201 Accepted with a tracking ID for approval-pending orders. `GetOrderStatus` polls the enrollment endpoint.
+
+**Note:** CRL and OCSP are managed by Entrust. certctl records revocations locally and notifies Entrust via `PUT /v1/certificate-authorities/{caId}/certificates/{serial}/revoke`.
+
+Location: `internal/connector/issuer/entrust/entrust.go`
+
+### Built-in: GlobalSign Atlas HVCA
+
+GlobalSign Atlas High Volume CA REST API with dual authentication: mTLS for the TLS handshake and API key/secret headers for request authorization. Region-aware base URLs (EMEA, APAC, Americas).
+
+| Setting | Required | Default | Description |
+|---------|----------|---------|-------------|
+| `CERTCTL_GLOBALSIGN_API_URL` | Yes | — | Atlas HVCA API URL (region-specific) |
+| `CERTCTL_GLOBALSIGN_API_KEY` | Yes | — | API key for request authentication |
+| `CERTCTL_GLOBALSIGN_API_SECRET` | Yes | — | API secret for request authentication |
+| `CERTCTL_GLOBALSIGN_CLIENT_CERT_PATH` | Yes | — | Path to mTLS client certificate PEM |
+| `CERTCTL_GLOBALSIGN_CLIENT_KEY_PATH` | Yes | — | Path to mTLS client private key PEM |
+| `CERTCTL_GLOBALSIGN_SERVER_CA_PATH` | No | system trust store | PEM bundle used to verify the Atlas API server certificate. Set this for private/lab Atlas deployments whose server TLS chain is not in the host's default trust bundle. |
+
+**Authentication:** Dual — mTLS client certificate for TLS handshake plus `X-API-Key` and `X-API-Secret` headers on every request.
+
+**TLS verification:** The connector always verifies the server certificate. When `server_ca_path` is set, the PEM bundle at that path is used as the trust anchor; otherwise the host's system trust store is used. TLS 1.2 is the minimum protocol version.
+
+**Issuance model:** `POST /v2/certificates` returns a serial number. Certificate PEM is available after validation completes. Typically resolves within seconds for DV. `GetOrderStatus` polls the certificate endpoint.
+
+**Note:** CRL and OCSP are managed by GlobalSign. certctl records revocations locally and notifies GlobalSign via `PUT /v2/certificates/{serial}/revoke`.
+
+Location: `internal/connector/issuer/globalsign/globalsign.go`
+
+### Built-in: EJBCA (Keyfactor)
+
+EJBCA REST API for self-hosted open-source and enterprise CAs. Supports dual authentication: mTLS (default) or OAuth2 Bearer token, selectable via configuration.
+
+| Setting | Required | Default | Description |
+|---------|----------|---------|-------------|
+| `CERTCTL_EJBCA_API_URL` | Yes | — | EJBCA REST API base URL |
+| `CERTCTL_EJBCA_AUTH_MODE` | No | `mtls` | Auth mode: `mtls` or `oauth2` |
+| `CERTCTL_EJBCA_CLIENT_CERT_PATH` | mTLS | — | Path to client certificate PEM (mTLS mode) |
+| `CERTCTL_EJBCA_CLIENT_KEY_PATH` | mTLS | — | Path to client key PEM (mTLS mode) |
+| `CERTCTL_EJBCA_TOKEN` | OAuth2 | — | Bearer token (oauth2 mode) |
+| `CERTCTL_EJBCA_CA_NAME` | Yes | — | EJBCA CA name |
+| `CERTCTL_EJBCA_CERT_PROFILE` | No | — | EJBCA certificate profile |
+| `CERTCTL_EJBCA_EE_PROFILE` | No | — | EJBCA end-entity profile |
+
+**Authentication:** Configurable via `auth_mode`. In mTLS mode, client certificate and key are loaded for the TLS handshake. In OAuth2 mode, the token is sent as `Authorization: Bearer {token}`.
+
+**Issuance model:** `POST /v1/certificate/pkcs10enroll` with base64-encoded CSR. Returns base64-encoded certificate PEM. EJBCA 9.3+ creates end-entity and issues cert in a single call. Approval-pending enrollments return 201.
+
+**Revocation note:** EJBCA requires both issuer DN and serial number for revocation. The connector stores these as a composite `OrderID` in `issuer_dn::serial` format.
+
+**Note:** CRL and OCSP are managed by the EJBCA instance. certctl records revocations locally and notifies EJBCA via `PUT /v1/certificate/{issuer_dn}/{serial}/revoke`.
+
+Location: `internal/connector/issuer/ejbca/ejbca.go`
+
+### ADCS Integration
+
+Active Directory Certificate Services integration is handled via the **sub-CA mode** of the Local CA issuer, not as a separate connector. certctl operates as a subordinate CA with its signing certificate issued by ADCS, so all certctl-issued certs chain to the enterprise ADCS root. See the Local CA section above.
 
 ### Building a Custom Issuer
 
-Here's the structure for a HashiCorp Vault PKI issuer:
+Here's a simplified example showing the connector pattern (using a hypothetical Vault-like CA):
 
 ```go
 package vault
@@ -543,51 +732,334 @@ When `mode` is `"api"`, the connector posts the certificate to the admin API end
 
 Location: `internal/connector/target/caddy/caddy.go`
 
-### F5 BIG-IP (Interface Only)
+### Built-in: Envoy
 
-The F5 BIG-IP target connector interface is defined with the iControl REST flow mapped out, but the actual API calls are not yet implemented. F5 appliances can't run agents directly, so this connector uses the **proxy agent pattern**: a designated agent in the same network zone picks up F5 deployment jobs and calls the iControl REST API. The server assigns the work; the proxy agent executes it.
+The Envoy connector uses file-based certificate delivery — it writes certificate and key files to a directory that Envoy watches via its SDS (Secret Discovery Service) file-based configuration or static `filename` references in the bootstrap config. When files change, Envoy automatically picks up the new certificates without requiring a reload command.
 
-The planned flow is: authenticate via `POST /mgmt/shared/authn/login`, upload cert PEM via `POST /mgmt/tm/ltm/certificate`, update the SSL profile via `PATCH /mgmt/tm/ltm/profile/client-ssl/{profile}`, and validate deployment by checking profile status.
+Configuration:
+```json
+{
+  "cert_dir": "/etc/envoy/certs",
+  "cert_filename": "cert.pem",
+  "key_filename": "key.pem",
+  "chain_filename": "chain.pem",
+  "sds_config": true
+}
+```
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `cert_dir` | string | (required) | Directory where Envoy watches for certificate files |
+| `cert_filename` | string | `cert.pem` | Filename for the certificate (leaf + chain unless `chain_filename` is set) |
+| `key_filename` | string | `key.pem` | Filename for the private key |
+| `chain_filename` | string | (empty) | If set, chain is written to a separate file instead of appended to the cert |
+| `sds_config` | bool | `false` | If true, writes an `sds.json` file for Envoy's file-based SDS provider |
+
+When `sds_config` is `true`, the connector writes an SDS JSON file (`{cert_dir}/sds.json`) containing a `tls_certificate` resource that points to the cert and key file paths. Envoy's file-based SDS (`path_config_source`) watches this file for changes, providing automatic hot-reload of certificates. This is the recommended approach for production Envoy deployments using dynamic TLS configuration.
+
+When `sds_config` is `false` (the default), the connector simply writes cert and key files. Use this mode when Envoy's bootstrap config references the cert/key files directly via static `filename` fields in the TLS context.
+
+Location: `internal/connector/target/envoy/envoy.go`
+
+### Built-in: Postfix / Dovecot
+
+The Postfix/Dovecot connector is a dual-mode mail server TLS connector. It writes certificate, key, and chain files to configured paths and reloads the mail service. The `mode` field selects between Postfix MTA and Dovecot IMAP/POP3, which determines default file paths and reload commands.
+
+This connector pairs with certctl's S/MIME certificate support (email protection EKU, email SAN routing) for a complete email infrastructure story — TLS for transport encryption, S/MIME for end-to-end message signing and encryption.
+
+**Postfix configuration:**
+```json
+{
+  "mode": "postfix",
+  "cert_path": "/etc/postfix/certs/cert.pem",
+  "key_path": "/etc/postfix/certs/key.pem",
+  "chain_path": "/etc/postfix/certs/chain.pem",
+  "reload_command": "postfix reload",
+  "validate_command": "postfix check"
+}
+```
+
+**Dovecot configuration:**
+```json
+{
+  "mode": "dovecot",
+  "cert_path": "/etc/dovecot/certs/cert.pem",
+  "key_path": "/etc/dovecot/certs/key.pem",
+  "chain_path": "/etc/dovecot/certs/chain.pem",
+  "reload_command": "doveadm reload",
+  "validate_command": "doveconf -n"
+}
+```
+
+| Field | Type | Default (Postfix) | Default (Dovecot) | Description |
+|-------|------|-------------------|-------------------|-------------|
+| `mode` | string | `postfix` | `dovecot` | Service mode — determines defaults |
+| `cert_path` | string | `/etc/postfix/certs/cert.pem` | `/etc/dovecot/certs/cert.pem` | Path for certificate file |
+| `key_path` | string | `/etc/postfix/certs/key.pem` | `/etc/dovecot/certs/key.pem` | Path for private key (0600 permissions) |
+| `chain_path` | string | (empty) | (empty) | If set, chain written separately; otherwise appended to cert |
+| `reload_command` | string | `postfix reload` | `doveadm reload` | Command to reload the mail service |
+| `validate_command` | string | `postfix check` | `doveconf -n` | Optional config validation before reload |
+
+All commands are validated against shell injection via `validation.ValidateShellCommand()`. File permissions: cert/chain 0644, key 0600.
+
+Location: `internal/connector/target/postfix/postfix.go`
+
+### F5 BIG-IP (Implemented)
+
+The F5 BIG-IP target connector deploys certificates to F5 load balancers via the iControl REST API. F5 appliances can't run agents directly, so this connector uses the **proxy agent pattern**: a designated certctl agent in the same network zone polls for F5 deployment jobs and executes iControl REST calls on behalf of the control plane. Minimum supported BIG-IP version: 12.0+.
+
+The deployment flow uses F5's transaction API for atomic updates: authenticate via token auth, upload cert/key/chain PEM files, install as crypto objects, update the SSL client profile within a transaction, and commit. If the transaction fails, F5 rolls back automatically and the connector cleans up uploaded crypto objects. Updating an SSL profile automatically takes effect on all bound virtual servers — no separate virtual server binding step is needed.
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `host` | string | *(required)* | F5 BIG-IP management hostname or IP |
+| `port` | int | `443` | iControl REST API port |
+| `username` | string | *(required)* | Administrative username |
+| `password` | string | *(required)* | Administrative password |
+| `partition` | string | `Common` | F5 partition for crypto objects and profiles |
+| `ssl_profile` | string | *(required)* | SSL client profile name to update |
+| `insecure` | bool | `true` | Skip TLS verification for management interface (self-signed certs common) |
+| `timeout` | int | `30` | HTTP timeout in seconds |
 
-Configuration (defined, not yet functional):
 ```json
 {
   "host": "f5.internal.example.com",
+  "port": 443,
   "username": "admin",
   "password": "...",
   "partition": "Common",
-  "ssl_profile": "/Common/clientssl_api"
+  "ssl_profile": "clientssl_api",
+  "insecure": true,
+  "timeout": 30
 }
 ```
 
-Note: F5 credentials are stored on the proxy agent, not on the control plane server. This limits the credential blast radius to the proxy agent's network zone.
+F5 credentials are stored on the proxy agent, not on the control plane server. This limits the credential blast radius to the proxy agent's network zone. Config fields are validated against regex patterns to prevent injection.
 
 Location: `internal/connector/target/f5/f5.go`
 
-### IIS (Interface Only, Dual-Mode)
+### IIS (Implemented, Dual-Mode)
 
-The IIS target connector supports two planned deployment modes:
+The IIS target connector supports two deployment modes — agent-local (recommended) and proxy agent WinRM for agentless targets.
 
-**Agent-local (recommended):** A Windows agent runs directly on the IIS server and deploys certificates using PowerShell — `Import-PfxCertificate` to install into the certificate store and `Set-WebBinding` to bind to the IIS site. This is the preferred approach: no remote access needed, no credential management, same pull-based model as NGINX/Apache/HAProxy.
+**Agent-local (recommended):** A Windows agent runs directly on the IIS server and deploys certificates using PowerShell — `Import-PfxCertificate` to install into the certificate store and `Set-WebBinding` to bind to the IIS site. The agent handles PEM-to-PFX conversion via `go-pkcs12`, computes SHA-1 thumbprint from the certificate, and executes parameterized PowerShell scripts for injection-safe binding management. This is the preferred approach: no remote access needed, no credential management, same pull-based model as NGINX/Apache/HAProxy.
 
-**Proxy agent WinRM (for agentless targets):** For Windows servers where you don't want to install an agent, a nearby Windows agent acts as a proxy and reaches the IIS box via WinRM. The proxy agent picks up the deployment job, transfers the PFX bundle over WinRM, and runs the PowerShell commands remotely. WinRM credentials are stored on the proxy agent, not on the control plane.
+**Proxy agent WinRM (for agentless targets):** For Windows servers where you don't want to install an agent, a Linux or Windows proxy agent in the same network zone connects via WinRM (Windows Remote Management) and executes PowerShell commands remotely. The PFX bundle is base64-encoded, transferred inline in the WinRM session, decoded to a temp file on the remote host, imported, and the temp file is cleaned up in a `try/finally` block. WinRM credentials are configured on the target, not on the control plane. Uses the `masterzen/winrm` Go library with support for Basic, NTLM, and Kerberos authentication.
 
-Configuration (defined, not yet functional):
+**Agent-local configuration:**
 ```json
 {
-  "mode": "local",
+  "hostname": "iis-server.example.com",
   "site_name": "Default Web Site",
   "cert_store": "WebHosting",
-  "winrm_host": "",
-  "winrm_username": "",
-  "winrm_password": "",
-  "winrm_use_https": true
+  "port": 443,
+  "sni": true,
+  "ip_address": "*",
+  "binding_info": "www.example.com"
 }
 ```
 
-When `mode` is `"local"`, the `winrm_*` fields are ignored. When `mode` is `"proxy"`, the agent connects to the remote IIS server via WinRM using the provided credentials.
+**WinRM proxy configuration:**
+```json
+{
+  "hostname": "iis-server.example.com",
+  "site_name": "Default Web Site",
+  "cert_store": "WebHosting",
+  "port": 443,
+  "sni": true,
+  "ip_address": "*",
+  "mode": "winrm",
+  "winrm": {
+    "winrm_host": "iis-server.example.com",
+    "winrm_port": 5985,
+    "winrm_username": "Administrator",
+    "winrm_password": "...",
+    "winrm_https": false,
+    "winrm_insecure": false,
+    "winrm_timeout": 60
+  }
+}
+```
 
-Location: `internal/connector/target/iis/iis.go`
+**Configuration Fields:**
+- `hostname` (string, required): IIS server hostname or FQDN
+- `site_name` (string, required): IIS website name (e.g., "Default Web Site")
+- `cert_store` (string, required): Certificate store for import (e.g., "WebHosting", "My")
+- `port` (number, default 443): HTTPS binding port
+- `sni` (boolean, default false): Enable Server Name Indication (SNI)
+- `ip_address` (string, default "*"): Specific IP to bind to, or "*" for all IPs
+- `binding_info` (string, optional): Host header for SNI bindings
+- `mode` (string, default "local"): Deployment mode — `local` (agent-local PowerShell) or `winrm` (remote via WinRM)
+
+**WinRM fields (required when `mode` is `winrm`):**
+- `winrm.winrm_host` (string, required): Remote Windows server hostname or IP
+- `winrm.winrm_port` (number, default 5985 HTTP / 5986 HTTPS): WinRM listener port
+- `winrm.winrm_username` (string, required): Windows account with admin privileges
+- `winrm.winrm_password` (string, required): Account password
+- `winrm.winrm_https` (boolean, default false): Use HTTPS transport
+- `winrm.winrm_insecure` (boolean, default false): Skip TLS certificate verification
+- `winrm.winrm_timeout` (number, default 60): Operation timeout in seconds
+
+**Security Model:**
+- PFX files are transient — generated with random passwords, deleted after import
+- In WinRM mode, PFX data is base64-encoded and transferred inline (no SMB/file share needed), with remote temp file cleanup in `try/finally`
+- PowerShell commands use parameterized values — IIS names and cert stores are regex-validated before script execution
+- Field names are validated against `^[a-zA-Z0-9 _\-\.]+$` to prevent PowerShell injection
+- Certificate thumbprints computed via SHA-1 for IIS binding lookups
+
+Location: `internal/connector/target/iis/iis.go`, `internal/connector/target/iis/winrm.go`
+
+### SSH (Agentless Deployment)
+
+The SSH target connector enables agentless certificate deployment to any Linux/Unix server via SSH/SFTP. Instead of installing the certctl agent binary on every target, a single "proxy agent" in the same network zone deploys certificates to remote servers over SSH. This is ideal for environments where installing agents on every server is impractical.
+
+**Key authentication (recommended):**
+```json
+{
+  "host": "web-server.internal",
+  "port": 22,
+  "user": "certctl",
+  "auth_method": "key",
+  "private_key_path": "/home/certctl/.ssh/id_ed25519",
+  "cert_path": "/etc/ssl/certs/cert.pem",
+  "key_path": "/etc/ssl/private/key.pem",
+  "chain_path": "/etc/ssl/certs/chain.pem",
+  "reload_command": "systemctl reload nginx",
+  "timeout": 30
+}
+```
+
+**Password authentication:**
+```json
+{
+  "host": "legacy-server.internal",
+  "user": "deploy",
+  "auth_method": "password",
+  "password": "s3cret",
+  "cert_path": "/etc/ssl/cert.pem",
+  "key_path": "/etc/ssl/key.pem",
+  "reload_command": "systemctl reload apache2"
+}
+```
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `host` | string | *(required)* | SSH hostname or IP address |
+| `port` | number | 22 | SSH port |
+| `user` | string | *(required)* | SSH username |
+| `auth_method` | string | `"key"` | `"key"` or `"password"` |
+| `private_key_path` | string | | Path to SSH private key file (key auth) |
+| `private_key` | string | | Inline SSH private key PEM (alternative to path) |
+| `password` | string | | SSH password (password auth) |
+| `passphrase` | string | | Passphrase for encrypted private keys |
+| `cert_path` | string | *(required)* | Remote path for certificate file |
+| `key_path` | string | *(required)* | Remote path for private key file |
+| `chain_path` | string | | Remote path for chain file (if empty, chain appended to cert) |
+| `cert_mode` | string | `"0644"` | File permissions for cert (octal) |
+| `key_mode` | string | `"0600"` | File permissions for private key (octal) |
+| `reload_command` | string | | Command to execute after deployment |
+| `timeout` | number | 30 | SSH connection timeout in seconds |
+
+**Security:**
+- Key-based authentication is recommended over password authentication
+- Reload commands are validated against shell injection (same validation as Postfix/Dovecot connectors)
+- Host field is regex-validated to prevent shell metacharacters
+- Private keys are written with 0600 permissions by default
+- Host key verification is intentionally skipped (same rationale as network scanner and F5 connector — deploying to known, operator-configured infrastructure)
+- Encrypted private keys supported via passphrase
+
+Location: `internal/connector/target/ssh/ssh.go`
+
+### Windows Certificate Store
+
+The Windows Certificate Store connector imports certificates into the Windows cert store via PowerShell, without managing IIS site bindings. Use this for non-IIS Windows services that read certificates from the cert store (Exchange, RDP, SQL Server, ADFS, etc.). Same injectable `PowerShellExecutor` pattern as the IIS connector, with optional WinRM proxy mode.
+
+```json
+{
+  "store_name": "My",
+  "store_location": "LocalMachine",
+  "friendly_name": "Production API Cert",
+  "remove_expired": true
+}
+```
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `store_name` | string | `"My"` | Windows cert store name (My, Root, WebHosting, etc.) |
+| `store_location` | string | `"LocalMachine"` | `"LocalMachine"` or `"CurrentUser"` |
+| `friendly_name` | string | | Optional friendly name for the imported certificate |
+| `remove_expired` | boolean | `false` | Remove expired certs with same CN after import |
+| `mode` | string | `"local"` | `"local"` (agent-local) or `"winrm"` (remote) |
+| `winrm_host` | string | | WinRM hostname (required for winrm mode) |
+| `winrm_port` | number | 5985 | WinRM port (5985 HTTP, 5986 HTTPS) |
+| `winrm_username` | string | | WinRM username (required for winrm mode) |
+| `winrm_password` | string | | WinRM password (required for winrm mode) |
+| `winrm_https` | boolean | `false` | Use HTTPS for WinRM |
+| `winrm_insecure` | boolean | `false` | Skip TLS verification for WinRM |
+
+Location: `internal/connector/target/wincertstore/wincertstore.go`
+
+### Java Keystore (JKS / PKCS#12)
+
+The Java Keystore connector deploys certificates to JKS or PKCS#12 keystores via the `keytool` CLI. This enables TLS cert deployment for Tomcat, Jetty, Kafka, Elasticsearch, and any JVM-based service. Flow: PEM to temp PKCS#12, then `keytool -importkeystore` into the target keystore.
+
+```json
+{
+  "keystore_path": "/opt/tomcat/conf/keystore.p12",
+  "keystore_password": "changeit",
+  "keystore_type": "PKCS12",
+  "alias": "server",
+  "reload_command": "systemctl restart tomcat"
+}
+```
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `keystore_path` | string | *(required)* | Absolute path to the keystore file |
+| `keystore_password` | string | *(required)* | Keystore password |
+| `keystore_type` | string | `"PKCS12"` | `"PKCS12"` or `"JKS"` |
+| `alias` | string | `"server"` | Key entry alias in the keystore |
+| `reload_command` | string | | Optional command to run after keystore update |
+| `create_keystore` | boolean | `true` | Create keystore if it doesn't exist |
+| `keytool_path` | string | `"keytool"` | Override keytool binary path |
+
+**Security:**
+- Reload commands validated against shell injection via `validation.ValidateShellCommand()`
+- Alias validated against injection (alphanumeric, hyphens, underscores only)
+- Path traversal prevention on keystore path
+- Transient PKCS#12 temp file cleaned up after import (even on error)
+
+Location: `internal/connector/target/javakeystore/javakeystore.go`
+
+### Kubernetes Secrets
+
+The Kubernetes Secrets connector deploys certificates as `kubernetes.io/tls` Secrets, compatible with Ingress controllers (nginx-ingress, Traefik, HAProxy), service meshes (Istio, Linkerd), and any Kubernetes workload that reads TLS Secrets.
+
+```json
+{
+  "namespace": "production",
+  "secret_name": "api-tls",
+  "labels": {"app": "api-gateway"},
+  "kubeconfig_path": "/home/agent/.kube/config"
+}
+```
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `namespace` | string | *(required)* | Kubernetes namespace (DNS-1123, max 63 chars) |
+| `secret_name` | string | *(required)* | Secret name (DNS subdomain, max 253 chars) |
+| `labels` | object | | Additional labels to apply to the Secret |
+| `kubeconfig_path` | string | | Path to kubeconfig for out-of-cluster agents |
+
+**Deployment modes:**
+- **In-cluster (default):** Agent runs as a Pod with a ServiceAccount. Authentication via auto-mounted token. Requires RBAC (`secrets.get`, `secrets.create`, `secrets.update`, `secrets.list`) — see Helm chart.
+- **Out-of-cluster:** Agent runs outside the cluster with `kubeconfig_path` pointing to a kubeconfig file. Useful for proxy agent pattern.
+
+**Secret format:** Standard `kubernetes.io/tls` with `tls.crt` (cert + chain PEM) and `tls.key` (private key PEM). Managed labels (`app.kubernetes.io/managed-by: certctl`) and annotations (`certctl.io/deployed-at`, `certctl.io/certificate-id`) are applied automatically.
+
+**Validation:** After deployment, the connector reads the Secret back and compares the certificate serial number to verify successful deployment.
+
+Location: `internal/connector/target/k8ssecret/k8ssecret.go`
 
 ## Notifier Connector
 
@@ -620,11 +1092,69 @@ type Connector interface {
 
 Built-in notifiers: **Email** (SMTP), **Webhook** (HTTP POST), **Slack** (incoming webhook), **Microsoft Teams** (MessageCard webhook), **PagerDuty** (Events API v2), and **OpsGenie** (Alert API v2).
 
+### Email (SMTP) Notifier
+
+The Email notifier sends transactional alerts and scheduled digests via SMTP. It bridges the connector-layer SMTP connector to the service-layer `Notifier` interface via the `NotifierAdapter`. Supports both plain text and HTML emails.
+
+Configuration:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_SMTP_HOST` | — | SMTP server hostname (required to enable) |
+| `CERTCTL_SMTP_PORT` | 587 | SMTP port (TLS) |
+| `CERTCTL_SMTP_USERNAME` | — | SMTP authentication username (optional) |
+| `CERTCTL_SMTP_PASSWORD` | — | SMTP authentication password (optional) |
+| `CERTCTL_SMTP_FROM_ADDRESS` | — | Email from address (required) |
+| `CERTCTL_SMTP_USE_TLS` | true | Enable TLS encryption |
+
+Example:
+```bash
+export CERTCTL_SMTP_HOST=smtp.gmail.com
+export CERTCTL_SMTP_PORT=587
+export CERTCTL_SMTP_USERNAME=admin@example.com
+export CERTCTL_SMTP_PASSWORD=app-password-123
+export CERTCTL_SMTP_FROM_ADDRESS=certctl@example.com
+```
+
+### Scheduled Certificate Digest
+
+The `DigestService` generates aggregated certificate digest emails and sends them on a configurable schedule. This is useful for periodic briefings on certificate inventory health — expiring certs, status summary, active agents, job trends.
+
+The digest HTML template includes:
+- Total certificates, expiring soon, expired, active agents (stats grid)
+- Jobs completed/failed summary (30 days)
+- Expiring certificates table (color-coded by urgency: 7d, 14d, 30d)
+- Auto-refresh and responsive email layout
+
+**Scheduler Integration:** The 7th scheduler loop runs on configurable interval (default 24 hours). It does NOT run on startup — waits for first scheduled tick. Operation timeout is 5 minutes. Each loop execution is guarded by `sync/atomic.Bool` idempotency.
+
+Configuration:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CERTCTL_DIGEST_ENABLED` | false | Enable scheduled digest emails |
+| `CERTCTL_DIGEST_INTERVAL` | 24h | How often to send digest (any duration, e.g. 12h, 7d) |
+| `CERTCTL_DIGEST_RECIPIENTS` | — | Comma-separated email addresses. Falls back to certificate owner emails if empty |
+
+API Endpoints:
+
+- **`GET /api/v1/digest/preview`** — Render digest HTML for preview (no email sent)
+- **`POST /api/v1/digest/send`** — Trigger digest send immediately (outside of schedule)
+
+Example:
+```bash
+# Preview digest
+curl http://localhost:8443/api/v1/digest/preview | jq '.html'
+
+# Send digest immediately
+curl -X POST http://localhost:8443/api/v1/digest/send
+```
+
 Each notifier is enabled by its configuration env var:
 
 | Notifier | Env Var | Description |
 |----------|---------|-------------|
-| Email | `CERTCTL_EMAIL_SMTP_HOST`, `CERTCTL_EMAIL_SMTP_PORT`, `CERTCTL_EMAIL_FROM` | SMTP email delivery. Optional: `CERTCTL_EMAIL_SMTP_USERNAME`, `CERTCTL_EMAIL_SMTP_PASSWORD` |
+| Email | `CERTCTL_SMTP_HOST` | SMTP email delivery. See Email Notifier section above |
 | Webhook | `CERTCTL_WEBHOOK_URL` | HTTP POST to any endpoint. Optional: `CERTCTL_WEBHOOK_SECRET` for HMAC signing |
 | Slack | `CERTCTL_SLACK_WEBHOOK_URL` | Incoming webhook URL. Optional: `CERTCTL_SLACK_CHANNEL`, `CERTCTL_SLACK_USERNAME` |
 | Teams | `CERTCTL_TEAMS_WEBHOOK_URL` | Incoming webhook URL (MessageCard format) |
@@ -869,6 +1399,63 @@ When `CERTCTL_NETWORK_SCAN_ENABLED=true`, the server runs a 6th scheduler loop (
 - **Migration assessment** — Scan a network range before onboarding to certctl management
 - **Expiration monitoring** — Discover soon-to-expire certs on network endpoints before they cause outages
 
+## Cloud Secret Manager Discovery
+
+certctl extends the existing filesystem and network discovery pipeline to cloud secret managers. Certificates stored in cloud vaults are automatically discovered, inventoried, and available for triage in the Discovery page.
+
+Each cloud source runs as a pluggable `DiscoverySource` with its own sentinel agent ID. Discovered certificates flow through the same `ProcessDiscoveryReport` pipeline used by filesystem and network discovery — dedup by fingerprint, audit trail, status tracking.
+
+### AWS Secrets Manager
+
+Discovers certificates stored as secrets in AWS Secrets Manager. Filters by tag (`type=certificate` by default) and optional name prefix.
+
+| Variable | Description | Default |
+|---|---|---|
+| `CERTCTL_CLOUD_DISCOVERY_ENABLED` | Enable cloud discovery scheduler | `false` |
+| `CERTCTL_AWS_SM_DISCOVERY_ENABLED` | Enable AWS SM source | `false` |
+| `CERTCTL_AWS_SM_REGION` | AWS region (e.g., `us-east-1`) | — |
+| `CERTCTL_AWS_SM_TAG_FILTER` | Tag key=value filter | `type=certificate` |
+| `CERTCTL_AWS_SM_NAME_PREFIX` | Secret name prefix filter | — |
+
+Source path format: `aws-sm://{region}/{secret-name}`. Sentinel agent: `cloud-aws-sm`.
+
+### Azure Key Vault
+
+Discovers certificates from Azure Key Vault using OAuth2 client credentials authentication. No Azure SDK dependency — uses stdlib HTTP with Azure AD token exchange.
+
+| Variable | Description | Default |
+|---|---|---|
+| `CERTCTL_AZURE_KV_DISCOVERY_ENABLED` | Enable Azure KV source | `false` |
+| `CERTCTL_AZURE_KV_VAULT_URL` | Vault URL (e.g., `https://myvault.vault.azure.net`) | — |
+| `CERTCTL_AZURE_KV_TENANT_ID` | Azure AD tenant ID | — |
+| `CERTCTL_AZURE_KV_CLIENT_ID` | Azure AD application (client) ID | — |
+| `CERTCTL_AZURE_KV_CLIENT_SECRET` | Azure AD application secret | — |
+
+Source path format: `azure-kv://{cert-name}/{version}`. Sentinel agent: `cloud-azure-kv`.
+
+### GCP Secret Manager
+
+Discovers certificates stored in GCP Secret Manager. Filters by label (`type=certificate`). Uses JWT-based OAuth2 service account auth — no Google SDK dependency.
+
+| Variable | Description | Default |
+|---|---|---|
+| `CERTCTL_GCP_SM_DISCOVERY_ENABLED` | Enable GCP SM source | `false` |
+| `CERTCTL_GCP_SM_PROJECT` | GCP project ID | — |
+| `CERTCTL_GCP_SM_CREDENTIALS` | Path to service account JSON file | — |
+
+Source path format: `gcp-sm://{project}/{secret-name}`. Sentinel agent: `cloud-gcp-sm`.
+
+### Cloud Discovery Scheduler
+
+All enabled cloud sources run on a shared scheduler loop (9th loop). The interval is configurable:
+
+| Variable | Description | Default |
+|---|---|---|
+| `CERTCTL_CLOUD_DISCOVERY_ENABLED` | Master switch | `false` |
+| `CERTCTL_CLOUD_DISCOVERY_INTERVAL` | Scan interval | `6h` |
+
+The loop runs immediately on startup and then on each tick. Each source runs sequentially within the loop. Errors from one source do not prevent other sources from running.
+
 ## What's Next
 
 - [Architecture Guide](architecture.md) — Understanding the full system design

docs/demo-advanced.md

@@ -307,8 +307,8 @@ flowchart TD
     A --> F["ACME\n(Let's Encrypt)"]
     A --> G["step-ca\n(implemented)"]
     A --> H["OpenSSL / Custom CA\n(script-based)"]
-    A --> J["DigiCert API\n(planned)"]
-    A --> K["Vault PKI\n(planned)"]
+    A --> J["DigiCert API\n(implemented)"]
+    A --> K["Vault PKI\n(implemented)"]
     A --> L["Entrust / GlobalSign\n(planned)"]
     A --> M["Google CAS / EJBCA\n(planned)"]
 ```
@@ -724,22 +724,24 @@ curl -s -X POST $API/api/v1/certificates/mc-demo-payments/revoke \
 6. Creates an audit trail entry
 7. Sends revocation notifications via configured channels
 
-Check the CRL (Certificate Revocation List):
+Check the CRL (Certificate Revocation List) — served unauthenticated under the RFC 8615 well-known namespace so relying parties without a certctl API key can still verify revocation (RFC 5280 §5):
 
 ```bash
-# JSON-formatted CRL
-curl -s $API/api/v1/crl | jq .
-
-# DER-encoded X.509 CRL for the local CA (binary — pipe to openssl for inspection)
-curl -s $API/api/v1/crl/iss-local -o /tmp/crl.der
+# DER-encoded X.509 CRL for the local CA (binary — pipe to openssl for inspection).
+# Note: no -H "Authorization: Bearer ..." — the endpoint is deliberately
+# unauthenticated. Content-Type is application/pkix-crl.
+curl -s http://localhost:8443/.well-known/pki/crl/iss-local -o /tmp/crl.der
 openssl crl -inform DER -in /tmp/crl.der -text -noout
 ```
 
-Check OCSP status:
+Check OCSP status (RFC 6960, also unauthenticated, `application/ocsp-response`):
 
 ```bash
-# Replace SERIAL with the actual serial number from the certificate version
-curl -s $API/api/v1/ocsp/iss-local/SERIAL | jq .
+# Replace SERIAL with the actual serial number from the certificate version.
+# The embedded OCSP responder returns a signed DER response — parse it with
+# `openssl ocsp -respin` or similar tooling.
+curl -s http://localhost:8443/.well-known/pki/ocsp/iss-local/SERIAL -o /tmp/ocsp.der
+openssl ocsp -respin /tmp/ocsp.der -noverify -resp_text | head -40
 ```
 
 **Why RFC 5280 reason codes:** The reason code isn't just metadata — it tells clients *why* the certificate was revoked. A `keyCompromise` revocation means the private key was exposed and the certificate should be distrusted immediately. A `superseded` revocation means a newer certificate replaced it — less urgent. CRLs and OCSP responses include the reason code so client software can make informed trust decisions.
@@ -981,7 +983,7 @@ export CERTCTL_API_KEY="test-key-123"
 
 ## Part 15: MCP Server for AI Integration (M18a)
 
-certctl exposes 78 MCP tools covering the REST API via the Model Context Protocol (MCP), enabling seamless integration with Claude, Cursor, and other AI assistants:
+certctl exposes the full REST API via the Model Context Protocol (MCP), enabling seamless integration with Claude, Cursor, and other AI assistants:
 
 ```bash
 # Build the MCP server
@@ -1153,7 +1155,7 @@ flowchart TB
         API["REST API\nGo net/http"]
         SVC["Service Layer\nBusiness Logic"]
         REPO["Repository Layer\ndatabase/sql + lib/pq"]
-        SCHED["Scheduler\n6 background loops"]
+        SCHED["Scheduler\n7 background loops"]
         CONN["Connector Registry\nIssuer + Target + Notifier"]
     end
 

docs/examples.md

@@ -0,0 +1,120 @@
+# Deployment Examples
+
+Five turnkey docker-compose scenarios, each runnable in under 5 minutes. Pick the one closest to your setup.
+
+## Which Example Should I Use?
+
+| I need to... | Example | Issuer | Target |
+|--------------|---------|--------|--------|
+| Get Let's Encrypt certs for NGINX on a public server | [ACME + NGINX](#acme--nginx) | ACME (HTTP-01) | NGINX |
+| Issue wildcard certs without opening port 80 | [Wildcard DNS-01](#wildcard-dns-01) | ACME (DNS-01) | Any |
+| Run an internal CA for services behind a firewall | [Private CA + Traefik](#private-ca--traefik) | Local CA | Traefik |
+| Use Smallstep step-ca as my PKI backend | [step-ca + HAProxy](#step-ca--haproxy) | step-ca | HAProxy |
+| Manage both public and internal certs from one dashboard | [Multi-Issuer](#multi-issuer) | ACME + Local CA | Mixed |
+
+**Already using another tool?** See the migration sections below each example for Certbot, acme.sh, and cert-manager users.
+
+---
+
+## ACME + NGINX
+
+**Scenario:** You have one or more public-facing domains, NGINX as the reverse proxy, and want automated Let's Encrypt certificates with HTTP-01 challenges.
+
+**What it deploys:** certctl server + PostgreSQL + certctl agent + NGINX, all on one Docker network. The agent generates keys locally (ECDSA P-256), submits CSRs to the server, receives signed certs from Let's Encrypt, and deploys them to NGINX with automatic reload.
+
+**Prerequisites:** A domain pointing to your server, ports 80 and 443 open, Docker Compose v20.10+.
+
+```bash
+cd examples/acme-nginx
+cp .env.example .env   # Edit with your domain and email
+docker compose up -d
+```
+
+The full walkthrough — including how HTTP-01 challenges work, adding multiple domains, switching to staging for testing, and a production checklist — is in the [example README](../examples/acme-nginx/acme-nginx.md).
+
+**Migrating from Certbot?** certctl discovers your existing `/etc/letsencrypt/live/` certificates automatically. You keep your ACME account, disable the Certbot cron, and certctl takes over renewal with centralized visibility and deployment verification. The step-by-step process is in [Migrating from Certbot](migrate-from-certbot.md).
+
+---
+
+## Wildcard DNS-01
+
+**Scenario:** You need wildcard certificates (`*.example.com`) or your servers aren't reachable from the internet (no port 80). DNS-01 validates ownership by creating a TXT record at your DNS provider.
+
+**What it deploys:** certctl server + PostgreSQL + certctl agent. Includes a Cloudflare DNS hook script as a working reference — swap in your own DNS provider (Route53, Azure DNS, Google Cloud DNS, or any provider with an API).
+
+**Prerequisites:** A domain, API credentials for your DNS provider, Docker Compose.
+
+```bash
+cd examples/acme-wildcard-dns01
+cp .env.example .env   # Edit with domain, email, DNS provider credentials
+docker compose up -d
+```
+
+The full walkthrough — including DNS-PERSIST-01 (set a TXT record once, never touch DNS again on renewals), adapting scripts for other providers, and propagation troubleshooting — is in the [example README](../examples/acme-wildcard-dns01/acme-wildcard-dns01.md).
+
+**Migrating from acme.sh?** Your existing `dns_*` hook scripts are compatible with certctl's DNS-01 — they use the same pattern (shell scripts creating TXT records). The migration guide covers script adaptation, discovery of existing acme.sh certificates, and phasing out the acme.sh cron. See [Migrating from acme.sh](migrate-from-acmesh.md).
+
+---
+
+## Private CA + Traefik
+
+**Scenario:** Internal services that don't need public CA validation. You run your own certificate authority — either a self-signed root for development, or a subordinate CA chained to your enterprise root (e.g., Active Directory Certificate Services).
+
+**What it deploys:** certctl server + PostgreSQL + certctl agent + Traefik. The Local CA issuer signs certificates directly. Traefik watches a cert directory and auto-reloads when new files appear.
+
+**Prerequisites:** Docker Compose. For sub-CA mode, you'll need a CA certificate and key signed by your enterprise root.
+
+```bash
+cd examples/private-ca-traefik
+docker compose up -d    # Self-signed mode (no .env needed for demo)
+```
+
+The full walkthrough — including sub-CA setup with `CERTCTL_CA_CERT_PATH` and `CERTCTL_CA_KEY_PATH`, creating certificates via the API, monitoring deployments, and production hardening — is in the [example README](../examples/private-ca-traefik/private-ca-traefik.md).
+
+---
+
+## step-ca + HAProxy
+
+**Scenario:** You use Smallstep's step-ca as your private PKI and want automated lifecycle management for certificates deployed to HAProxy load balancers.
+
+**What it deploys:** certctl server + PostgreSQL + certctl agent + step-ca (with JWK provisioner) + HAProxy. certctl issues certs via step-ca's native `/sign` API, combines them into HAProxy's expected PEM format (cert + chain + key in one file), and reloads HAProxy.
+
+**Prerequisites:** Docker Compose.
+
+```bash
+cd examples/step-ca-haproxy
+docker compose up -d
+```
+
+The full walkthrough — including step-ca provisioner configuration, integrating with an existing step-ca instance, HAProxy PEM format details, and advanced features (approval workflows, policy-based renewal, multi-instance HAProxy) — is in the [example README](../examples/step-ca-haproxy/step-ca-haproxy.md).
+
+---
+
+## Multi-Issuer
+
+**Scenario:** You manage both public-facing services (needing Let's Encrypt or another public CA) and internal services (using a private CA) and want a single dashboard for everything.
+
+**What it deploys:** certctl server + PostgreSQL + certctl agent configured with both an ACME issuer and a Local CA issuer. Demonstrates issuer assignment via profiles — public services get ACME certs, internal services get Local CA certs, all visible in one inventory.
+
+**Prerequisites:** Docker Compose. For real ACME certs, a public domain and port 80 access.
+
+```bash
+cd examples/multi-issuer
+docker compose up -d
+```
+
+The full walkthrough — including profile-based issuer assignment, testing with ACME staging, Local CA enterprise sub-CA mode, and scaling beyond Docker Compose — is in the [example README](../examples/multi-issuer/multi-issuer.md).
+
+**Using cert-manager for Kubernetes?** certctl complements cert-manager — cert-manager handles in-cluster certs, certctl handles everything outside: VMs, bare metal, network appliances, Windows servers. They can share the same CA (ACME, step-ca, Vault PKI). See [certctl for cert-manager Users](certctl-for-cert-manager-users.md).
+
+---
+
+## Beyond These Examples
+
+These 5 scenarios cover the most common deployment patterns, but certctl supports 7 issuer backends and 10 target connectors. Once you have the basics running, you can mix and match:
+
+**Issuers:** ACME (Let's Encrypt, ZeroSSL, Buypass, Google Trust Services), Local CA (self-signed or sub-CA), step-ca, Vault PKI, DigiCert CertCentral, OpenSSL/Custom CA script, Sectigo (coming soon).
+
+**Targets:** NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, IIS (local PowerShell or WinRM proxy), Postfix, Dovecot, F5 BIG-IP (coming soon).
+
+See [Connector Reference](connectors.md) for configuration details on every issuer and target.

docs/mcp.md

@@ -94,7 +94,7 @@ Add certctl as an MCP server in your project's `.mcp.json`:
 
 ## Available Tools
 
-The MCP server registers 78 tools organized across 16 resource domains:
+The MCP server exposes the full REST API organized across 16 resource domains:
 
 | Domain | Tools | Examples |
 |--------|-------|---------|
@@ -153,7 +153,7 @@ flowchart LR
     AI <-->|"stdio"| MCP
     MCP -->|"HTTP + Bearer token"| SERVER
 
-    MCP ~~~ TOOLS["78 tools · 16 domains\nTyped input structs"]
+    MCP ~~~ TOOLS["REST API via MCP · 16 domains\nTyped input structs"]
 ```
 
 The MCP server is intentionally thin:

docs/migrate-from-acmesh.md

@@ -0,0 +1,275 @@
+# Migrate from acme.sh to certctl
+
+You use acme.sh to automate Let's Encrypt renewal across multiple servers. It works — but without centralized visibility, deployment verification, or policy enforcement.
+
+This guide walks through moving your acme.sh workload to certctl while keeping your existing DNS provider setup.
+
+## Why Migrate
+
+**acme.sh strength:** Lightweight agent, works everywhere, integrates with any DNS provider via shell script hooks.
+
+**acme.sh limitations:**
+- No inventory visibility — certificates scattered across servers, no unified view of expiry dates or renewal status
+- No deployment verification — cron job succeeds even if cert doesn't actually take effect on the service
+- No policy enforcement — no way to require approval, audit who renewed what, or prevent misconfigurations
+- No multi-server orchestration — each server manages its own renewals; no way to batch test or rollback
+
+certctl adds a control plane that sees all your certificates, deploys with verification, enforces policy, and provides a complete audit trail. You keep the DNS-01 challenge scripts you already have.
+
+## What You Keep
+
+- **Existing certificates** — discovered automatically during migration, claimed in the dashboard
+- **DNS provider scripts** — acme.sh's `dns_*` hooks are shell-script compatible with certctl's DNS-01 implementation
+- **Same Let's Encrypt account** — ACME issuer in certctl uses the same account and email
+
+## Migration Steps
+
+### 1. Deploy certctl Server
+
+Start with Docker Compose (5 minutes):
+
+```bash
+git clone https://github.com/shankar0123/certctl.git
+cd certctl/deploy
+docker compose up -d
+```
+
+Access the dashboard at `http://localhost:8443` with API key from `.env` file.
+
+### 2. Deploy Agents
+
+On each server running acme.sh certs, install the certctl agent:
+
+```bash
+curl -sSL https://raw.githubusercontent.com/shankar0123/certctl/master/install-agent.sh | bash
+# Prompted for server URL and API key
+```
+
+Or manually:
+
+```bash
+# Download and install agent binary
+wget https://github.com/shankar0123/certctl/releases/download/v2.1.0/certctl-agent-linux-amd64
+chmod +x certctl-agent-linux-amd64
+sudo mv certctl-agent-linux-amd64 /usr/local/bin/certctl-agent
+
+# Create systemd unit
+sudo tee /etc/systemd/system/certctl-agent.service > /dev/null <<EOF
+[Unit]
+Description=certctl Agent
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/certctl-agent
+Environment="CERTCTL_SERVER_URL=https://certctl.internal:8443"
+Environment="CERTCTL_API_KEY=your-api-key-here"
+Environment="CERTCTL_DISCOVERY_DIRS=~/.acme.sh"
+Restart=always
+RestartSec=10s
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+sudo systemctl daemon-reload
+sudo systemctl enable --now certctl-agent
+```
+
+### 3. Discover Existing acme.sh Certificates
+
+acme.sh stores certificates in `~/.acme.sh/<domain>/` (or `/etc/acme.sh/` if installed system-wide).
+
+When you start the agent with `CERTCTL_DISCOVERY_DIRS` pointing to those directories, it scans for existing PEM/DER certificates and reports fingerprints to the control plane. The dashboard's **Discovery** page shows what was found.
+
+Example agent systemd service (using home directory):
+
+```bash
+Environment="CERTCTL_DISCOVERY_DIRS=/home/user/.acme.sh"
+```
+
+Or for system-wide acme.sh:
+
+```bash
+Environment="CERTCTL_DISCOVERY_DIRS=/etc/acme.sh"
+```
+
+### 4. Claim Discovered Certificates
+
+In the **Discovery** page:
+1. Review the "Unmanaged" certificates found by the agent
+2. Click **Claim** on each acme.sh certificate
+3. Enter the managed certificate ID to link it (e.g., `mc-api-prod`)
+
+Once claimed, the certificate appears in the main **Certificates** page with ownership, renewal history, and deployment status.
+
+### 5. Create an ACME Issuer
+
+In **Issuers** → **+ New Issuer:**
+
+1. Select **ACME** from the issuer type grid
+2. Fill in the type-specific fields: name, directory URL (`https://acme-v02.api.letsencrypt.org/directory`), and config
+
+Or configure via environment variables:
+```bash
+export CERTCTL_ACME_DIRECTORY_URL=https://acme-v02.api.letsencrypt.org/directory
+export CERTCTL_ACME_EMAIL=your-email@example.com  # same as your acme.sh account
+export CERTCTL_ACME_CHALLENGE_TYPE=dns-01
+```
+
+### 6. Adapt Your DNS Provider Scripts
+
+acme.sh uses `dns_*` hooks (e.g., `dns_cloudflare`) with predictable argument patterns. certctl's DNS-01 uses the same pattern, so your scripts often work with zero changes.
+
+**acme.sh pattern:**
+```bash
+# acme.sh invokes: dns_cloudflare_add "domain" "record" "value"
+dns_cloudflare_add() {
+  local full_domain=$1
+  local record_name=$2
+  local record_value=$3
+  # ... DNS API call to create TXT record ...
+}
+```
+
+**certctl pattern:**
+```bash
+# certctl invokes: /path/to/dns-present-script
+# Scripts receive environment variables:
+#!/bin/bash
+# CERTCTL_DNS_DOMAIN — domain name (e.g., "example.com")
+# CERTCTL_DNS_FQDN — full record name (e.g., "_acme-challenge.example.com")
+# CERTCTL_DNS_VALUE — TXT record value (key authorization digest)
+# CERTCTL_DNS_TOKEN — ACME challenge token
+# Create TXT record at "${CERTCTL_DNS_FQDN}" with value "${CERTCTL_DNS_VALUE}"
+```
+
+**Example: Cloudflare DNS-01 adapter**
+
+If you have an acme.sh Cloudflare hook, adapt it:
+
+```bash
+#!/bin/bash
+# /etc/certctl/dns/cloudflare-present.sh
+set -e
+
+# certctl passes these environment variables:
+# CERTCTL_DNS_DOMAIN — domain name
+# CERTCTL_DNS_FQDN — full record name (e.g., "_acme-challenge.example.com")
+# CERTCTL_DNS_VALUE — TXT record value
+# CERTCTL_DNS_TOKEN — ACME challenge token
+
+# Call your existing Cloudflare API (example using curl)
+curl -X POST "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/dns_records" \
+  -H "X-Auth-Email: ${CF_EMAIL}" \
+  -H "X-Auth-Key: ${CF_KEY}" \
+  -H "Content-Type: application/json" \
+  -d "{\"type\":\"TXT\",\"name\":\"${CERTCTL_DNS_FQDN}\",\"content\":\"${CERTCTL_DNS_VALUE}\"}"
+
+echo "Created ${CERTCTL_DNS_FQDN}"
+```
+
+DNS cleanup:
+
+```bash
+#!/bin/bash
+# /etc/certctl/dns/cloudflare-cleanup.sh
+
+# certctl passes these environment variables:
+# CERTCTL_DNS_DOMAIN — domain name
+# CERTCTL_DNS_FQDN — full record name (e.g., "_acme-challenge.example.com")
+# CERTCTL_DNS_VALUE — TXT record value
+# CERTCTL_DNS_TOKEN — ACME challenge token
+
+# Query and delete the TXT record
+curl -X DELETE "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/dns_records/${RECORD_ID}" \
+  -H "X-Auth-Email: ${CF_EMAIL}" \
+  -H "X-Auth-Key: ${CF_KEY}"
+```
+
+Configure the ACME issuer via environment variables:
+
+```bash
+export CERTCTL_ACME_DIRECTORY_URL=https://acme-v02.api.letsencrypt.org/directory
+export CERTCTL_ACME_EMAIL=your-email@example.com
+export CERTCTL_ACME_CHALLENGE_TYPE=dns-01
+export CERTCTL_ACME_DNS_PRESENT_SCRIPT=/etc/certctl/dns/cloudflare-present.sh
+export CERTCTL_ACME_DNS_CLEANUP_SCRIPT=/etc/certctl/dns/cloudflare-cleanup.sh
+```
+
+Or create the issuer through the dashboard: **Issuers** → **+ New Issuer** → select **ACME** → fill in the config fields.
+
+### 7. Create Renewal Policies
+
+In **Policies** → **+ New Policy:**
+
+- **Name:** e.g., "ACME DNS-01 Policy"
+- **Type:** `expiration_window` (enforces renewal thresholds)
+- **Severity:** `high`
+- **Config:** set your renewal window (default: 30 days before expiry)
+
+Renewal scheduling is driven by the certificate's assigned profile and issuer. Policies add enforcement guardrails on top.
+
+### 8. Phase Out acme.sh Cron
+
+Once you verify renewals work via certctl (manually trigger one in the dashboard first), remove the acme.sh cron job:
+
+```bash
+# Remove acme.sh from crontab
+crontab -e
+# Delete the line: "0 0 * * * /home/user/.acme.sh/acme.sh --cron --home /home/user/.acme.sh"
+
+# OR disable the cron service if installed
+sudo systemctl disable acme-renew.timer
+```
+
+## DNS Script Compatibility
+
+Most acme.sh DNS provider hooks need only minor changes:
+
+| acme.sh | certctl |
+|---------|---------|
+| Called on every renewal | Called once per challenge window |
+| Receives: domain, record name, record value as arguments | Receives: `CERTCTL_DNS_DOMAIN`, `CERTCTL_DNS_FQDN`, `CERTCTL_DNS_VALUE`, `CERTCTL_DNS_TOKEN` as environment variables |
+| Must support multiple concurrent records | Same — cleanup removes the specific token |
+| Environment variables for credentials | Same — pass via agent systemd `Environment=` or `.env` file |
+
+**Real example:** If you use Route53, acme.sh's `dns_aws` hook submits via AWS CLI. Adapt it to use `${CERTCTL_DNS_FQDN}` and `${CERTCTL_DNS_VALUE}` environment variables instead of positional arguments, and it works with certctl's DNS-01.
+
+## Coexistence Period
+
+During migration, run both acme.sh and certctl in parallel:
+
+1. Keep acme.sh cron running (low overhead, serves as fallback)
+2. Configure certctl policies and test renewal on 1-2 non-critical domains
+3. Monitor certctl's audit trail and deployment logs
+4. Once confident, disable acme.sh cron on those domains
+5. Roll out to remaining domains
+
+This way, if certctl renewal fails, acme.sh's cron still renews the cert (you'll see duplicate renewals in the audit trail, but no gap).
+
+## Next: DNS-PERSIST-01 (Zero-Touch Renewals)
+
+After migrating to certctl + DNS-01, consider upgrading to **DNS-PERSIST-01**. Instead of creating/deleting DNS records on every renewal, you create one persistent TXT record at `_validation-persist.<domain>` that never changes. Let's Encrypt then validates against that standing record forever.
+
+Benefits:
+- **Zero operational overhead per renewal** — no DNS API calls during renewal
+- **Auditable** — DNS record created once, visible to the team, never modified
+- **Vendor-agnostic** — works with any DNS provider that supports TXT records
+
+To enable:
+
+```bash
+export CERTCTL_ACME_CHALLENGE_TYPE=dns-persist-01
+export CERTCTL_ACME_DNS_PERSIST_ISSUER_DOMAIN=letsencrypt.org
+export CERTCTL_ACME_DNS_PRESENT_SCRIPT=/etc/certctl/dns/cloudflare-present.sh
+```
+
+certctl automatically falls back to DNS-01 if the CA doesn't support dns-persist-01 yet.
+
+## Next Steps
+
+- Try the [Wildcard DNS-01 example](../examples/acme-wildcard-dns01/acme-wildcard-dns01.md) — a working docker-compose with Cloudflare hooks you can adapt for your DNS provider
+- See [Connector Reference](connectors.md) for advanced ACME options (EAB, ARI, custom timeouts)
+- See [Discovery Guide](concepts.md#certificate-discovery) for managing discovered certificates at scale
+- See all [Deployment Examples](./examples.md) for other scenarios (ACME+NGINX, private CA, step-ca, multi-issuer)

docs/migrate-from-certbot.md

@@ -0,0 +1,172 @@
+# Migrating from Certbot to certctl
+
+You have 50 Let's Encrypt certificates across 10 servers, managed by a mix of Certbot cron jobs and manual renewals. Certbot handles issuance, but you lack inventory visibility, centralized alerting, and audit trails. This guide walks you through moving to certctl while keeping your existing certificates and ACME account.
+
+## Why Migrate
+
+Certbot renews certs in isolation. If a renewal fails on one server, you don't know until the cert expires. certctl gives you a single pane of glass: see all certs across all servers, get alerts 30/14/7 days before expiry, track who renewed what when, and verify each deployment succeeded via TLS fingerprint validation.
+
+## What You Keep
+
+- Your existing Certbot ACME account key and Let's Encrypt account
+- All issued certificates in `/etc/letsencrypt/live/`
+- Certbot's renewal history and hooks
+
+You will not re-issue any certificates. certctl discovers them and takes over renewal scheduling.
+
+## Step-by-Step Migration
+
+### 1. Deploy certctl Control Plane
+
+Option A: Docker Compose (quickest for evaluation)
+```bash
+cd /opt/certctl
+docker compose up -d
+# Dashboard & API: http://localhost:8443
+# Default API key in logs (grep CERTCTL_API_KEY docker logs certctl-server)
+```
+
+Option B: Kubernetes (Helm)
+```bash
+helm install certctl deploy/helm/certctl/ \
+  --set auth.apiKey=YOUR_SECURE_KEY
+```
+
+### 2. Deploy Agents to Each Server
+
+On each of your 10 servers running Certbot:
+
+```bash
+# Linux amd64 (adjust for your architecture)
+curl -sSL https://github.com/shankar0123/certctl/releases/download/v2.1.0/certctl-agent-linux-amd64 \
+  -o /usr/local/bin/certctl-agent
+chmod +x /usr/local/bin/certctl-agent
+
+# Create config
+sudo mkdir -p /etc/certctl /var/lib/certctl/keys
+sudo tee /etc/certctl/agent.env > /dev/null <<EOF
+CERTCTL_SERVER_URL=http://certctl-control-plane.example.com:8443
+CERTCTL_API_KEY=your-api-key-here
+CERTCTL_DISCOVERY_DIRS=/etc/letsencrypt/live
+CERTCTL_KEY_DIR=/var/lib/certctl/keys
+EOF
+sudo chmod 600 /etc/certctl/agent.env
+
+# Start agent
+sudo systemctl start certctl-agent  # if installed via script
+# OR manually:
+sudo certctl-agent --server https://... --api-key ... --discovery-dirs /etc/letsencrypt/live
+```
+
+The agent will scan `/etc/letsencrypt/live/` and report all discovered certificates to the control plane.
+
+### 3. Triage Discovered Certificates
+
+In the certctl dashboard, go to **Discovery**:
+- See all discovered certs grouped by agent
+- Status shows "Unmanaged" for certificates not yet claimed
+- For each Certbot cert, click **Claim** and link it to managed inventory
+
+The control plane now knows about all 50 certs and where they live.
+
+### 4. Configure ACME Issuer
+
+Go to **Issuers** → **+ New Issuer**:
+1. Select **ACME** from the issuer type grid
+2. Fill in the type-specific fields: name, directory URL (`https://acme-v02.api.letsencrypt.org/directory`), and any required config
+
+Alternatively, configure via environment variables before starting the server:
+```bash
+export CERTCTL_ACME_DIRECTORY_URL=https://acme-v02.api.letsencrypt.org/directory
+export CERTCTL_ACME_EMAIL=your-email@example.com
+export CERTCTL_ACME_CHALLENGE_TYPE=http-01  # or dns-01 for wildcard certs
+```
+
+For DNS-01, also set:
+```bash
+export CERTCTL_ACME_DNS_PRESENT_SCRIPT=/etc/certctl/dns/present.sh
+export CERTCTL_ACME_DNS_CLEANUP_SCRIPT=/etc/certctl/dns/cleanup.sh
+```
+
+certctl uses the same Let's Encrypt account; no new credentials needed.
+
+### 5. Create Renewal Policies
+
+Go to **Policies** → **+ New Policy** to create enforcement rules:
+- Name: e.g., "ACME Renewal Policy"
+- Type: `expiration_window` (to enforce renewal thresholds)
+- Severity: `high`
+- Config: set your renewal threshold (default: 30 days before expiry)
+
+Renewal scheduling is driven by the certificate's assigned profile and issuer. Policies add enforcement guardrails (key algorithm requirements, expiration windows, etc.).
+
+### 6. Disable Certbot Cron, One Server at a Time
+
+On the first server (start with a low-traffic one):
+
+```bash
+# Stop Certbot renewal
+sudo systemctl disable certbot.timer
+sudo systemctl stop certbot.timer
+
+# Or remove the cron job
+sudo rm /etc/cron.d/certbot  # if managed by cron
+```
+
+Monitor that server in the certctl dashboard. Certctl will renew the cert ~30 days before expiry.
+
+### 7. Verify First Renewal Succeeds
+
+Wait for the renewal to trigger (or manually trigger it in **Certificates** → select cert → **Renew**). Check the dashboard:
+- **Certificates** page: status transitions from `Active` to `Renewing` to `Active`
+- **Jobs** page: renewal job shows `Completed` status
+- **Verification** tab: TLS check confirms the new cert is deployed and live
+
+After verifying, disable Certbot on the remaining 9 servers.
+
+### 8. Enable Alerting
+
+Configure notifiers via environment variables before starting the server:
+```bash
+# Example: Slack alerting
+export CERTCTL_SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/WEBHOOK/URL
+docker compose up -d
+
+# Or email alerting
+export CERTCTL_SMTP_HOST=smtp.gmail.com
+export CERTCTL_SMTP_PORT=587
+export CERTCTL_SMTP_USERNAME=your-email@gmail.com
+export CERTCTL_SMTP_PASSWORD=your-app-password
+export CERTCTL_SMTP_FROM_ADDRESS=certctl@example.com
+docker compose up -d
+
+# Other options: CERTCTL_TEAMS_WEBHOOK_URL, CERTCTL_PAGERDUTY_ROUTING_KEY, CERTCTL_OPSGENIE_API_KEY
+```
+
+Now you get 30/14/7-day warnings before any cert expires, across all 10 servers, in one place.
+
+## What Changes
+
+- **Renewal**: Agent polls certctl for work instead of Certbot cron triggering locally. Faster failure detection (agent heartbeat every 60 seconds vs. cron running once a day).
+- **Deployment**: certctl verifies post-deployment by probing the live TLS endpoint and comparing SHA-256 fingerprints. Catches reload failures silently.
+- **Audit Trail**: Every renewal, deployment, and alert is logged immutably. Answer "who renewed cert X when and why" within seconds.
+- **Alerting**: Threshold-based alerts to Slack/email/webhook 30/14/7 days before expiry, not when cert expires.
+
+## Coexistence and Rollback
+
+During migration, certctl and Certbot can run simultaneously. The agent will discover Certbot certs even while Certbot continues renewing them. Run both for a week to build confidence.
+
+**If you need to rollback**: Re-enable Certbot cron on any server:
+```bash
+sudo systemctl enable certbot.timer
+sudo systemctl start certbot.timer
+```
+
+certctl will stop renewing that cert when the policy is disabled. Certbot resumes as before. Your certificates and ACME account remain untouched.
+
+## Next Steps
+
+- Try the [ACME + NGINX example](../examples/acme-nginx/acme-nginx.md) — a working docker-compose you can run locally before deploying to production
+- Review the [Concepts Guide](./concepts.md) for terminology (profiles, policies, agents, jobs)
+- Explore [Network Discovery](./quickstart.md#network-discovery-agentless) to find certificates you didn't know about
+- See all [Deployment Examples](./examples.md) for other scenarios (wildcard DNS-01, private CA, step-ca, multi-issuer)

docs/qa-test-guide.md

@@ -0,0 +1,295 @@
+# QA Test Suite Guide (`qa_test.go`)
+
+> **Audience:** Anyone running release QA for certctl — whether you're a first-time contributor or the maintainer cutting a release tag.
+>
+> **Companion to:** `docs/testing-guide.md` (the *what* to test). This document explains the *how* — the automated test file, what it covers, what it skips, and how to fill the gaps manually.
+
+---
+
+## What Is This File?
+
+`deploy/test/qa_test.go` is a single Go test file (~1700 lines) that automates as much of `docs/testing-guide.md` as possible against a running certctl Docker Compose demo stack. It replaces the legacy `qa-smoke-test.sh` bash script.
+
+It covers **all 54 Parts** of the testing guide:
+
+- **~164 automated subtests** — API calls, database queries, source file checks, performance benchmarks
+- **11 skipped Parts** — with documented reasons (external CAs, Windows, browser-only, etc.)
+- **Remaining ~282 manual tests** — GUI flows, scheduler timing, Docker log inspection — must be done by a human following `docs/testing-guide.md`
+
+## Architecture
+
+```
+┌────────────────────────┐     ┌──────────────────────────┐
+│  qa_test.go            │────▶│  certctl demo stack      │
+│  (//go:build qa)       │     │  docker-compose.yml +    │
+│                        │     │  docker-compose.demo.yml │
+│  TestQA(t *testing.T)  │     │                          │
+│   ├─ Part01_Infra      │     │  ┌─ certctl-server :8443 │
+│   ├─ Part02_Auth       │     │  ├─ postgres :5432       │
+│   ├─ Part03_CertCRUD   │     │  └─ certctl-agent        │
+│   ├─ ...               │     └──────────────────────────┘
+│   └─ Part52_HelmChart  │
+└────────────────────────┘
+```
+
+Key design choices:
+
+- **Build tag:** `//go:build qa` — never runs during `go test ./...` or CI. Only runs when explicitly requested.
+- **Package:** `integration_test` — same package as `integration_test.go` (which uses `//go:build integration` for the test stack). They coexist but never run together.
+- **Zero internal imports:** Uses only stdlib + `lib/pq` (from `go.mod`). All API interactions are plain HTTP. All JSON is decoded into lightweight local structs (`qaCert`, `qaJob`, etc.) — not the internal domain types.
+- **Self-cleaning:** Tests that create data use `t.Cleanup()` to delete it afterward. The seed data is not modified.
+
+## Prerequisites
+
+1. **Docker Compose demo stack running:**
+   ```bash
+   cd deploy
+   docker compose -f docker-compose.yml -f docker-compose.demo.yml up --build -d
+   ```
+   Wait ~15 seconds for health checks to pass.
+
+2. **Go 1.22+** installed (the project uses Go 1.25 in `go.mod`, but 1.22+ works for running tests).
+
+3. **PostgreSQL port exposed** — the demo stack exposes port 5432 for database verification tests (table counts, schema checks).
+
+4. **Repository checkout** — source file verification tests (`fileExists`, `fileContains`) read files relative to `qaRepoDir` (default: `../..` from `deploy/test/`).
+
+## Running the Tests
+
+### Full suite
+```bash
+cd deploy/test
+go test -tags qa -v -timeout 10m ./...
+```
+
+### Single Part
+```bash
+go test -tags qa -v -run TestQA/Part03 ./...
+```
+
+### Single subtest
+```bash
+go test -tags qa -v -run TestQA/Part03_CertCRUD/Create_Minimal ./...
+```
+
+### With custom environment
+```bash
+CERTCTL_QA_SERVER_URL=https://staging.internal:8443 \
+CERTCTL_QA_API_KEY=my-staging-key \
+CERTCTL_QA_DB_URL=postgres://certctl:secret@db.internal:5432/certctl?sslmode=require \
+CERTCTL_QA_REPO_DIR=/path/to/certctl \
+go test -tags qa -v -timeout 10m ./...
+```
+
+### Environment Variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `CERTCTL_QA_SERVER_URL` | `http://localhost:8443` | certctl server URL |
+| `CERTCTL_QA_API_KEY` | `change-me-in-production` | API key for Bearer auth |
+| `CERTCTL_QA_DB_URL` | `postgres://certctl:certctl@localhost:5432/certctl?sslmode=disable` | PostgreSQL connection string |
+| `CERTCTL_QA_REPO_DIR` | `../..` | Path to certctl repo root (for source file checks) |
+
+## Part-by-Part Coverage Map
+
+This table shows what each Part tests and what's left for manual verification.
+
+| Part | Testing Guide Section | Automated Subtests | What's Automated | What's Manual |
+|------|----------------------|-------------------|-----------------|--------------|
+| 1 | Infrastructure & Deployment | 8 | Table count, health/ready endpoints, seed data counts (certs, agents, issuers, targets, policies) | Docker container health, log inspection, volume mounts |
+| 2 | Authentication & Security | 4 | No-auth 401, bad-key 401, health-no-auth 200, no private keys in API | CORS preflight, rate limiting (429 + Retry-After), TLS config |
+| 3 | Certificate Lifecycle | 10 | Create (minimal + full), get, 404, list pagination, status/issuer filters, sparse fields, update, archive | Deployment trigger, version history, certificate detail UI |
+| 4 | Renewal Workflow | 3 | Trigger renewal, 404 on nonexistent, agent work endpoint | AwaitingCSR flow, agent key generation, full issuance cycle |
+| 5 | Revocation | 5 | Revoke (default reason), already-revoked, nonexistent, invalid reason, CRL JSON | DER CRL, OCSP responder, revocation notifications |
+| 6 | Policies & Profiles | 6 | Policy CRUD (create/delete), invalid type 400, profile CRUD, list | Policy violation detection, profile enforcement on CSR |
+| 7 | Ownership & Teams | 4 | Team CRUD, owner CRUD, agent groups list | Owner notification routing, dynamic group matching |
+| 8 | Job System | 2 | List jobs, 404 on nonexistent | Job state transitions, approval workflow, cancellation |
+| 9 | Issuer Connectors | 4 | List, get detail, create (GenericCA), missing name 400 | Test connection, issuer-specific issuance flow |
+| 10 | Sub-CA Mode | SKIP | — | Requires CA cert+key on disk |
+| 11 | ACME ARI | SKIP | — | Requires ARI-capable CA |
+| 12 | Vault PKI | SKIP | — | Requires live Vault server |
+| 13 | DigiCert | SKIP | — | Requires DigiCert sandbox |
+| 14 | Target Connectors | 3 | List, create NGINX target, delete 204 | Deploy to real target, validate deployment |
+| 15–17 | Apache/HAProxy, Traefik/Caddy, IIS | — | (Covered by source checks in Parts 42–46) | Requires real services or Windows |
+| 18 | Agent Operations | 3 | Heartbeat (register), metadata check, auto-create on heartbeat | Agent binary behavior, key storage, discovery scan |
+| 19 | Agent Work Routing | 1 | Empty work for agent with no targets | Scoped job assignment, multi-target fan-out |
+| 20 | Post-Deployment Verification | 1 | 404 on nonexistent job verification | TLS probing, fingerprint comparison |
+| 21 | EST Server | 2 | CACerts (200 + content-type), CSRAttrs (200/204) | simpleenroll with CSR, simplereenroll, PKCS#7 parsing |
+| 22 | Certificate Export | 3 | PEM export, PKCS#12 export, 404 on nonexistent | Download mode, file content validation |
+| 25 | Certificate Discovery | 5 | List discovered, summary, list scan targets, create target, invalid CIDR 400 | Agent filesystem scan, claim/dismiss workflow |
+| 26 | Enhanced Query API | 4 | Sort descending, cursor pagination, time-range filter, invalid sort field | Field projection correctness, cursor token cycling |
+| 27 | Request Body Size Limits | 1 | 2MB body rejected (413/400) | Exact limit boundary (1MB) |
+| 28 | CLI | SKIP | — | Requires compiled `certctl-cli` binary |
+| 29 | MCP Server | SKIP | — | Requires compiled `mcp-server` binary + stdio |
+| 30 | Observability | 7 | Dashboard summary, certs by status, expiration timeline, job trends, issuance rate, JSON metrics (uptime + gauges), Prometheus (content-type + 4 metric names) | Chart rendering (GUI), Grafana import |
+| 31 | Notifications | 2 | List, 404 on nonexistent | Notification content, mark-read, email/Slack delivery |
+| 32 | Audit Trail | 3 | List events (≥10), PUT immutability, DELETE immutability | Actor attribution, body hash, time range filters |
+| 33 | Background Scheduler | SKIP | — | Timing-dependent; verify via Docker logs |
+| 34 | Structured Logging | SKIP | — | Requires Docker log inspection |
+| 35 | GUI Testing | SKIP | — | Requires browser |
+| 36–37 | Issuer Catalog, Frontend Audit | SKIP | — | Requires browser |
+| 38 | Error Handling | 5 | Malformed JSON, missing required field, method not allowed, UTF-8 CN, empty body | Stack trace suppression, error response format |
+| 39 | Performance | 5 | List certs < 200ms, stats < 500ms, metrics < 200ms, Prometheus < 300ms, audit < 500ms | Load testing, concurrent request handling |
+| 40 | Documentation | 8 | README, quickstart, architecture, connectors, compliance exist; migration guides exist; 8 issuer types in docs; 11 target types in docs | Content accuracy, link validity |
+| 41 | Regression | 3 | DELETE 204, per_page max fallback, network scan target seed count | `errors.Is(errors.New())` anti-pattern source scan |
+| 42 | Envoy Target | 5 | Domain type, connector file, test file, OpenAPI, agent dispatch | Envoy deployment test, SDS config |
+| 43 | Postfix/Dovecot | 3 | Domain types (Postfix + Dovecot), connector file, OpenAPI | Mail server deployment test |
+| 44 | SSH Target | 4 | Domain type, connector file, agent dispatch (`sshconn`), OpenAPI | SSH deployment test (requires target host) |
+| 45 | Windows Certificate Store | 3 | Domain type, connector file, shared certutil package | Windows deployment (requires Windows) |
+| 46 | Java Keystore | 3 | Domain type, connector file, OpenAPI | JKS deployment (requires keytool) |
+| 47 | Certificate Digest Email | 3 | Preview endpoint (200/503), service file, adapter file | SMTP delivery, HTML template rendering |
+| 48 | Dynamic Issuer Config | 4 | Crypto package exists, create ACME issuer via API, config redaction check, migration exists | Test connection flow, registry rebuild |
+| 49 | Dynamic Target Config | 2 | Create NGINX target via API, migration exists | Test connection via agent heartbeat |
+| 50 | Onboarding Wizard | 2 | Wizard component exists, docker-compose split (clean vs demo) | Wizard UI flow, step completion |
+| 51 | ACME Profile Selection | 3 | Profile module exists, frontend config, RFC 9702→9773 renumber check | Profile-aware issuance against real CA |
+| 52 | Helm Chart | 5 | Chart.yaml, values.yaml, 4 templates exist, securityContext, health probes | `helm template` rendering, `helm install` |
+| 53 | Kubernetes Secrets Target Connector (M47) | 18 | Config validation (namespace DNS-1123, secret name DNS subdomain, label keys, required fields), deployment (create/update Secret, chain concatenation, error propagation), validation (serial comparison, not-found, empty cert) | GUI target wizard KubernetesSecrets fields (namespace, secret_name, labels, kubeconfig_path), Helm RBAC toggle, TargetDetailPage type label |
+| 54 | AWS ACM Private CA Issuer Connector (M47) | 23 | Config validation (region, CA ARN regex, signing algorithm whitelist, validity_days, defaults), issuance (full flow, empty CSR, errors), renewal (reuses issuance), revocation (reason mapping, default, errors), GetOrderStatus completed, GetCACertPEM (success/chain/error), GetRenewalInfo nil | GUI issuer wizard AWSACMPCA fields (region, ca_arn, signing_algorithm, validity_days, template_arn), seed data visibility, create issuer flow |
+
+**Totals:** ~164 automated subtests, 11 fully skipped Parts, ~282 manual tests remaining.
+
+## Test Categories
+
+The automated tests fall into four categories:
+
+### 1. API Integration Tests (majority)
+Make real HTTP requests to the running server and verify status codes, response structure, and JSON field values. Examples:
+- `POST /api/v1/certificates` with valid payload → 201
+- `GET /api/v1/certificates?status=Active` → all returned certs have `status: "Active"`
+- `DELETE /api/v1/certificates/mc-qa-full` → 204
+
+### 2. Database Verification Tests
+Connect directly to PostgreSQL and verify schema state:
+- Table count ≥ 19 (from migrations 000001–000010)
+- Useful for catching migration regressions
+
+### 3. Source File Verification Tests
+Read files from the repo checkout and verify structure:
+- Domain types exist in `internal/domain/connector.go` (e.g., `TargetTypeEnvoy`)
+- Connector implementations exist (e.g., `internal/connector/target/envoy/envoy.go`)
+- Documentation contains expected content (all issuer/target types listed)
+- No stale RFC 9702 references (replaced by RFC 9773)
+
+### 4. Performance Spot Checks
+Timed API requests with threshold assertions:
+- `GET /api/v1/certificates?per_page=15` < 200ms
+- `GET /api/v1/stats/summary` < 500ms
+- `GET /api/v1/metrics/prometheus` < 300ms
+
+## What This Test Does NOT Cover
+
+These gaps must be filled by manual testing per `docs/testing-guide.md`:
+
+### External CA Integrations (Parts 10–13)
+- **Sub-CA mode** — requires CA cert+key files on disk
+- **ACME ARI** — requires a CA that supports RFC 9773 Renewal Information
+- **Vault PKI** — requires a running HashiCorp Vault instance
+- **DigiCert / Sectigo / Google CAS** — requires sandbox API credentials
+
+### Browser/GUI Testing (Parts 35–37, 50)
+- Dashboard chart rendering (Recharts)
+- Onboarding wizard step-by-step flow
+- Issuer catalog card layout and create wizard
+- Bulk operations UI (multi-select, progress bars)
+- Discovery triage workflow
+
+### Real Deployment Testing (Parts 15–17)
+- NGINX/Apache/HAProxy file write + reload
+- Traefik/Caddy file provider or API reload
+- IIS PowerShell/WinRM (requires Windows)
+- F5 BIG-IP iControl REST (requires appliance or mock)
+- SSH agentless deployment (requires target host)
+
+### Agent Binary Behavior (Parts 18, 28–29)
+- Agent-side ECDSA key generation and CSR submission
+- Agent filesystem discovery scan
+- CLI tool (`certctl-cli`) — all 10 subcommands
+- MCP server (`mcp-server`) — stdio transport
+
+### Timing-Dependent Tests (Parts 33–34)
+- Background scheduler loop execution (renewal, jobs, health, notifications, digest, network scan)
+- Structured logging format verification (requires Docker log parsing)
+
+## How This Relates to `integration_test.go`
+
+Both files live in `deploy/test/` in the same Go package (`integration_test`):
+
+| | `qa_test.go` | `integration_test.go` |
+|---|---|---|
+| **Build tag** | `//go:build qa` | `//go:build integration` |
+| **Target stack** | Demo (`docker-compose.yml` + `docker-compose.demo.yml`) | Test (`docker-compose.test.yml`) |
+| **Port** | 8443 | Different (test stack config) |
+| **Seed data** | `seed_demo.sql` (32 certs, 8 agents, realistic history) | Minimal (created by tests) |
+| **CA backends** | Local CA only (demo mode) | Pebble ACME, step-ca, NGINX |
+| **Purpose** | Release QA — broad coverage, spot checks | Functional — end-to-end issuance, renewal, revocation against real CAs |
+| **Run frequency** | Before each release tag | CI on every PR |
+
+They are complementary. Integration tests prove the machinery works. QA tests prove the product works at release quality.
+
+## Seed Data Reference
+
+The QA tests depend on `migrations/seed_demo.sql`. Key IDs used:
+
+### Certificates (32 total)
+`mc-api-prod`, `mc-web-prod`, `mc-pay-prod`, `mc-dash-prod`, `mc-data-prod`, `mc-search-prod`, `mc-admin-prod`, `mc-blog-prod`, `mc-docs-prod`, `mc-status-prod`, `mc-grpc-prod`, `mc-vault-prod`, `mc-consul-prod`, `mc-shop-prod`, `mc-auth-prod`, `mc-cdn-prod`, `mc-mail-prod`, `mc-ci-prod`, `mc-legacy-prod`, `mc-old-api`, `mc-wiki-prod`, `mc-api-stg`, `mc-web-stg`, `mc-pay-stg`, `mc-api-dev`, `mc-grafana-prod`, `mc-vpn-prod`, `mc-wildcard-prod`, `mc-compromised`, `mc-edge-eu`, `mc-k8s-ingress`, `mc-smime-bob`
+
+### Agents (9 total)
+`ag-web-prod`, `ag-web-staging`, `ag-lb-prod`, `ag-iis-prod`, `ag-data-prod`, `ag-edge-01`, `ag-k8s-prod`, `ag-mac-dev`, `server-scanner` (sentinel)
+
+### Issuers (9 total)
+`iss-local`, `iss-acme-le`, `iss-stepca`, `iss-acme-zs`, `iss-openssl`, `iss-vault`, `iss-digicert`, `iss-sectigo`, `iss-googlecas`
+
+### Targets (8 total)
+`tgt-nginx-prod`, `tgt-nginx-staging`, `tgt-haproxy-prod`, `tgt-apache-prod`, `tgt-iis-prod`, `tgt-traefik-prod`, `tgt-caddy-prod`, `tgt-nginx-data`
+
+### Network Scan Targets (4 total)
+`nst-dc1-web`, `nst-dc2-apps`, `nst-dmz`, `nst-edge`
+
+## Troubleshooting
+
+### "Server unreachable" on startup
+The test pings `GET /health` before running anything. If this fails:
+```bash
+# Check if the stack is running
+docker compose -f docker-compose.yml -f docker-compose.demo.yml ps
+
+# Check server logs
+docker compose -f docker-compose.yml -f docker-compose.demo.yml logs certctl-server
+
+# Check if the port is exposed
+curl -s http://localhost:8443/health
+```
+
+### "connect to QA DB" failure
+The database tests connect directly to PostgreSQL. Ensure port 5432 is exposed:
+```bash
+docker compose -f docker-compose.yml -f docker-compose.demo.yml port postgres 5432
+```
+
+### Performance tests flaking
+The performance thresholds (200ms, 300ms, 500ms) assume a local Docker stack. On slow CI runners or remote Docker hosts, increase the thresholds or skip Part 39:
+```bash
+go test -tags qa -v -run 'TestQA/Part(?!39)' ./...
+```
+
+### Source file checks failing
+The `fileExists` and `fileContains` helpers read from `CERTCTL_QA_REPO_DIR` (default `../..`). If running from a non-standard location:
+```bash
+CERTCTL_QA_REPO_DIR=/absolute/path/to/certctl go test -tags qa -v ./...
+```
+
+## Adding New Tests
+
+When a new feature ships:
+
+1. **Add a Part section** in `qa_test.go` following the numbering in `docs/testing-guide.md`
+2. **API tests**: use `c.get()`, `c.post()`, `c.bodyStr()`, `c.getJSON()`, `c.timedGet()`
+3. **Source checks**: use `fileExists(t, "relative/path")` and `fileContains(t, "path", "substring")`
+4. **DB checks**: use `openQADB(t)` and `db.queryInt(t, "SELECT ...")`
+5. **Cleanup**: always use `t.Cleanup()` for data created during tests
+6. **Skip if external**: use `t.Skip("Requires X — manual test")` with a clear reason
+
+## Version History
+
+- **v1.0** (April 2026) — Initial release covering all 52 Parts of testing-guide.md v2.1. Replaces `qa-smoke-test.sh`.
+- **v1.1** (April 2026) — Added Parts 53–54 (M47: Kubernetes Secrets target + AWS ACM PCA issuer). 54 Parts total, ~164 automated subtests.

docs/quickstart.md

@@ -43,6 +43,8 @@ On Linux, follow the official Docker install guide for your distribution.
 
 ## Start Everything
 
+### Docker Compose (Quick Start)
+
 ```bash
 git clone https://github.com/shankar0123/certctl.git
 cd certctl
@@ -58,6 +60,37 @@ cp deploy/.env.example deploy/.env
 docker compose -f deploy/docker-compose.yml up -d --build
 ```
 
+### Docker Compose Environments
+
+The `deploy/` directory contains four compose files for different use cases:
+
+| File | Purpose | How to run |
+|------|---------|------------|
+| `docker-compose.yml` | **Base platform.** PostgreSQL + certctl server + agent. Clean dashboard with onboarding wizard — use this for production or first-time setup. | `docker compose -f deploy/docker-compose.yml up --build` |
+| `docker-compose.demo.yml` | **Demo data override.** Layers 180 days of realistic seed data (15 certs, 5 agents, multiple issuers) onto the base. Dashboard charts and tables look populated on first boot. | `docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.demo.yml up --build` |
+| `docker-compose.dev.yml` | **Development override.** Adds PgAdmin (port 5050), debug-level logging, and a Delve debugger port (40000) for the server. | `docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.dev.yml up --build` |
+| `docker-compose.test.yml` | **Integration test environment.** 7 containers on a static-IP subnet: PostgreSQL, certctl server+agent, step-ca, Pebble ACME server, challenge test server, and NGINX. Runs the full issuance→deployment→verification flow against real CA backends. Standalone — does not combine with the base file. | `docker compose -f deploy/docker-compose.test.yml up --build` |
+
+Override files are layered onto the base with multiple `-f` flags. The test environment is self-contained and runs independently. To reset any environment's data, add `down -v` to remove volumes.
+
+For a deep dive into every service, environment variable, and networking decision, see the [Docker Compose Environments Guide](../deploy/ENVIRONMENTS.md).
+
+### Kubernetes with Helm
+
+For production deployments on Kubernetes, use the Helm chart:
+
+```bash
+helm install certctl deploy/helm/certctl/ \
+  --create-namespace --namespace certctl \
+  --set server.auth.apiKey="your-secure-api-key" \
+  --set postgresql.auth.password="your-db-password" \
+  --set ingress.enabled=true \
+  --set ingress.hosts[0].host="certctl.example.com" \
+  --set ingress.hosts[0].tls=true
+```
+
+The chart includes: server Deployment (with configurable replicas, health probes, security context), PostgreSQL StatefulSet with persistent volumes, agent DaemonSet (one agent per infrastructure node), optional Ingress with TLS, and ServiceAccount with RBAC. All certctl configuration options are exposed in `values.yaml` — customize issuer settings, target connectors, scheduler intervals, and notifier credentials there.
+
 Wait about 30 seconds for PostgreSQL to initialize, then verify:
 
 ```bash
@@ -83,7 +116,11 @@ curl http://localhost:8443/health
 
 Open **http://localhost:8443** in your browser.
 
-The dashboard comes pre-loaded with 15 demo certificates across multiple teams, environments, and statuses — expiring certs, expired certs, active certs, failed renewals. A realistic snapshot of what certificate management looks like in a real organization.
+> **Note:** The Docker Compose demo runs with authentication disabled (`CERTCTL_AUTH_TYPE=none`) so you can explore immediately. For production, set `CERTCTL_AUTH_TYPE=api-key` and `CERTCTL_AUTH_SECRET=<your-secret>` in your environment, then pass `Authorization: Bearer <your-secret>` on all API requests. The dashboard will prompt for your API key on first load.
+>
+> **Key rotation:** `CERTCTL_AUTH_SECRET` accepts comma-separated keys (e.g., `CERTCTL_AUTH_SECRET=new-key,old-key`). Both keys are valid simultaneously, enabling zero-downtime rotation: add the new key, roll clients over, then remove the old key.
+
+The dashboard comes pre-loaded with 35 demo certificates across 5 issuers, 8 agents, and 90 days of job history — expiring certs, expired certs, active certs, failed renewals, revocations, discovery scans, and approval workflows. A realistic snapshot of what certificate management looks like in a real organization.
 
 ### What you're looking at
 
@@ -105,7 +142,7 @@ Explore the sidebar: Certificates, Agents, Policies, Jobs, Audit Trail, Notifica
 
 **"I need to approve a renewal before it proceeds"** — Click "Jobs" in the sidebar. You'll see an amber banner: "2 jobs awaiting approval." These are renewal jobs for `auth-production` and `payments-production` that require human sign-off before proceeding. Click Approve or Reject with a reason — the decision is recorded in the audit trail.
 
-**"Show me the agent fleet"** — Click "Agents." Four agents online, one offline. Click "Fleet Overview" for OS/architecture grouping, version distribution, and per-platform listing. Agents generate ECDSA P-256 keys locally — private keys never leave your infrastructure.
+**"Show me the agent fleet"** — Click "Agents." Eight agents across Linux, macOS, and Windows platforms—most online, showing OS, architecture, IP, and version metadata. A ninth entry (server-scanner) is the sentinel agent used for network certificate discovery. Click "Fleet Overview" for OS/architecture grouping, version distribution, and per-platform listing. Agents generate ECDSA P-256 keys locally — private keys never leave your infrastructure.
 
 **"What about bulk operations?"** — On the Certificates page, select multiple certificates with checkboxes. A bulk action bar appears: trigger renewal, revoke with reason codes, or reassign ownership — all with progress tracking. At 47-day lifespans with hundreds of certs, bulk operations aren't optional.
 
@@ -249,9 +286,11 @@ curl -s -X POST http://localhost:8443/api/v1/certificates/$CERT_ID/revoke \
 
 Supported RFC 5280 reason codes: `unspecified`, `keyCompromise`, `caCompromise`, `affiliationChanged`, `superseded`, `cessationOfOperation`, `certificateHold`, `privilegeWithdrawn`.
 
-Confirm via CRL:
+Confirm via the unauthenticated DER CRL (RFC 5280 §5, RFC 8615):
 ```bash
-curl -s http://localhost:8443/api/v1/crl | jq .
+# Fetch the CRL without any API key — relying parties shouldn't need one.
+curl -s http://localhost:8443/.well-known/pki/crl/iss-local -o /tmp/crl.der
+openssl crl -inform der -in /tmp/crl.der -noout -text | head -40
 ```
 
 ### Interactive approval workflow
@@ -342,6 +381,35 @@ export CERTCTL_API_KEY="test-key-123"
 ./certctl-cli status                   # Health + stats
 ```
 
+## Scheduled Certificate Digest Emails
+
+Enable automatic HTML digest emails with certificate stats, expiration timeline, and job health:
+
+```bash
+# Set SMTP configuration
+export CERTCTL_SMTP_HOST=smtp.gmail.com
+export CERTCTL_SMTP_PORT=587
+export CERTCTL_SMTP_USERNAME=admin@example.com
+export CERTCTL_SMTP_PASSWORD=your-app-password
+export CERTCTL_SMTP_FROM_ADDRESS=certctl@example.com
+export CERTCTL_SMTP_USE_TLS=true
+
+# Enable digest and set recipients
+export CERTCTL_DIGEST_ENABLED=true
+export CERTCTL_DIGEST_INTERVAL=24h
+export CERTCTL_DIGEST_RECIPIENTS=ops@example.com,security@example.com
+```
+
+Preview the digest HTML before enabling scheduled delivery:
+```bash
+curl http://localhost:8443/api/v1/digest/preview | jq '.html' | grep -o '<html>' # Shows HTML is ready
+
+# Trigger a digest send immediately (outside of schedule)
+curl -X POST http://localhost:8443/api/v1/digest/send
+```
+
+If no recipients are configured (`CERTCTL_DIGEST_RECIPIENTS` empty), the digest falls back to certificate owner emails. Digests include total certificates, expiring soon, expired, active agents, completed/failed jobs (30-day summary), and a table of expiring certs color-coded by urgency (7/14/30 days).
+
 ## MCP Server (AI Integration)
 
 ```bash
@@ -353,24 +421,25 @@ export CERTCTL_API_KEY="test-key-123"
 ./mcp-server
 ```
 
-Exposes 78 MCP tools covering the REST API via stdio transport. Ask Claude: "What certificates are expiring in the next 30 days?", "Revoke the payments cert due to key compromise", "Show me the audit trail."
+Exposes the full REST API via MCP over stdio transport. Ask Claude: "What certificates are expiring in the next 30 days?", "Revoke the payments cert due to key compromise", "Show me the audit trail."
 
 ## Demo Data Reference
 
 | Resource | Count | Examples |
 |----------|-------|---------|
-| Teams | 5 | Platform, Security, Payments, Frontend, Data |
-| Owners | 5 | Alice, Bob, Carol, Dave, Eve |
-| Issuers | 4 | Local Dev CA, Let's Encrypt Staging, step-ca Internal, DigiCert (disabled) |
-| Agents | 6 | ag-web-prod, ag-web-staging, ag-lb-prod, ag-iis-prod, ag-data-prod, server-scanner (network discovery) |
-| Targets | 5 | NGINX (prod/staging/data), F5 LB, IIS |
-| Certificates | 15 | Various statuses: Active, Expiring, Expired, Failed, Wildcard |
-| Discovered Certs | 9 | 5 Unmanaged (filesystem + network), 2 Managed (linked), 1 Dismissed, network-discovered expired printer cert |
-| Discovery Scans | 3 | Agent filesystem scans + network TLS scan |
-| Network Scan Targets | 3 | DC1 Web Servers, DC2 Application Tier, DMZ Public Endpoints |
-| Jobs (Approval) | 2 | AwaitingApproval renewal jobs for auth-prod and payments-prod |
+| Teams | 6 | Platform, Security, Payments, Frontend, Data, DevOps |
+| Owners | 6 | Alice, Bob, Carol, Dave, Eve, Frank |
+| Issuers | 5 | Local Dev CA, Let's Encrypt Staging, step-ca Internal, ZeroSSL (EAB), Custom OpenSSL CA |
+| Agents | 9 | 8 real agents (linux/darwin/windows, amd64/arm64) + server-scanner (network discovery) |
+| Targets | 8 | NGINX prod, NGINX staging, NGINX data, HAProxy, Apache, IIS, Traefik, Caddy |
+| Certificates | 35 | Active, Expiring, Expired, Failed, Revoked, RenewalInProgress, Wildcard, S/MIME |
+| Jobs | 50+ | 90 days of issuance, renewal, deployment jobs + 2 AwaitingApproval |
+| Discovered Certs | 12 | Unmanaged (filesystem + network), Managed (linked), Dismissed |
+| Discovery Scans | 8 | Historical + recent agent filesystem scans + network TLS scans |
+| Network Scan Targets | 4 | DC1 Web Servers, DC2 Application Tier, DMZ Public Endpoints, Edge Locations |
+| Audit Events | 55+ | 90 days of lifecycle events (issuance, renewal, deployment, revocation, discovery) |
 | Policies | 4 | Required owner, allowed environments, max lifetime, min renewal window |
-| Profiles | 4 | Standard TLS, Internal mTLS, Short-Lived, High Security |
+| Profiles | 5 | Standard TLS, Internal mTLS, Short-Lived, High Security, S/MIME Email |
 | Agent Groups | 5 | Linux agents, ARM agents, Production subnet, etc. |
 
 ## Dashboard Demo Mode
@@ -409,7 +478,10 @@ The `-v` flag removes the PostgreSQL data volume for a clean slate.
 
 ## What's Next
 
+**Ready to deploy with your stack?** The [Deployment Examples](examples.md) page has 5 turnkey docker-compose scenarios — pick the one closest to your setup and have it running in minutes. It also covers migration paths from Certbot, acme.sh, and cert-manager.
+
+- **[Deployment Examples](examples.md)** — ACME+NGINX, wildcard DNS-01, private CA+Traefik, step-ca+HAProxy, multi-issuer
 - **[Advanced Demo](demo-advanced.md)** — Issue a real certificate via the Local CA end-to-end
 - **[Architecture](architecture.md)** — How the control plane, agents, and connectors work together
-- **[Connector Guide](connectors.md)** — Build custom connectors for your infrastructure
+- **[Connector Reference](connectors.md)** — Configuration for all 7 issuers and 10 targets
 - **[Concepts Guide](concepts.md)** — TLS certificates, CAs, and private keys explained from scratch

docs/why-certctl.md

@@ -1,82 +1,119 @@
 # Why certctl?
 
-Certificate management is broken at every scale between "one domain on Let's Encrypt" and "Fortune 500 budget for Venafi."
+Certificate management is broken at every scale between "one domain on Let's Encrypt" and "Fortune 500 budget for Venafi." certctl fills that gap: a self-hosted platform that automates the entire certificate lifecycle, works with any CA, deploys to any server, and keeps private keys on your infrastructure. It's free, source-available, and you own everything.
 
-If you run a personal blog, Certbot works fine. If your company spends $200K/year on Keyfactor, you're covered. But if you're an ops engineer managing 20-500 certificates across NGINX, Apache, HAProxy, and maybe a private CA — the tools available today either don't do enough or cost too much.
+## The Math That Forces the Decision
 
-certctl fills that gap.
+The CA/Browser Forum passed [Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) in April 2025, mandating a phased reduction in TLS certificate lifetimes: **200 days** as of March 2026, **100 days** by March 2027, and **47 days** by March 2029.
 
-## The Problem
+At 47-day lifespans, a team managing 100 certificates is processing **7+ renewals per week**, every week, forever. At 200 certificates, it's two per day. Manual processes, calendar reminders, and certbot cron jobs don't scale to this — a single missed renewal becomes a production outage at 3 AM. Certificate lifecycle automation is no longer optional; the only question is what tool runs it.
 
-The CA/Browser Forum passed [Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) in April 2025, mandating a phased reduction in TLS certificate lifetimes: 200 days as of March 2026, 100 days by March 2027, and 47 days by March 2029. That means every organization needs automated certificate renewal — not eventually, but now.
+## The Landscape Today
 
-The existing options for automation are:
+If you're evaluating your options, here's what you'll find:
 
-- **ACME clients** (Certbot, Lego, CertWarden): Handle issuance and renewal for ACME-compatible CAs, but don't manage deployment to target servers, don't provide inventory visibility, don't support non-ACME CAs, and don't offer audit trails or policy enforcement.
-- **Kubernetes-native** (cert-manager): Works well inside Kubernetes, but if your infrastructure includes bare-metal servers, VMs, or network appliances alongside Kubernetes, you need a separate solution for everything cert-manager can't reach.
-- **Commercial SaaS** (CertKit, Sectigo CLM): Handle more of the lifecycle but are proprietary, cloud-dependent, and priced per certificate — costs scale linearly with your infrastructure.
-- **Enterprise platforms** (Venafi, Keyfactor, AppViewX): Comprehensive but start at $75K/year and require dedicated teams to operate.
+**ACME clients** (certbot, lego, acme.sh) handle issuance and renewal for Let's Encrypt and similar CAs, but they don't deploy to target servers, don't track inventory, don't support private CAs, and give you no audit trail or policy enforcement. You end up writing glue scripts and hoping they don't break.
+
+**Kubernetes-native tools** (cert-manager) work well inside the cluster, but most organizations run mixed infrastructure — NGINX on VMs, HAProxy at the edge, IIS on Windows, maybe an F5. You need a separate solution for everything outside Kubernetes.
+
+**Commercial SaaS platforms** handle more of the lifecycle but are proprietary, cloud-dependent, and priced per certificate. At 100 certs and 20 agents, SaaS pricing runs $3,000-5,000/year and scales linearly. You're paying rent on your own infrastructure's security.
+
+**Enterprise platforms** (Venafi, Keyfactor, AppViewX) are comprehensive but start at $75K/year and require dedicated teams to operate. If you have a 50-server environment, the licensing costs more than the servers.
 
 ## What certctl Does Differently
 
-certctl is a self-hosted certificate lifecycle platform. It handles issuance, renewal, deployment, revocation, discovery, and monitoring — with three design decisions that no other tool at any price point combines:
+certctl handles issuance, renewal, deployment, revocation, discovery, and monitoring — with three design decisions that no other tool at any price point combines:
 
 ### 1. Private Keys Never Leave Your Infrastructure
 
-certctl agents generate private keys locally using ECDSA P-256. The agent creates a CSR and submits it to the control plane. The signed certificate comes back. The private key stays on the agent's filesystem with 0600 permissions.
+certctl agents generate ECDSA P-256 private keys locally. The agent creates a CSR and submits it to the control plane. The signed certificate comes back. The private key stays on the agent's filesystem with 0600 permissions — it never crosses the network.
 
-This isn't a premium feature — it's the default behavior in the free tier. Most competitors either generate keys server-side (creating a single point of compromise) or gate key isolation behind paid tiers.
+This isn't a premium feature. It's the default behavior, free. Most alternatives either generate keys on the server (creating a single point of compromise) or gate key isolation behind paid tiers.
 
 ### 2. CA-Agnostic Issuer Architecture
 
-certctl works with any certificate authority, not just ACME providers:
+certctl works with any certificate authority, not just ACME providers. Nine issuer connectors ship today, all free:
 
-- **ACME** (Let's Encrypt, ZeroSSL, Google Trust Services, Buypass) — HTTP-01 and DNS-01 challenges, DNS-PERSIST-01 for zero-touch renewals, External Account Binding
-- **step-ca** (Smallstep) — native /sign API with JWK provisioner authentication
-- **Local CA** — self-signed or sub-CA mode (chain to your enterprise root CA, e.g. ADCS)
-- **OpenSSL / Custom CA** — delegate signing to any shell script with configurable timeout
-- **EST enrollment** (RFC 7030) — device certificate enrollment for WiFi/802.1X, MDM, and IoT
+- **ACME v2** (Let's Encrypt, ZeroSSL, Google Trust Services, Buypass) — HTTP-01, DNS-01, DNS-PERSIST-01 challenges, External Account Binding, ACME Renewal Information (RFC 9773), certificate profile selection
+- **HashiCorp Vault PKI** — `/v1/{mount}/sign/{role}` API, token auth
+- **DigiCert CertCentral** — async order model, OV/EV support
+- **Sectigo SCM** — async order model, DV/OV/EV support, 3-header auth
+- **Google Cloud CAS** — Certificate Authority Service, OAuth2 service account auth, CA pool selection
+- **step-ca** (Smallstep) — native /sign API with JWK provisioner auth
+- **Local CA** — self-signed or sub-CA mode (chain to ADCS or any enterprise root)
+- **OpenSSL / Custom CA** — delegate signing to any shell script
+- **EST enrollment** (RFC 7030) — device certs for WiFi/802.1X, MDM, IoT
 
-Every issuer connector implements the same interface. Switching CAs or running multiple CAs in parallel requires zero code changes — just configuration.
+Every connector implements the same interface. Running multiple CAs in parallel — Let's Encrypt for public certs, Vault for internal services, your enterprise CA for legacy systems — is configuration, not code.
 
 ### 3. Post-Deployment Verification
 
-Every other tool in this space stops at "the deployment command succeeded." certctl goes further: after deploying a certificate to a target, the agent connects back to the target's TLS endpoint and verifies the served certificate matches what was deployed, using SHA-256 fingerprint comparison.
+Every other tool in this space stops at "the deployment command succeeded." certctl goes further: after deploying a certificate, the agent connects back to the live TLS endpoint and compares the SHA-256 fingerprint of the served certificate against what was deployed.
 
-A reload command can exit 0 while the certificate doesn't take effect — wrong virtual host, stale cache, config that validates but doesn't apply. certctl catches this.
+A reload command can exit 0 while the certificate doesn't take effect — wrong virtual host, stale cache, config that validates but doesn't apply. certctl catches this automatically.
+
+## What Else Ships Free
+
+The three differentiators above get the headlines, but the feature surface is wider than most paid platforms:
+
+**13 deployment targets** — NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, IIS (local PowerShell + remote WinRM), F5 BIG-IP (proxy agent + iControl REST), Postfix, Dovecot, SSH (agentless), Windows Certificate Store, and Java Keystore. All use a pluggable connector model. The control plane never initiates outbound connections — agents poll for work, meaning certctl works behind firewalls, across network zones, and in air-gapped environments.
+
+**Network certificate discovery** — active TLS scanning of CIDR ranges finds certificates you didn't know existed. Agents also scan local filesystems for PEM/DER files. Everything feeds into a triage workflow where you claim, dismiss, or import discovered certs into management.
+
+**Immutable audit trail** — every API call recorded (method, path, actor, body hash, status, latency). Every certificate lifecycle event tracked. Append-only, no update or delete. Mapped to SOC 2, PCI-DSS 4.0, and NIST SP 800-57 compliance frameworks with published evidence guides.
+
+**Policy engine** — 5 rule types (allowed issuers, allowed domains, required metadata, allowed environments, renewal lead time) with violation tracking and severity levels.
+
+**PKI compliance** — DER-encoded X.509 CRL signed by issuing CA, embedded OCSP responder, RFC 5280 revocation with all reason codes, short-lived certificate exemption.
+
+**Prometheus metrics** — `/api/v1/metrics/prometheus` in standard exposition format. Works with Prometheus, Grafana Agent, Datadog Agent, Victoria Metrics.
+
+**MCP server** — the entire REST API is exposed via MCP for AI-assisted certificate management via Claude, Cursor, or any MCP-compatible client. No other certificate platform offers this.
+
+**Full REST API** — OpenAPI 3.1-documented operations covering the entire platform. CLI tool with 10 subcommands. Helm chart for Kubernetes deployment. Scheduled certificate digest emails. Certificate export in PEM and PKCS#12. S/MIME support with EKU-aware issuance.
+
+**Extensively tested** — Go backend with race detection, static analysis (golangci-lint), and vulnerability scanning (govulncheck) on every commit. CI-enforced per-layer coverage thresholds. Frontend test suite. Every push is gated.
 
 ## How certctl Compares
 
-### vs. CertKit
+### vs. ACME Clients
 
-Closest competitor architecturally — agent-based, private key isolation (Keystore), multi-platform. certctl leads on issuer coverage (ACME + step-ca + Local CA + OpenSSL + EST vs. ACME-only), PKI compliance (CRL, OCSP, RFC 5280 revocation, immutable audit trail — all missing from CertKit today), policy engine (5 rule types vs. none), and network discovery (CIDR TLS scanning vs. none). certctl is source-available (BSL 1.1 → Apache 2.0) with no cert limit; CertKit is proprietary SaaS with a 3-cert free tier. Where CertKit leads: more deployment targets today (adds LiteSpeed, IIS, auto-detection), Windows support, Kubernetes, and polished SaaS onboarding.
+ACME clients solve one slice of the problem — issuance and renewal from ACME CAs. certctl replaces the ACME client, adds 6 more CA integrations, deploys the cert to the right server, verifies it's live, tracks it in an inventory, alerts on expiry, logs everything to an audit trail, and enforces policy. If you're currently running certbot behind a cron job and a prayer, certctl replaces all of it.
 
-### vs. KeyTalk
+### vs. Agent-Based SaaS
 
-Commercial (proprietary) PKI platform from a Dutch company — on-prem appliance, cloud, or managed service. Broader cert type coverage (TLS, S/MIME, device auth, VPN) and DigiCert + SCEP integrations. No public documentation on policy engine, API surface, or audit capabilities. No free tier, no public pricing. certctl trades breadth of cert types for full transparency — source-available, public API spec, free community edition with no limits.
+The closest architectural competitors use the same agent model — local key generation, CSR submission, push-based deployment. Where certctl differs: it supports 9 issuer types (not just ACME), provides CRL/OCSP/revocation infrastructure (not just issuance), includes a policy engine and network discovery, and is source-available with no certificate limit. SaaS alternatives are typically proprietary, priced per certificate ($2+/cert/month), and cap their free tiers at 3-5 certificates. certctl is free for any number of certificates, forever.
 
-### vs. Enterprise Platforms (Venafi, Keyfactor)
+### vs. Commercial PKI Platforms
 
-Comprehensive solutions with decades of features — at $75K-$250K+/yr. certctl targets organizations that need 80% of those capabilities at 1% of the cost. The trade-off: no SSO/RBAC yet (coming in certctl Pro), no F5/IIS target connectors yet, no SLA-backed support.
+On-prem or hosted commercial platforms offer broader cert type coverage (VPN certs, device auth, SCEP) and deeper CA integrations. The trade-off: no free tier, opaque pricing (often €13K+/year for 1,500 certs), proprietary codebases, and no public API documentation. certctl trades breadth of exotic cert types for full transparency — source-available code, fully documented OpenAPI spec, and a free community edition with no artificial limits.
 
-## Getting Started
+### vs. Enterprise Platforms
+
+Venafi and Keyfactor offer decades of features at $75K-$250K+/year. certctl targets organizations that need 80% of those capabilities at a fraction of the cost. What certctl doesn't have yet: SSO/RBAC (coming in certctl Pro), vendor SLA-backed support. What certctl does have that enterprise platforms don't: an MCP server for AI-assisted management, ACME ARI (RFC 9773) for CA-directed renewal timing, and a deployment model that works in 5 minutes instead of 5 months.
+
+## Who Should Look Elsewhere
+
+certctl isn't the right tool for everyone:
+
+- **Single-domain sites** — if you have one certificate on one server, certbot is fine. certctl is designed for managing tens to hundreds of certificates across multiple servers and CAs.
+- **Pure Kubernetes environments** — if every workload runs in-cluster and you're happy with cert-manager, there's no reason to add another tool. certctl shines when your infrastructure extends beyond Kubernetes.
+- **Organizations that need a vendor SLA today** — certctl is source-available software maintained by a small team. If you need contractual uptime guarantees and a support hotline, an enterprise platform is the right choice (for now).
+
+## See It Running
+
+The demo seeds certificates across multiple issuers, agents, and deployment targets with 180 days of realistic history — jobs, audit events, discovery scans, approval workflows — so you can explore every feature immediately.
 
 ```bash
-# Clone and start with Docker Compose (includes demo data)
 git clone https://github.com/shankar0123/certctl.git
-cd certctl/deploy
-docker compose up -d
-
-# Open the dashboard
-open http://localhost:8443
+cd certctl/deploy && docker compose up -d
+# Dashboard at http://localhost:8443
 ```
 
-The demo seeds 15 certificates, 5 agents, 5 deployment targets, discovery data, network scan targets, and pending approval jobs so you can explore every feature immediately.
-
-See the [Quickstart Guide](quickstart.md) for a full walkthrough.
+See the [Quickstart Guide](quickstart.md) for a full walkthrough, or explore the [5 turnkey examples](../examples/) for specific scenarios (ACME+NGINX, wildcard DNS-01, private CA+Traefik, step-ca+HAProxy, multi-issuer).
 
 ## License
 
-certctl is licensed under the [Business Source License 1.1](../LICENSE). The licensed work is free to use for any purpose other than offering a competing managed service. The license converts to Apache 2.0 on March 1, 2033.
+certctl is source-available under the [Business Source License 1.1](../LICENSE). Free for any use except offering a competing managed service. Converts to Apache 2.0 on March 14, 2033.
 
-The source is available, auditable, and self-hostable. You own your data, your keys, and your deployment.
+You own your data, your keys, and your deployment.

examples/acme-nginx/acme-nginx.md

@@ -0,0 +1,372 @@
+# certctl + NGINX + Let's Encrypt
+
+This example demonstrates certctl's core use case: **automatically manage TLS certificates for NGINX using Let's Encrypt (ACME HTTP-01 challenges).**
+
+## What This Does
+
+- Deploys certctl server (control plane) with PostgreSQL
+- Deploys certctl agent on the same network (in production: on your NGINX server)
+- Configures Let's Encrypt as the certificate issuer via ACME v2
+- Demonstrates HTTP-01 challenge solving (requires port 80 open to the internet)
+- Shows how to set up 3 example domains for certificate enrollment and renewal
+- Automatically renews certificates 30 days before expiration
+
+## Architecture
+
+```mermaid
+flowchart TD
+    A["Your Domain (example.com)"]
+    B["Let's Encrypt ACME"]
+    C["certctl Server (control plane)"]
+    D["certctl Agent (on NGINX server)"]
+    E["NGINX Reverse Proxy"]
+
+    A -->|HTTP-01 validation<br/>port 80| B
+    B -->|CSR submission| C
+    C -->|API polling| D
+    D -->|deploy cert+key| E
+```
+
+## Prerequisites
+
+1. **Docker & Docker Compose** (v20.10+)
+2. **A domain name** pointing to your server (e.g., `example.com`)
+3. **Ports 80 and 443 open** to the internet (ACME HTTP-01 needs port 80)
+4. **Valid email address** for Let's Encrypt account (errors and renewal notices)
+
+If you don't have a real domain or can't open port 80, see [Customization Tips](#customization-tips) below.
+
+## Quick Start
+
+### 1. Clone or copy this example
+
+```bash
+cd examples/acme-nginx
+```
+
+### 2. Create a `.env` file with your settings
+
+```bash
+cat > .env <<'EOF'
+# Your email for Let's Encrypt account
+ACME_EMAIL=admin@example.com
+
+# Database password (change this in production!)
+DB_PASSWORD=certctl-demo-password
+
+# Agent API key (generate a real one in production)
+AGENT_API_KEY=agent-demo-key
+
+# Server port (certctl listens here internally on 8443; expose as needed)
+SERVER_PORT=8443
+EOF
+```
+
+### 3. (Optional) Create an NGINX config
+
+If you have a real domain and want NGINX to route traffic:
+
+```bash
+cat > nginx.conf <<'EOF'
+events {
+    worker_connections 1024;
+}
+
+http {
+    # HTTP block for ACME challenges
+    server {
+        listen 80;
+        server_name example.com www.example.com api.example.com;
+
+        # ACME challenge directory (certctl writes validation files here)
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+        }
+
+        # Redirect HTTP to HTTPS
+        location / {
+            return 301 https://$server_name$request_uri;
+        }
+    }
+
+    # HTTPS block (certificates deployed here by certctl agent)
+    server {
+        listen 443 ssl http2;
+        server_name example.com www.example.com api.example.com;
+
+        ssl_certificate /etc/nginx/ssl/example.com.crt;
+        ssl_certificate_key /etc/nginx/ssl/example.com.key;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers HIGH:!aNULL:!MD5;
+
+        location / {
+            proxy_pass http://upstream-service;
+        }
+    }
+}
+EOF
+```
+
+Or just accept the default empty NGINX config for demonstration.
+
+### 4. Start the stack
+
+```bash
+docker compose up -d
+```
+
+Monitor logs:
+```bash
+docker compose logs -f certctl-server certctl-agent
+```
+
+### 5. Access the dashboard
+
+Navigate to `http://localhost:8443` (or your `SERVER_PORT`)
+
+You should see:
+- An empty certificate inventory (no certs issued yet)
+- One ACME issuer ("iss-acme") configured and ready
+- One agent ("nginx-agent-01") online and heartbeating
+
+### 6. Create a certificate profile
+
+In the certctl dashboard:
+1. Go to **Profiles** (sidebar)
+2. Click **New Profile**
+3. Set:
+   - Name: `acme-prod`
+   - Key Type: `RSA-2048` (or `ECDSA-P256`)
+   - Max TTL: `90 days`
+   - Allowed Key Types: `RSA-2048, ECDSA-P256`
+4. Save
+
+### 7. Request a certificate
+
+In the certctl dashboard:
+1. Go to **Certificates** (sidebar)
+2. Click **Request New Certificate**
+3. Set:
+   - Common Name: `example.com`
+   - SANs: `www.example.com`, `api.example.com` (optional)
+   - Issuer: `iss-acme` (Let's Encrypt)
+   - Profile: `acme-prod`
+4. Click **Request**
+
+Behind the scenes:
+- Server creates an `Issuance` job
+- Agent polls for work, fetches the job
+- Agent generates a P-256 key (never sent to server)
+- Agent submits CSR to server
+- Server sends CSR to Let's Encrypt ACME
+- Let's Encrypt provides HTTP-01 challenge token
+- Server downloads ACME challenge, returns to agent
+- Agent deploys challenge file to NGINX `/.well-known/acme-challenge/`
+- Let's Encrypt validates (HTTP GET to `http://example.com/.well-known/acme-challenge/...`)
+- Let's Encrypt issues certificate
+- Server receives certificate, passes to agent
+- Agent deploys cert+key to `/etc/nginx/ssl/example.com.crt` + `.key`
+- Agent reloads NGINX (`nginx -s reload`)
+- Certificate is now active
+
+### 8. View the certificate
+
+In the dashboard:
+1. Go to **Certificates**
+2. Click the certificate to see:
+   - Common name, SANs, serial number
+   - Issuer (Let's Encrypt), not-before/after dates
+   - Status (Active, Expiring in N days, Expired)
+   - Deployment history (timestamps, agent name, target)
+   - Next auto-renewal date (30 days before expiration)
+
+### 9. Set up automatic renewal
+
+The server automatically checks for certificates expiring within 30 days and triggers renewal. You can:
+- Adjust the threshold in the certificate's policy
+- Manually trigger renewal via dashboard button
+- View renewal job status and history
+
+## How It Works
+
+### Certificate Lifecycle
+
+1. **Request** — Operator creates certificate request via dashboard or API
+2. **CSR Generation** — Agent generates private key locally, submits CSR to server
+3. **ACME Challenge** — Server communicates with Let's Encrypt ACME, obtains challenge
+4. **Challenge Proof** — Agent deploys challenge proof to NGINX
+5. **Issuance** — Let's Encrypt validates, issues certificate
+6. **Deployment** — Agent receives certificate, deploys to NGINX SSL directory
+7. **Reload** — Agent signals NGINX to reload (`nginx -s reload`)
+8. **Verification** — Agent optionally verifies the live TLS endpoint (handshake fingerprint)
+9. **Renewal** — 30 days before expiration, process repeats automatically
+
+### HTTP-01 Challenge
+
+ACME HTTP-01 works like this:
+1. Let's Encrypt generates random token (e.g., `abc123def456`)
+2. Server returns token to agent
+3. Agent writes file: `/.well-known/acme-challenge/abc123def456` with value (random key material)
+4. Let's Encrypt performs HTTP GET to `http://example.com/.well-known/acme-challenge/abc123def456`
+5. If content matches, domain ownership is proven
+6. Certificate is issued
+
+**Requirements:**
+- Port 80 must be open to the internet
+- DNS must resolve your domain to your server
+- NGINX must serve `/.well-known/acme-challenge/` (or certctl mounts a separate directory)
+
+### Agent Key Generation
+
+Keys are generated **on the agent**, never on the server:
+1. Agent creates ECDSA P-256 keypair using `crypto/ecdsa`
+2. Private key is stored locally on agent at `/var/lib/certctl/keys/` (readable only by certctl process)
+3. Agent creates CSR (certificate signing request) with private key
+4. Agent submits CSR to server
+5. Server never sees the private key
+6. Certificate is returned, agent stores it alongside key
+7. Both key and cert used for NGINX deployment
+
+This keeps private keys in the infrastructure where they're used, following zero-trust principles.
+
+## Adding More Domains
+
+### Option 1: Additional SANs on Same Certificate
+
+Edit the existing certificate in the dashboard:
+1. Click the certificate
+2. Edit SANs to add `mail.example.com`, `ftp.example.com`, etc.
+3. Trigger renewal
+4. Agent generates new CSR with all SANs
+5. Let's Encrypt validates each SAN (HTTP-01 for each)
+6. Single certificate with multiple SANs is issued
+
+### Option 2: Separate Certificates per Domain
+
+If you want separate certificates (different issuance schedules, different targets):
+1. Dashboard → **Certificates** → **Request New Certificate**
+2. Common Name: `subdomain.example.com`
+3. Set same issuer and profile
+4. Request
+
+Each domain gets its own cert, key, and renewal schedule.
+
+### Wildcard Certificates (Not HTTP-01)
+
+HTTP-01 does **not** support wildcard (`*.example.com`). To issue wildcards, use DNS-01 challenge (see [acme-wildcard-dns01](../acme-wildcard-dns01/) example).
+
+## Customization Tips
+
+### Using Let's Encrypt Staging (for testing)
+
+Staging has higher rate limits and doesn't require real domains:
+
+```bash
+# In .env or docker-compose.yml override:
+CERTCTL_ACME_DIRECTORY_URL=https://acme-staging-v02.api.letsencrypt.org/directory
+```
+
+Staging certificates won't be trusted by browsers (fake CA), but you can test the full flow without hitting production rate limits.
+
+### Disabling Port 80 Requirement (Demo Mode)
+
+If you can't open port 80, use ACME DNS-01 instead (requires DNS provider integration). See [acme-wildcard-dns01](../acme-wildcard-dns01/) example.
+
+Or use Local CA for internal testing:
+```bash
+# Switch issuer to Local CA (not public-trusted, but no challenge needed)
+CERTCTL_ACME_DIRECTORY_URL=  # Leave empty to disable ACME
+# (then configure Local CA instead)
+```
+
+### Custom NGINX Config
+
+Replace `nginx.conf` with your own before `docker compose up`. The agent doesn't manage the NGINX config — it only deploys certificates. You're responsible for:
+- Configuring SSL paths (`ssl_certificate`, `ssl_certificate_key`)
+- Setting up challenge directory (`/.well-known/acme-challenge/`)
+- Pointing NGINX to agent-deployed certificates
+
+### Database Persistence
+
+PostgreSQL data is stored in the `postgres_data` volume. To reset:
+```bash
+docker compose down -v  # Destroy all volumes
+```
+
+### Viewing Agent Logs
+
+```bash
+docker compose logs -f certctl-agent
+```
+
+Look for:
+- `Heartbeat successful` — agent is communicating with server
+- `CSR submitted` — key generation and CSR submission worked
+- `Deployment succeeded` — certificate deployed to NGINX
+- `NGINX reload` — signal sent to reload
+
+### Testing ACME Without Real Domain
+
+Use `nip.io` (free DNS service):
+1. Deploy to a server with a public IP
+2. Use domain: `<your-ip>.nip.io` (e.g., `203.0.113.45.nip.io`)
+3. Let's Encrypt will validate to that IP
+4. Change ACME_EMAIL to a real email you control
+
+## Production Checklist
+
+Before running in production:
+
+- [ ] Change `DB_PASSWORD` to a strong random password
+- [ ] Generate a real API key for the agent (don't use the demo key)
+- [ ] Enable `CERTCTL_AUTH_TYPE=api-key` and enforce authentication
+- [ ] Use Let's Encrypt production directory (not staging)
+- [ ] Configure `CERTCTL_CORS_ORIGINS` to restrict cross-origin access
+- [ ] Use `CERTCTL_KEYGEN_MODE=agent` (default, but verify)
+- [ ] Set `CERTCTL_LOG_LEVEL=warn` to reduce log noise
+- [ ] Configure email notifications for certificate expiration alerts
+- [ ] Set up log aggregation (Datadog, ELK, Splunk, etc.)
+- [ ] Use docker secrets or external secret manager for credentials (not .env)
+- [ ] Run agent on actual NGINX servers (not co-located with server for HA)
+- [ ] Set up monitoring and alerting on agent heartbeat and job completion
+- [ ] Implement backup/restore for PostgreSQL
+- [ ] Use TLS for certctl server (terminate at reverse proxy or load balancer)
+
+## Troubleshooting
+
+### Agent heartbeat failing
+```bash
+docker compose logs certctl-agent
+# Check: CERTCTL_SERVER_URL, CERTCTL_API_KEY, network connectivity
+```
+
+### ACME challenge failing
+```bash
+# Ensure port 80 is open: curl http://example.com/.well-known/acme-challenge/test
+# Check NGINX is running and serving /.well-known/acme-challenge/
+# Verify DNS resolves domain to your server: dig example.com
+```
+
+### NGINX reload failing
+Check agent permissions on NGINX socket and that NGINX is reachable from agent container.
+
+### Let's Encrypt rate limited
+Let's Encrypt has rate limits (50 certs per domain per week). Use staging to test, or wait a week.
+
+### Certificate not deployed to NGINX
+Check agent logs for deployment errors. Verify `/etc/nginx/ssl` volume is writable by agent container.
+
+## Next Steps
+
+- **Wildcard certificates**: See [acme-wildcard-dns01](../acme-wildcard-dns01/) example
+- **Multiple issuers**: See [multi-issuer](../multi-issuer/) example
+- **Private CA**: See [private-ca-traefik](../private-ca-traefik/) example
+- **Dashboard deep dive**: Read [docs/quickstart.md](../../docs/quickstart.md)
+- **REST API**: Explore [api/openapi.yaml](../../api/openapi.yaml)
+
+## Support
+
+For issues or questions:
+- Check [docs/troubleshooting.md](../../docs/troubleshooting.md)
+- Open an issue on GitHub
+- Review server and agent logs: `docker compose logs -f`

examples/acme-nginx/docker-compose.yml

@@ -0,0 +1,146 @@
+version: '3.8'
+
+services:
+  # PostgreSQL database for certctl
+  postgres:
+    image: postgres:16-alpine
+    container_name: certctl-postgres-acme-nginx
+    environment:
+      POSTGRES_DB: certctl
+      POSTGRES_USER: certctl
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-certctl-dev-password}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U certctl -d certctl']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # certctl server (control plane)
+  certctl-server:
+    image: ghcr.io/shankar0123/certctl-server:latest
+    container_name: certctl-server-acme-nginx
+    environment:
+      # Database
+      CERTCTL_DATABASE_URL: postgres://certctl:${DB_PASSWORD:-certctl-dev-password}@postgres:5432/certctl?sslmode=disable
+
+      # Server settings
+      CERTCTL_SERVER_PORT: 8443
+      CERTCTL_SERVER_HOST: 0.0.0.0
+
+      # Auth (disabled for demo; production should use API keys)
+      CERTCTL_AUTH_TYPE: none
+
+      # CORS (allow agent communication)
+      CERTCTL_CORS_ORIGINS: '*'
+
+      # Key generation mode (agent-side in production, server-side for demo)
+      CERTCTL_KEYGEN_MODE: agent
+
+      # ACME issuer configuration
+      # This registers the Let's Encrypt ACME issuer
+      CERTCTL_ACME_DIRECTORY_URL: https://acme-v02.api.letsencrypt.org/directory
+      CERTCTL_ACME_EMAIL: ${ACME_EMAIL:-admin@example.com}
+      CERTCTL_ACME_CHALLENGE_TYPE: http-01
+
+      # Local CA as fallback for internal services (optional)
+      CERTCTL_CA_CERT_PATH: /etc/certctl/ca.crt
+      CERTCTL_CA_KEY_PATH: /etc/certctl/ca.key
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+    ports:
+      - '${SERVER_PORT:-8443}:8443'
+    depends_on:
+      postgres:
+        condition: service_healthy
+    networks:
+      - certctl-network
+    healthcheck:
+      test: ['CMD-SHELL', 'curl -sf http://localhost:8443/health || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+
+  # certctl agent (runs on the target machine with NGINX)
+  # In this example, the agent is in the same compose file for simplicity.
+  # In production, the agent runs on each server that needs certificates.
+  certctl-agent:
+    image: ghcr.io/shankar0123/certctl-agent:latest
+    container_name: certctl-agent-acme-nginx
+    environment:
+      # Control plane connection
+      CERTCTL_SERVER_URL: http://certctl-server:8443
+      CERTCTL_API_KEY: ${AGENT_API_KEY:-agent-demo-key}
+
+      # Key generation (agent-side keys, never sent to server)
+      CERTCTL_KEYGEN_MODE: agent
+      CERTCTL_KEY_DIR: /var/lib/certctl/keys
+
+      # Discovery (scan existing certs so operator knows what's already deployed)
+      CERTCTL_DISCOVERY_DIRS: /etc/nginx/ssl
+
+      # Heartbeat interval
+      CERTCTL_HEARTBEAT_INTERVAL: 30s
+
+      # Agent metadata (self-reported)
+      CERTCTL_AGENT_NAME: nginx-agent-01
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+    volumes:
+      # Mount NGINX config and cert directories
+      # In production, these would be the actual NGINX paths
+      - nginx_certs:/etc/nginx/ssl
+      - nginx_conf:/etc/nginx/conf.d
+      # Agent key storage (persisted across restarts)
+      - agent_keys:/var/lib/certctl/keys
+    depends_on:
+      certctl-server:
+        condition: service_healthy
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # NGINX reverse proxy / web server
+  # This is where certificates will be deployed
+  nginx:
+    image: nginx:alpine
+    container_name: certctl-nginx-acme-nginx
+    ports:
+      - '80:80'
+      - '443:443'
+    volumes:
+      - nginx_conf:/etc/nginx/conf.d
+      - nginx_certs:/etc/nginx/ssl
+      # Default NGINX config (if not provided by agent)
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+    depends_on:
+      - certctl-agent
+    networks:
+      - certctl-network
+    healthcheck:
+      test: ['CMD-SHELL', 'wget --quiet --tries=1 --spider http://localhost/ || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+
+networks:
+  certctl-network:
+    driver: bridge
+
+volumes:
+  postgres_data:
+    driver: local
+  nginx_certs:
+    driver: local
+  nginx_conf:
+    driver: local
+  agent_keys:
+    driver: local

examples/acme-wildcard-dns01/acme-wildcard-dns01.md

@@ -0,0 +1,306 @@
+# ACME Wildcard DNS-01 Example
+
+**What this does:** Issues wildcard certificates (e.g., `*.example.com`) from Let's Encrypt using DNS-01 challenge validation.
+
+This example is ideal for:
+- Issuing wildcard certificates (`*.example.com`)
+- Services behind NAT, firewalls, or non-public networks
+- Batch issuance of multiple domains in parallel
+- Internal PKI with public DNS names
+- Scenarios where you have programmatic access to your DNS provider's API
+
+## Prerequisites
+
+Before running this example, you need:
+
+1. **A domain name** (e.g., `example.com`) that you control and can manage DNS records for
+2. **DNS provider credentials:**
+   - **Cloudflare** (example included): API token with DNS:write permission + Zone ID
+   - **Route53 (AWS)**: AWS access key + secret key
+   - **Azure DNS**: Azure subscription ID + credentials
+   - **Other providers**: See "Adapting for Other DNS Providers" below
+3. **Docker and Docker Compose** installed
+
+## Quick Start (Cloudflare)
+
+### Step 1: Get Cloudflare Credentials
+
+1. Log in to [Cloudflare Dashboard](https://dash.cloudflare.com)
+2. Select your domain (e.g., `example.com`)
+3. In the sidebar, find **Zone ID** (copy this)
+4. Go to **Account Settings > API Tokens**
+5. Create a new token with these scopes:
+   - **Zone > Zone:Read** (to list DNS records)
+   - **Zone > DNS:Write** (to create/delete challenge records)
+6. Copy the API token
+
+### Step 2: Set Environment Variables
+
+Create a `.env` file in this directory:
+
+```bash
+# .env
+CLOUDFLARE_API_TOKEN=your-api-token-here
+CLOUDFLARE_ZONE_ID=your-zone-id-here
+ACME_EMAIL=admin@example.com
+DB_PASSWORD=your-secure-db-password
+```
+
+Or export them in your shell:
+
+```bash
+export CLOUDFLARE_API_TOKEN="your-api-token-here"
+export CLOUDFLARE_ZONE_ID="your-zone-id-here"
+export ACME_EMAIL="admin@example.com"
+export DB_PASSWORD="your-secure-db-password"
+```
+
+### Step 3: Make DNS Scripts Executable
+
+```bash
+chmod +x dns-hooks/*.sh
+```
+
+### Step 4: Start the Stack
+
+```bash
+docker compose up -d
+```
+
+This starts:
+- **certctl-server** (port 8443): Control plane and ACME orchestrator
+- **postgres**: Certificate metadata database
+- **certctl-agent**: Certificate deployment agent
+
+### Step 5: Access the Dashboard
+
+Open your browser to `http://localhost:8443`
+
+### Step 6: Create a Wildcard Certificate
+
+1. Go to **Issuers** page
+2. Verify the ACME issuer is registered
+3. Go to **Certificates** > **New Certificate**
+4. Fill in:
+   - **Issuer:** ACME (Let's Encrypt)
+   - **Common Name:** `*.example.com`
+   - **Subject Alt Names:** `example.com` (to also cover the root domain)
+5. Click **Request**
+
+The renewal job will:
+1. Send a request to Let's Encrypt
+2. Run `dns-hooks/cloudflare-present.sh` to create `_acme-challenge.example.com` TXT record
+3. Wait for Let's Encrypt to verify the TXT record
+4. Issue the certificate
+5. Run `dns-hooks/cloudflare-cleanup.sh` to delete the temporary TXT record
+
+### Step 7: Monitor the Job
+
+Go to **Jobs** page to see the renewal progress:
+- **AwaitingCSR**: Agent is generating the CSR
+- **Running**: ACME challenge in progress (DNS record being validated)
+- **Completed**: Certificate issued and stored
+- **Failed**: Check logs for errors (e.g., DNS provider API issues)
+
+## How DNS-01 Works
+
+The DNS-01 challenge proves you own a domain by creating a DNS TXT record:
+
+```
+_acme-challenge.example.com TXT "acme-validation-token-xxxxx"
+```
+
+Let's Encrypt then queries this TXT record. Once verified, it issues the certificate and certctl cleans up the TXT record.
+
+**Why DNS-01 is better than HTTP-01 for wildcards:**
+- HTTP-01 requires a public web server; DNS-01 works anywhere
+- Wildcard certificates require DNS proof (not HTTP)
+- DNS challenges can be solved for multiple domains in parallel
+- No need for public IP or inbound port 80/443
+
+## Adapting for Other DNS Providers
+
+The example uses Cloudflare, but certctl supports **any DNS provider via pluggable shell scripts**.
+
+### AWS Route53
+
+Replace the `CERTCTL_ACME_DNS_PRESENT_SCRIPT` and `CERTCTL_ACME_DNS_CLEANUP_SCRIPT` in `docker-compose.yml` with:
+- `./dns-hooks/route53-present.sh`
+- `./dns-hooks/route53-cleanup.sh`
+
+Example script outline (using AWS CLI):
+
+```bash
+#!/bin/bash
+DOMAIN="$1"
+VALIDATION_TOKEN="$2"
+
+# Get Route53 hosted zone ID for the domain
+ZONE_ID=$(aws route53 list-hosted-zones --query \
+  "HostedZones[?Name=='$DOMAIN.'].Id" --output text | cut -d'/' -f3)
+
+# Create TXT record
+aws route53 change-resource-record-sets \
+  --hosted-zone-id "$ZONE_ID" \
+  --change-batch "{
+    \"Changes\": [{
+      \"Action\": \"CREATE\",
+      \"ResourceRecordSet\": {
+        \"Name\": \"_acme-challenge.$DOMAIN\",
+        \"Type\": \"TXT\",
+        \"TTL\": 120,
+        \"ResourceRecords\": [{\"Value\": \"\\\"$VALIDATION_TOKEN\\\"\"}]
+      }
+    }]
+  }"
+```
+
+### Azure DNS
+
+```bash
+#!/bin/bash
+DOMAIN="$1"
+VALIDATION_TOKEN="$2"
+
+# Set Azure credentials via environment variables
+# AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP, AZURE_TENANT_ID, etc.
+
+az network dns record-set txt create \
+  --resource-group "$AZURE_RESOURCE_GROUP" \
+  --zone-name "$DOMAIN" \
+  --name "_acme-challenge" \
+  --ttl 120 \
+  --txt-value "$VALIDATION_TOKEN"
+```
+
+### Generic DNS Provider (using dig + TSIG)
+
+If your DNS provider supports NSUPDATE (RFC 2136):
+
+```bash
+#!/bin/bash
+DOMAIN="$1"
+VALIDATION_TOKEN="$2"
+
+nsupdate <<EOF
+zone $DOMAIN
+update add _acme-challenge.$DOMAIN 120 TXT "$VALIDATION_TOKEN"
+send
+EOF
+```
+
+### Manual DNS (for testing)
+
+Replace scripts with no-ops during testing:
+
+```bash
+#!/bin/bash
+echo "Please create: _acme-challenge.$1 TXT $2"
+sleep 60  # Manual wait for you to create the record
+```
+
+## Alternative: DNS-PERSIST-01 (Standing Records)
+
+If your DNS provider supports it, use **DNS-PERSIST-01** for zero-maintenance renewals.
+
+Instead of creating a new TXT record for each renewal, you create one standing record once:
+
+```
+_validation-persist.example.com TXT "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/12345678"
+```
+
+Then every renewal uses the same record — no cleanup scripts needed!
+
+To enable in `docker-compose.yml`:
+
+```yaml
+CERTCTL_ACME_CHALLENGE_TYPE: dns-persist-01
+CERTCTL_ACME_DNS_PERSIST_ISSUER_DOMAIN: letsencrypt.org
+```
+
+Certctl will:
+1. Fetch your ACME account URI
+2. Create the standing `_validation-persist` record once
+3. Reuse it for all future renewals (no per-renewal DNS updates)
+
+## Security Notes
+
+1. **API Token Scope:** Restrict Cloudflare/AWS tokens to DNS:write only (not full account access)
+2. **Key Generation:** This example uses agent-side key generation (`CERTCTL_KEYGEN_MODE=agent`), which is production-standard. Private keys never leave the agent.
+3. **Script Safety:** The DNS scripts run in the certctl-server container. For production:
+   - Validate script inputs (already done in certctl code)
+   - Log all API calls
+   - Monitor for failed DNS operations
+   - Use a separate proxy agent for DNS operations if needed
+
+## Troubleshooting
+
+### DNS record not created
+
+Check the server logs:
+
+```bash
+docker logs certctl-server-dns01
+```
+
+Look for lines like:
+- `[certctl DNS-01] Creating DNS record: _acme-challenge.example.com`
+- `Error: Cloudflare API failed: ...`
+
+**Common issues:**
+- Missing or invalid `CLOUDFLARE_API_TOKEN`
+- Invalid `CLOUDFLARE_ZONE_ID`
+- API token doesn't have DNS:write permission
+- Domain not in your Cloudflare account
+
+### DNS propagation timeout
+
+If the TLS negotiation fails, it might be DNS caching. Increase the wait time in the script:
+
+```bash
+sleep 30  # Increase from 10 to 30 seconds
+```
+
+### Let's Encrypt rate limits
+
+Let's Encrypt has strict rate limits:
+- 50 certificates per registered domain per week
+- 5 duplicate certificates per domain per week
+
+For testing, use the **staging directory**:
+
+```yaml
+CERTCTL_ACME_DIRECTORY_URL: https://acme-staging-v02.api.letsencrypt.org/directory
+```
+
+(Staging certs won't be trusted by browsers, but don't count against rate limits.)
+
+### Job fails with "CSR generation timeout"
+
+If your DNS provider is very slow, increase the timeout in the cleanup script or add a longer wait time:
+
+```bash
+sleep 60  # Wait 1 minute for DNS propagation
+```
+
+## Next Steps
+
+1. **Monitor renewals:** Set up notifications (email, Slack, PagerDuty) for renewal events
+2. **Deploy certificates:** Configure target connectors (NGINX, HAProxy, Traefik) to automatically deploy issued certs
+3. **Multi-domain:** Use certificate profiles to group wildcard + subdomain certs
+4. **Backup DNS scripts:** Version control your DNS provider scripts in git
+
+## Files in This Example
+
+- **docker-compose.yml** — Container stack definition with ACME DNS-01 configuration
+- **dns-hooks/cloudflare-present.sh** — Creates `_acme-challenge` TXT record (Cloudflare)
+- **dns-hooks/cloudflare-cleanup.sh** — Deletes `_acme-challenge` TXT record (Cloudflare)
+- **README.md** — This file
+
+## Additional Resources
+
+- [certctl Documentation](../../docs/)
+- [ACME Specification (RFC 8555)](https://tools.ietf.org/html/rfc8555)
+- [DNS-01 Challenge Details](https://letsencrypt.org/docs/challenge-types/#dns-01)
+- [DNS-PERSIST-01 (IETF Draft)](https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-persist)
+- [Let's Encrypt Documentation](https://letsencrypt.org/docs/)

examples/acme-wildcard-dns01/dns-hooks/cloudflare-cleanup.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+
+#
+# Cloudflare DNS-01 Challenge Script (CLEANUP)
+#
+# This script removes a DNS TXT record after ACME DNS-01 challenge validation.
+# Called by certctl after certificate issuance to clean up temporary challenge records.
+#
+# certctl sets these environment variables before invoking this script:
+#   CERTCTL_DNS_DOMAIN   - Base domain (e.g., "example.com")
+#   CERTCTL_DNS_FQDN     - Full challenge FQDN (e.g., "_acme-challenge.example.com")
+#   CERTCTL_DNS_VALUE    - Challenge value/token that was in the TXT record
+#
+# You must set these environment variables before running:
+#   CLOUDFLARE_API_TOKEN - Cloudflare API token with DNS:write permission
+#   CLOUDFLARE_ZONE_ID   - Cloudflare zone ID for your domain
+#
+# Error Handling:
+#   This script exits 0 on success, non-zero on failure.
+#   If cleanup fails, certctl logs the error but doesn't block renewals.
+#
+
+set -euo pipefail
+
+# Get values from certctl environment variables
+DOMAIN="${CERTCTL_DNS_DOMAIN:-}"
+RECORD_NAME="${CERTCTL_DNS_FQDN:-}"
+VALIDATION_TOKEN="${CERTCTL_DNS_VALUE:-}"
+
+# Validate inputs
+if [[ -z "$DOMAIN" || -z "$RECORD_NAME" || -z "$VALIDATION_TOKEN" ]]; then
+    echo "Error: Required certctl environment variables not set (CERTCTL_DNS_DOMAIN, CERTCTL_DNS_FQDN, CERTCTL_DNS_VALUE)" >&2
+    exit 1
+fi
+
+# Validate environment
+if [[ -z "${CLOUDFLARE_API_TOKEN:-}" ]]; then
+    echo "Error: CLOUDFLARE_API_TOKEN environment variable not set" >&2
+    exit 1
+fi
+
+if [[ -z "${CLOUDFLARE_ZONE_ID:-}" ]]; then
+    echo "Error: CLOUDFLARE_ZONE_ID environment variable not set" >&2
+    exit 1
+fi
+
+# Validate RECORD_NAME (set by certctl above)
+RECORD_TYPE="TXT"
+
+# Cloudflare API endpoint
+CF_API="https://api.cloudflare.com/client/v4"
+CF_ZONE="$CLOUDFLARE_ZONE_ID"
+CF_TOKEN="$CLOUDFLARE_API_TOKEN"
+
+echo "[certctl DNS-01] Cleaning up DNS record: $RECORD_NAME"
+
+# Step 1: Find the record ID
+RECORD_ID=$(curl -s -X GET \
+  "$CF_API/zones/$CF_ZONE/dns_records?name=$RECORD_NAME&type=$RECORD_TYPE" \
+  -H "Authorization: Bearer $CF_TOKEN" \
+  -H "Content-Type: application/json" \
+  | jq -r '.result | if length > 0 then .[0].id else "" end')
+
+if [[ -z "$RECORD_ID" ]]; then
+    echo "[certctl DNS-01] Record not found (already deleted?). Skipping cleanup."
+    exit 0
+fi
+
+# Step 2: Delete the record (DELETE /zones/{zone_id}/dns_records/{record_id})
+echo "[certctl DNS-01] Deleting DNS record (ID: $RECORD_ID)..."
+RESPONSE=$(curl -s -X DELETE \
+  "$CF_API/zones/$CF_ZONE/dns_records/$RECORD_ID" \
+  -H "Authorization: Bearer $CF_TOKEN" \
+  -H "Content-Type: application/json")
+
+# Check response success
+SUCCESS=$(echo "$RESPONSE" | jq -r '.success')
+if [[ "$SUCCESS" != "true" ]]; then
+    ERROR=$(echo "$RESPONSE" | jq -r '.errors[0].message // "Unknown error"')
+    echo "Warning: Cloudflare API failed to delete record: $ERROR" >&2
+    # Don't exit 1 here — DNS cleanup is best-effort; cleanup failures shouldn't block certs
+    exit 0
+fi
+
+echo "[certctl DNS-01] Successfully deleted DNS record"
+exit 0

examples/acme-wildcard-dns01/dns-hooks/cloudflare-present.sh

@@ -0,0 +1,108 @@
+#!/bin/bash
+
+#
+# Cloudflare DNS-01 Challenge Script (PRESENT)
+#
+# This script creates a DNS TXT record for ACME DNS-01 challenge validation.
+# Called by certctl during the renewal process to prove domain ownership.
+#
+# certctl sets these environment variables before invoking this script:
+#   CERTCTL_DNS_DOMAIN   - Base domain (e.g., "example.com")
+#   CERTCTL_DNS_FQDN     - Full challenge FQDN (e.g., "_acme-challenge.example.com")
+#   CERTCTL_DNS_VALUE    - Challenge value/token to place in the TXT record
+#
+# You must set these environment variables before running:
+#   CLOUDFLARE_API_TOKEN - Cloudflare API token with DNS:write permission
+#   CLOUDFLARE_ZONE_ID   - Cloudflare zone ID for your domain
+#                          (Find at: https://dash.cloudflare.com > Select Domain > Zone ID in sidebar)
+#
+# Error Handling:
+#   This script exits 0 on success, non-zero on failure.
+#   certctl will retry the renewal if this script fails.
+#
+
+set -euo pipefail
+
+# Get values from certctl environment variables
+DOMAIN="${CERTCTL_DNS_DOMAIN:-}"
+RECORD_NAME="${CERTCTL_DNS_FQDN:-}"
+VALIDATION_TOKEN="${CERTCTL_DNS_VALUE:-}"
+
+# Validate inputs
+if [[ -z "$DOMAIN" || -z "$RECORD_NAME" || -z "$VALIDATION_TOKEN" ]]; then
+    echo "Error: Required certctl environment variables not set (CERTCTL_DNS_DOMAIN, CERTCTL_DNS_FQDN, CERTCTL_DNS_VALUE)" >&2
+    exit 1
+fi
+
+# Validate environment
+if [[ -z "${CLOUDFLARE_API_TOKEN:-}" ]]; then
+    echo "Error: CLOUDFLARE_API_TOKEN environment variable not set" >&2
+    exit 1
+fi
+
+if [[ -z "${CLOUDFLARE_ZONE_ID:-}" ]]; then
+    echo "Error: CLOUDFLARE_ZONE_ID environment variable not set" >&2
+    exit 1
+fi
+
+# Validate RECORD_NAME (set by certctl above)
+RECORD_TYPE="TXT"
+RECORD_TTL=120  # Short TTL for challenge records (1-2 min)
+
+# Cloudflare API endpoint
+CF_API="https://api.cloudflare.com/client/v4"
+CF_ZONE="$CLOUDFLARE_ZONE_ID"
+CF_TOKEN="$CLOUDFLARE_API_TOKEN"
+
+echo "[certctl DNS-01] Creating DNS record: $RECORD_NAME = $VALIDATION_TOKEN"
+
+# Step 1: Check if record already exists (GET /zones/{zone_id}/dns_records)
+# This is optional but helps with idempotency
+EXISTING=$(curl -s -X GET \
+  "$CF_API/zones/$CF_ZONE/dns_records?name=$RECORD_NAME&type=$RECORD_TYPE" \
+  -H "Authorization: Bearer $CF_TOKEN" \
+  -H "Content-Type: application/json" \
+  | jq -r '.result | if length > 0 then .[0].id else "" end')
+
+if [[ -n "$EXISTING" ]]; then
+    echo "[certctl DNS-01] Record already exists (ID: $EXISTING). Updating..."
+    # Update existing record
+    RESPONSE=$(curl -s -X PUT \
+      "$CF_API/zones/$CF_ZONE/dns_records/$EXISTING" \
+      -H "Authorization: Bearer $CF_TOKEN" \
+      -H "Content-Type: application/json" \
+      -d "{
+        \"type\": \"$RECORD_TYPE\",
+        \"name\": \"$RECORD_NAME\",
+        \"content\": \"$VALIDATION_TOKEN\",
+        \"ttl\": $RECORD_TTL
+      }")
+else
+    echo "[certctl DNS-01] Creating new DNS record..."
+    # Create new record
+    RESPONSE=$(curl -s -X POST \
+      "$CF_API/zones/$CF_ZONE/dns_records" \
+      -H "Authorization: Bearer $CF_TOKEN" \
+      -H "Content-Type: application/json" \
+      -d "{
+        \"type\": \"$RECORD_TYPE\",
+        \"name\": \"$RECORD_NAME\",
+        \"content\": \"$VALIDATION_TOKEN\",
+        \"ttl\": $RECORD_TTL
+      }")
+fi
+
+# Check response success
+SUCCESS=$(echo "$RESPONSE" | jq -r '.success')
+if [[ "$SUCCESS" != "true" ]]; then
+    ERROR=$(echo "$RESPONSE" | jq -r '.errors[0].message // "Unknown error"')
+    echo "Error: Cloudflare API failed: $ERROR" >&2
+    exit 1
+fi
+
+RECORD_ID=$(echo "$RESPONSE" | jq -r '.result.id')
+echo "[certctl DNS-01] Successfully created/updated DNS record (ID: $RECORD_ID)"
+echo "[certctl DNS-01] Waiting for DNS propagation..."
+sleep 10
+
+exit 0

examples/acme-wildcard-dns01/docker-compose.yml

@@ -0,0 +1,171 @@
+version: '3.8'
+
+# ACME Wildcard DNS-01 Example
+#
+# This example demonstrates how to use certctl with Let's Encrypt to issue wildcard
+# certificates (*.example.com) using DNS-01 challenge validation.
+#
+# DNS-01 is ideal for:
+# - Wildcard certificates (*.domain.com)
+# - Services behind NAT or non-public networks
+# - Batch certificate issuance (multiple domains in parallel)
+#
+# It works by:
+# 1. certctl creates a renewal job for a wildcard certificate
+# 2. Let's Encrypt sends an ACME challenge: "create _acme-challenge TXT record with value X"
+# 3. certctl runs the dns-present.sh script to create the TXT record via your DNS provider API
+# 4. Let's Encrypt verifies the TXT record exists
+# 5. Certificate is issued
+# 6. certctl runs dns-cleanup.sh to remove the TXT record
+#
+# This compose file also demonstrates:
+# - ACME issuer with DNS-01 challenge type
+# - Pluggable DNS provider scripts (Cloudflare example included; adapt for Route53, Azure DNS, etc.)
+# - Wildcard and multi-SAN certificate support
+# - Agent-side key generation (production-ready)
+
+services:
+  # PostgreSQL database for certctl metadata
+  postgres:
+    image: postgres:16-alpine
+    container_name: certctl-postgres-dns01
+    environment:
+      POSTGRES_DB: certctl
+      POSTGRES_USER: certctl
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-certctl-dev-password}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U certctl -d certctl']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # certctl server (control plane + ACME orchestration)
+  certctl-server:
+    image: ghcr.io/shankar0123/certctl-server:latest
+    container_name: certctl-server-dns01
+    environment:
+      # Database
+      CERTCTL_DATABASE_URL: postgres://certctl:${DB_PASSWORD:-certctl-dev-password}@postgres:5432/certctl?sslmode=disable
+
+      # Server settings
+      CERTCTL_SERVER_PORT: 8443
+      CERTCTL_SERVER_HOST: 0.0.0.0
+
+      # Auth (disabled for demo; production should use API keys with CERTCTL_AUTH_TYPE=api-key)
+      CERTCTL_AUTH_TYPE: none
+
+      # CORS (allow agent communication)
+      CERTCTL_CORS_ORIGINS: '*'
+
+      # Key generation mode (agent-side: keys never leave agents; production standard)
+      CERTCTL_KEYGEN_MODE: agent
+
+      # ===== ACME Issuer Configuration (DNS-01 Wildcard) =====
+      # Let's Encrypt production directory (ACME v2)
+      CERTCTL_ACME_DIRECTORY_URL: https://acme-v02.api.letsencrypt.org/directory
+
+      # Email for certificate expiration notices and account recovery
+      CERTCTL_ACME_EMAIL: ${ACME_EMAIL:-admin@example.com}
+
+      # Challenge type: dns-01 (not http-01, which doesn't support wildcards)
+      CERTCTL_ACME_CHALLENGE_TYPE: dns-01
+
+      # DNS present script: creates _acme-challenge TXT record
+      # The script is mounted from ./dns-hooks/cloudflare-present.sh
+      # Arguments: $1 = domain (e.g., "example.com"), $2 = validation token
+      CERTCTL_ACME_DNS_PRESENT_SCRIPT: /etc/certctl/dns-hooks/cloudflare-present.sh
+
+      # DNS cleanup script: removes _acme-challenge TXT record
+      # Arguments: $1 = domain, $2 = validation token
+      CERTCTL_ACME_DNS_CLEANUP_SCRIPT: /etc/certctl/dns-hooks/cloudflare-cleanup.sh
+
+      # Optional: DNS propagation wait time (seconds) before proceeding to next challenge
+      # Default is 30s; increase if your DNS propagates slowly
+      # Set via CERTCTL_ACME_DNS_PROPAGATION_WAIT in code, or rely on default
+
+      # Optional: Let's Encrypt Renewal Information (RFC 9773) for CA-directed renewal timing
+      # CERTCTL_ACME_ARI_ENABLED: "true"
+
+      # Local CA as fallback for internal services (optional)
+      CERTCTL_CA_CERT_PATH: /etc/certctl/ca.crt
+      CERTCTL_CA_KEY_PATH: /etc/certctl/ca.key
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+
+    ports:
+      - '${SERVER_PORT:-8443}:8443'
+
+    volumes:
+      # Mount DNS provider scripts (adapt these for your DNS provider)
+      - ./dns-hooks:/etc/certctl/dns-hooks:ro
+
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+    networks:
+      - certctl-network
+
+    healthcheck:
+      test: ['CMD-SHELL', 'curl -sf http://localhost:8443/health || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+    restart: unless-stopped
+
+  # certctl agent (manages certificate deployment on target hosts)
+  # In production, run agents on each host that needs certificates.
+  # For demo, we include one agent in this compose.
+  certctl-agent:
+    image: ghcr.io/shankar0123/certctl-agent:latest
+    container_name: certctl-agent-dns01
+    environment:
+      # Control plane connection
+      CERTCTL_SERVER_URL: http://certctl-server:8443
+      CERTCTL_API_KEY: ${AGENT_API_KEY:-agent-demo-key}
+
+      # Key generation (agent-side keys: production-standard security model)
+      CERTCTL_KEYGEN_MODE: agent
+      CERTCTL_KEY_DIR: /var/lib/certctl/keys
+
+      # Discovery (scan existing certs so operator knows what's already deployed)
+      CERTCTL_DISCOVERY_DIRS: /etc/letsencrypt/live:/etc/ssl/certs
+
+      # Heartbeat interval (how often agent checks for work)
+      CERTCTL_HEARTBEAT_INTERVAL: 30s
+
+      # Agent metadata (self-reported to server)
+      CERTCTL_AGENT_NAME: wildcard-agent-01
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+
+    volumes:
+      # Agent persistent key storage (survives restarts)
+      - agent_keys:/var/lib/certctl/keys
+
+    depends_on:
+      certctl-server:
+        condition: service_healthy
+
+    networks:
+      - certctl-network
+
+    restart: unless-stopped
+
+networks:
+  certctl-network:
+    driver: bridge
+
+volumes:
+  postgres_data:
+    driver: local
+  agent_keys:
+    driver: local

examples/multi-issuer/docker-compose.yml

@@ -0,0 +1,150 @@
+version: '3.8'
+
+services:
+  # PostgreSQL database for certctl
+  postgres:
+    image: postgres:16-alpine
+    container_name: certctl-postgres-multi-issuer
+    environment:
+      POSTGRES_DB: certctl
+      POSTGRES_USER: certctl
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-certctl-dev-password}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U certctl -d certctl']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # certctl server (control plane)
+  # Configured with BOTH ACME (Let's Encrypt) and Local CA issuers
+  certctl-server:
+    image: ghcr.io/shankar0123/certctl-server:latest
+    container_name: certctl-server-multi-issuer
+    environment:
+      # Database
+      CERTCTL_DATABASE_URL: postgres://certctl:${DB_PASSWORD:-certctl-dev-password}@postgres:5432/certctl?sslmode=disable
+
+      # Server settings
+      CERTCTL_SERVER_PORT: 8443
+      CERTCTL_SERVER_HOST: 0.0.0.0
+
+      # Auth (disabled for demo; production should use API keys)
+      CERTCTL_AUTH_TYPE: none
+
+      # CORS (allow agent communication)
+      CERTCTL_CORS_ORIGINS: '*'
+
+      # Key generation mode (agent-side in production, server-side for demo)
+      CERTCTL_KEYGEN_MODE: server
+
+      # ACME issuer (Let's Encrypt for public-facing services)
+      # Change CERTCTL_ACME_EMAIL to your email and CERTCTL_ACME_CHALLENGE_TYPE as needed
+      CERTCTL_ACME_DIRECTORY_URL: https://acme-v02.api.letsencrypt.org/directory
+      CERTCTL_ACME_EMAIL: ${ACME_EMAIL:-admin@example.com}
+      CERTCTL_ACME_CHALLENGE_TYPE: http-01
+
+      # Local CA issuer (for internal services - self-signed or sub-CA)
+      # Set these paths if you have an existing CA cert+key for sub-CA mode
+      # Otherwise, leave empty for self-signed CA generation
+      CERTCTL_CA_CERT_PATH: ${CA_CERT_PATH:-}
+      CERTCTL_CA_KEY_PATH: ${CA_KEY_PATH:-}
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+    ports:
+      - '${SERVER_PORT:-8443}:8443'
+    depends_on:
+      postgres:
+        condition: service_healthy
+    networks:
+      - certctl-network
+    healthcheck:
+      test: ['CMD-SHELL', 'curl -sf http://localhost:8443/health || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+
+  # certctl agent (manages certificates on NGINX and application servers)
+  certctl-agent:
+    image: ghcr.io/shankar0123/certctl-agent:latest
+    container_name: certctl-agent-multi-issuer
+    environment:
+      # Control plane connection
+      CERTCTL_SERVER_URL: http://certctl-server:8443
+      CERTCTL_API_KEY: ${AGENT_API_KEY:-agent-demo-key}
+
+      # Key generation (agent-side keys, never sent to server)
+      CERTCTL_KEYGEN_MODE: server
+      CERTCTL_KEY_DIR: /var/lib/certctl/keys
+
+      # Discovery (scan existing certs to track what's already deployed)
+      CERTCTL_DISCOVERY_DIRS: /etc/nginx/ssl:/etc/app/ssl
+
+      # Heartbeat interval
+      CERTCTL_HEARTBEAT_INTERVAL: 30s
+
+      # Agent metadata
+      CERTCTL_AGENT_NAME: multi-issuer-agent-01
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+    volumes:
+      # Mount NGINX cert directories
+      - nginx_certs:/etc/nginx/ssl
+      - nginx_conf:/etc/nginx/conf.d
+      # Mount application service cert directory
+      - app_certs:/etc/app/ssl
+      # Agent key storage (persisted across restarts)
+      - agent_keys:/var/lib/certctl/keys
+    depends_on:
+      certctl-server:
+        condition: service_healthy
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # NGINX reverse proxy / web server
+  # This is where public TLS certs (from ACME) will be deployed
+  nginx:
+    image: nginx:alpine
+    container_name: certctl-nginx-multi-issuer
+    ports:
+      - '80:80'
+      - '443:443'
+    volumes:
+      - nginx_conf:/etc/nginx/conf.d
+      - nginx_certs:/etc/nginx/ssl
+      # Default NGINX config
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+    depends_on:
+      - certctl-agent
+    networks:
+      - certctl-network
+    healthcheck:
+      test: ['CMD-SHELL', 'wget --quiet --tries=1 --spider http://localhost/ || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+
+networks:
+  certctl-network:
+    driver: bridge
+
+volumes:
+  postgres_data:
+    driver: local
+  nginx_certs:
+    driver: local
+  nginx_conf:
+    driver: local
+  app_certs:
+    driver: local
+  agent_keys:
+    driver: local

examples/multi-issuer/multi-issuer.md

@@ -0,0 +1,244 @@
+# Multi-Issuer Example: ACME + Local CA
+
+This example demonstrates certctl managing **both public and internal certificates from a single dashboard**. Public-facing services use Let's Encrypt (ACME), while internal services use a private Local CA — all visible and managed in one place.
+
+## The Use Case
+
+You have:
+- **Public-facing services** (web app, API, etc.) that need TLS certs signed by a trusted public CA (Let's Encrypt)
+- **Internal services** (databases, microservices, middleware) that need TLS certs but don't require public trust
+- **One team** managing certs across both, needing unified visibility and automated renewal
+
+With certctl, both issuer types are configured and available. You assign each certificate to the appropriate issuer via its profile or at enrollment time. The dashboard shows all certs together, with renewal status, expiration timelines, and audit trails — regardless of which CA issued them.
+
+## Architecture
+
+```mermaid
+flowchart TD
+    subgraph Server ["certctl Server (Control Plane)"]
+        A["Let's Encrypt ACME issuer<br/>(HTTP-01 challenges)"]
+        B["Local CA issuer<br/>(self-signed or sub-CA mode)"]
+        C["PostgreSQL database<br/>(cert inventory, audit, jobs)"]
+    end
+
+    subgraph Agent ["certctl Agent"]
+        D["Discovers existing certs<br/>(/etc/nginx/ssl, /etc/app/ssl)"]
+        E["Polls server for<br/>renewal/issuance/deployment jobs"]
+        F["Generates keys locally<br/>(agent-side crypto)"]
+        G["Deploys certs to NGINX<br/>and app service directories"]
+    end
+
+    subgraph Targets ["Target Services"]
+        H["NGINX (public TLS)<br/>(Let's Encrypt certs)"]
+        I["App Services (internal TLS)<br/>(Local CA certs)"]
+    end
+
+    Server -->|API polling| Agent
+    Agent -->|Deploy| H
+    Agent -->|Deploy| I
+```
+
+## Prerequisites
+
+- **Docker & Docker Compose** — containers run everything
+- **Port access** — 80 (HTTP-01 challenges) and 443 (HTTPS) for Let's Encrypt
+- **Domain for ACME** (optional) — if using real Let's Encrypt, not needed for demo
+- **Internet connectivity** — to reach Let's Encrypt's API (demo can use staging directory)
+
+## Quick Start
+
+### 1. Clone or navigate to this directory
+
+```bash
+cd examples/multi-issuer
+```
+
+### 2. Set environment variables (optional, defaults provided)
+
+```bash
+# Email for Let's Encrypt account
+export ACME_EMAIL="your-email@example.com"
+
+# Database password (for demo, default is fine)
+export DB_PASSWORD="certctl-dev-password"
+
+# Agent API key
+export AGENT_API_KEY="agent-demo-key"
+
+# Server port (default 8443)
+export SERVER_PORT="8443"
+```
+
+### 3. Start the services
+
+```bash
+docker compose up -d
+```
+
+This spins up:
+- **PostgreSQL** database (certctl data store)
+- **certctl server** with ACME and Local CA issuers configured
+- **certctl agent** discovering existing certs and polling for work
+- **NGINX** web server (target for public TLS certs)
+
+### 4. Access the dashboard
+
+Open your browser to **http://localhost:8443** (or your configured SERVER_PORT)
+
+You should see:
+- Empty cert inventory (fresh start)
+- Two configured issuers: "ACME" and "Local CA"
+- One registered agent ("multi-issuer-agent-01")
+
+### 5. Create test certificates
+
+In the dashboard:
+
+**For a public cert (Let's Encrypt):**
+1. Go to **Certificates** > **+ New Certificate**
+2. Common Name: `example.com` (or a test domain you control)
+3. Issuer: Select "ACME"
+4. Profile: Select default or create one (key type: RSA 2048, TTL: 90 days)
+5. Create → The server submits an ACME order
+
+**For an internal cert (Local CA):**
+1. Go to **Certificates** > **+ New Certificate**
+2. Common Name: `internal-api.internal` (or any internal name)
+3. Issuer: Select "Local CA"
+4. Profile: Select default
+5. Create → The server issues immediately from the private CA
+
+### 6. Monitor in the dashboard
+
+- **Dashboard** — see cert counts by status and issuer
+- **Certificates** page — filter by issuer, see renewal status, expiration timeline
+- **Audit Trail** — track all operations (issuance, renewals, deployments)
+- **Agents** — view agent health and pending work
+
+## How Issuer Assignment Works
+
+### Via Profiles
+Create a profile for each issuer type:
+- Profile **public-tls** → Issuer: ACME, TTL: 90 days, allowed domains: `*.example.com`
+- Profile **internal-tls** → Issuer: Local CA, TTL: 1 year, allowed SANs: internal DNS names
+
+Then create certificates using the appropriate profile.
+
+### Via Direct Assignment
+When creating a certificate, explicitly select the issuer. The certificate remembers which issuer it belongs to.
+
+## ACME Configuration
+
+The server is configured with Let's Encrypt's production directory:
+
+```yaml
+CERTCTL_ACME_DIRECTORY_URL: https://acme-v02.api.letsencrypt.org/directory
+CERTCTL_ACME_EMAIL: admin@example.com
+CERTCTL_ACME_CHALLENGE_TYPE: http-01
+```
+
+**For testing without a real domain**, use Let's Encrypt's staging directory:
+
+```bash
+# Edit docker-compose.yml and change:
+CERTCTL_ACME_DIRECTORY_URL: https://acme-staging-v02.api.letsencrypt.org/directory
+```
+
+Staging certs are untrusted (for testing only) but unlimited rate limits.
+
+## Local CA Configuration
+
+The Local CA issuer can operate in two modes:
+
+### Mode 1: Self-Signed (Default)
+Leave `CERTCTL_CA_CERT_PATH` and `CERTCTL_CA_KEY_PATH` empty. The server generates a self-signed root CA on first run.
+
+```yaml
+CERTCTL_CA_CERT_PATH: ""
+CERTCTL_CA_KEY_PATH: ""
+```
+
+**Use case:** Development, testing, internal services that trust a self-signed root.
+
+### Mode 2: Sub-CA (Enterprise)
+Provide an existing CA cert + key (e.g., from your organization's PKI). The Local CA issues certs signed by that intermediate.
+
+```bash
+# In docker-compose.yml, volume-mount your CA cert+key:
+volumes:
+  - /path/to/ca.crt:/etc/certctl/ca.crt:ro
+  - /path/to/ca.key:/etc/certctl/ca.key:ro
+
+# And set env vars:
+CERTCTL_CA_CERT_PATH: /etc/certctl/ca.crt
+CERTCTL_CA_KEY_PATH: /etc/certctl/ca.key
+```
+
+**Use case:** Enterprise internal PKI where certs need to chain to a trusted root (e.g., Windows ADCS, OpenSSL, Vault PKI).
+
+## Deployment Flow
+
+When you create a certificate and assign it for deployment:
+
+1. **Issuance** — Server calls the issuer connector (ACME or Local CA)
+   - ACME: submit challenge, poll until DNS/HTTP validated, retrieve cert
+   - Local CA: generate and sign immediately
+
+2. **Agent picks up work** — Agent polls `/api/v1/agents/{id}/work`
+
+3. **Agent deployment** — Agent places cert+key in the target directory
+   - NGINX: `/etc/nginx/ssl/` (mounted volume)
+   - App services: `/etc/app/ssl/` (mounted volume)
+
+4. **Service reload** — Agent triggers reload (NGINX: `nginx -s reload`, etc.)
+
+5. **Dashboard reflects status** — Job transitions from `Running` → `Completed`, cert shows as `Active`
+
+## Scaling Beyond Docker Compose
+
+In production:
+
+- **Deploy certctl server** on a single node (or HA cluster with external PostgreSQL)
+- **Deploy certctl agents** on each server needing cert management
+- **Point agents to server URL** via `CERTCTL_SERVER_URL` env var
+- **Configure issuers on server** via env vars or (in V3+) the dashboard UI
+- **Use profiles to segment issuers** — operators select a profile at cert creation time
+
+Each agent independently manages its local cert inventory and deployments. The server coordinates all agent work and provides the unified dashboard.
+
+## Troubleshooting
+
+### Certs aren't being issued
+- Check server logs: `docker compose logs certctl-server`
+- Verify issuer configuration: Dashboard → Issuers, click "Test Connection"
+- For ACME, ensure ports 80/443 are open and your domain resolves
+
+### Agent can't reach server
+- Check network: `docker compose exec certctl-agent curl http://certctl-server:8443/health`
+- Verify `CERTCTL_SERVER_URL` environment variable
+
+### No issuers showing up
+- Ensure env vars are set on the server container
+- Restart server: `docker compose restart certctl-server`
+- Check server logs for validation errors
+
+### Let's Encrypt rate limits
+- Use the staging directory for testing (unlimited, untrusted certs)
+- Production directory: 50 certs per domain per week
+- Read more: https://letsencrypt.org/docs/rate-limits/
+
+## Next Steps
+
+- **Create a certificate profile** — Dashboard → Profiles → + New Profile
+- **Configure team ownership** — Dashboard → Owners/Teams (assign certs to teams)
+- **Set renewal policies** — Dashboard → Policies (expiration thresholds, auto-renewal)
+- **Enable notifications** — Configure Slack/Teams webhook to get alerts on renewals and expirations
+- **Explore discovery** — Agent scans `/etc/nginx/ssl` and `/etc/app/ssl`, Dashboard → Discovery shows what's already deployed
+
+## Further Reading
+
+- [certctl Architecture](../../docs/architecture.md)
+- [ACME Connector Docs](../../docs/connectors.md#acme-letsencrypt)
+- [Local CA Connector Docs](../../docs/connectors.md#local-ca)
+- [Agent Configuration](../../docs/agent.md)
+- [Deployment Targets](../../docs/connectors.md#deployment-targets)

examples/private-ca-traefik/docker-compose.yml

@@ -0,0 +1,182 @@
+version: '3.8'
+
+services:
+  # PostgreSQL database for certctl
+  postgres:
+    image: postgres:16-alpine
+    container_name: certctl-postgres-private-ca
+    environment:
+      POSTGRES_DB: certctl
+      POSTGRES_USER: certctl
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-certctl-dev-password}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U certctl -d certctl']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # certctl server (control plane) with Local CA in sub-CA mode
+  certctl-server:
+    image: ghcr.io/shankar0123/certctl-server:latest
+    container_name: certctl-server-private-ca
+    environment:
+      # Database
+      CERTCTL_DATABASE_URL: postgres://certctl:${DB_PASSWORD:-certctl-dev-password}@postgres:5432/certctl?sslmode=disable
+
+      # Server settings
+      CERTCTL_SERVER_PORT: 8443
+      CERTCTL_SERVER_HOST: 0.0.0.0
+
+      # Auth (disabled for demo; production should use API keys)
+      CERTCTL_AUTH_TYPE: none
+
+      # CORS (allow agent and Traefik communication)
+      CERTCTL_CORS_ORIGINS: '*'
+
+      # Key generation mode (agent-side in production, server-side for demo)
+      CERTCTL_KEYGEN_MODE: server
+
+      # Local CA configuration
+      # For self-signed CA (default, no paths set):
+      #   - CA generates a self-signed root certificate
+      #   - All issued certificates chain to this root
+      #
+      # For sub-CA mode (provide both paths):
+      #   - Load pre-signed CA certificate and key from these paths
+      #   - All issued certificates chain to your enterprise root CA
+      #   - Requires: CA cert must have IsCA=true and KeyUsageCertSign
+      #   - Supports: RSA, ECDSA, PKCS#8 key formats
+      #
+      # To use sub-CA mode:
+      #   1. Place your enterprise CA cert at ./ca-cert.pem
+      #   2. Place your enterprise CA key at ./ca-key.pem
+      #   3. Uncomment the two lines below
+      #   4. Restart the service
+      #
+      # CERTCTL_CA_CERT_PATH: /etc/certctl/ca-cert.pem
+      # CERTCTL_CA_KEY_PATH: /etc/certctl/ca-key.pem
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+    ports:
+      - '${SERVER_PORT:-8443}:8443'
+    volumes:
+      # Mount directory for CA cert/key (for sub-CA mode)
+      # Copy your enterprise CA cert+key here:
+      #   cp /path/to/your/ca.pem ./ca-cert.pem
+      #   cp /path/to/your/ca-key.pem ./ca-key.pem
+      - ./ca-certs:/etc/certctl:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+    networks:
+      - certctl-network
+    healthcheck:
+      test: ['CMD-SHELL', 'curl -sf http://localhost:8443/health || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+
+  # certctl agent (deploys certs to Traefik)
+  certctl-agent:
+    image: ghcr.io/shankar0123/certctl-agent:latest
+    container_name: certctl-agent-private-ca
+    environment:
+      # Control plane connection
+      CERTCTL_SERVER_URL: http://certctl-server:8443
+      CERTCTL_API_KEY: ${AGENT_API_KEY:-agent-demo-key}
+
+      # Key generation (agent-side keys, never sent to server)
+      CERTCTL_KEYGEN_MODE: server
+      CERTCTL_KEY_DIR: /var/lib/certctl/keys
+
+      # Discovery (scan for existing certs in Traefik's directory)
+      CERTCTL_DISCOVERY_DIRS: /etc/traefik/certs
+
+      # Heartbeat interval
+      CERTCTL_HEARTBEAT_INTERVAL: 30s
+
+      # Agent metadata (self-reported)
+      CERTCTL_AGENT_NAME: traefik-agent-01
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+    volumes:
+      # Mount Traefik cert directory for deployment
+      - traefik_certs:/etc/traefik/certs
+      # Agent key storage (persisted across restarts)
+      - agent_keys:/var/lib/certctl/keys
+    depends_on:
+      certctl-server:
+        condition: service_healthy
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # Traefik reverse proxy / edge router
+  # Certificates deployed by certctl-agent are automatically loaded from the certs directory
+  traefik:
+    image: traefik:v3.0
+    container_name: certctl-traefik-private-ca
+    command:
+      # Enable dashboard and API
+      - '--api.insecure=true'
+      - '--api.dashboard=true'
+
+      # File provider: watch the certs directory for dynamic config updates
+      - '--providers.file.directory=/etc/traefik/dynamic'
+      - '--providers.file.watch=true'
+
+      # Entry points (HTTP and HTTPS)
+      - '--entrypoints.web.address=:80'
+      - '--entrypoints.websecure.address=:443'
+      - '--entrypoints.websecure.http.tls=true'
+
+      # Global TLS settings
+      - '--entryPoints.websecure.http.tls.certResolver=internal'
+
+      # Logging
+      - '--log.level=info'
+      - '--accesslog=true'
+    ports:
+      # HTTP
+      - '80:80'
+      # HTTPS
+      - '443:443'
+      # Dashboard (http://localhost:8080)
+      - '8080:8080'
+    volumes:
+      # Mount Traefik config directory
+      - ./traefik-config:/etc/traefik/dynamic:ro
+      # Mount cert directory (where certctl deploys certs)
+      - traefik_certs:/etc/traefik/certs:ro
+      # Allow Traefik to read Docker socket (optional, for container labeling)
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - certctl-network
+    depends_on:
+      - certctl-agent
+    healthcheck:
+      test: ['CMD-SHELL', 'curl -sf http://localhost:8080/ping || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+
+networks:
+  certctl-network:
+    driver: bridge
+
+volumes:
+  postgres_data:
+    driver: local
+  traefik_certs:
+    driver: local
+  agent_keys:
+    driver: local

examples/private-ca-traefik/private-ca-traefik.md

@@ -0,0 +1,345 @@
+# Private CA + Traefik Example
+
+This example demonstrates certctl managing certificates for **internal services without public CA dependency**. Ideal for enterprise environments where:
+
+- All services are internal (VPN, private networks)
+- You need unified certificate lifecycle management across multiple internal apps
+- You want automatic cert deployment to your reverse proxy
+- You may have an existing enterprise root CA (ADCS, OpenCA, etc.)
+
+## What's Included
+
+- **certctl server** with Local CA issuer (self-signed or sub-CA mode)
+- **certctl agent** that deploys certificates to Traefik
+- **Traefik** reverse proxy with file provider for dynamic cert discovery
+- **PostgreSQL** database for certificate storage and audit trail
+- Automatic certificate discovery for existing certs in Traefik
+
+## Architecture
+
+```mermaid
+flowchart TD
+    A["certctl-server<br/>(control plane)<br/>(Local CA issuer)"]
+    B["certctl-agent<br/>(certificate deployer)"]
+    C["Traefik<br/>(watches cert directory)"]
+    D["[Internal Services]"]
+
+    A -->|REST API<br/>job polling| B
+    B -->|Write cert/key files| C
+    C -->|TLS handshakes| D
+```
+
+## Quick Start (Self-Signed CA)
+
+The simplest way to get running in 2 minutes:
+
+```bash
+# 1. Create directory structure
+mkdir -p traefik-config ca-certs
+
+# 2. Create a minimal Traefik dynamic config
+cat > traefik-config/default.yaml << 'EOF'
+# Traefik will auto-load certificates from /etc/traefik/certs
+# Certctl deploys {cert-id}.crt and {cert-id}.key files here
+http:
+  routers:
+    api:
+      rule: "Host(`api.internal.local`)"
+      service: api-service
+      tls: {}
+  services:
+    api-service:
+      loadBalancer:
+        servers:
+          - url: "http://localhost:3000"
+EOF
+
+# 3. Start the stack
+docker compose up -d
+
+# 4. Access the dashboards
+# - certctl: http://localhost:8443 (API only, use the CLI or direct HTTP calls)
+# - Traefik dashboard: http://localhost:8080
+```
+
+The self-signed CA will be automatically generated on first startup.
+
+## Using Sub-CA Mode (Enterprise Root CA)
+
+If you have an existing enterprise CA (ADCS, OpenCA, etc.) and want issued certs to chain to your root:
+
+```bash
+# 1. Create directory structure
+mkdir -p traefik-config ca-certs
+
+# 2. Copy your enterprise CA cert and key
+cp /path/to/your/enterprise-ca.crt ca-certs/ca-cert.pem
+cp /path/to/your/enterprise-ca-key.pem ca-certs/ca-key.pem
+
+# 3. Edit docker-compose.yml and uncomment the sub-CA env vars:
+#    CERTCTL_CA_CERT_PATH: /etc/certctl/ca-cert.pem
+#    CERTCTL_CA_KEY_PATH: /etc/certctl/ca-key.pem
+
+# 4. Create the dynamic config (same as above)
+mkdir -p traefik-config
+cat > traefik-config/default.yaml << 'EOF'
+http:
+  routers:
+    api:
+      rule: "Host(`api.internal.local`)"
+      service: api-service
+      tls: {}
+  services:
+    api-service:
+      loadBalancer:
+        servers:
+          - url: "http://localhost:3000"
+EOF
+
+# 5. Start the stack
+docker compose up -d
+```
+
+**Requirements for sub-CA mode:**
+- CA certificate must have `X509v3 Basic Constraints: CA:TRUE`
+- CA certificate must have `X509v3 Key Usage: Certificate Sign`
+- Key format: RSA, ECDSA, or PKCS#8
+- Paths: must be absolute paths to mounted files
+
+## Creating a Certificate
+
+Once the stack is running:
+
+```bash
+# 1. Create a certificate profile in certctl (defines allowed key types, TTL, etc.)
+curl -X POST http://localhost:8443/api/v1/profiles \
+  -H "Content-Type: application/json" \
+  -d '{
+    "id": "prof-internal",
+    "name": "Internal Services",
+    "description": "For internal APIs and web apps",
+    "max_ttl_hours": 8760,
+    "key_types": ["rsa-2048", "ecdsa-p256"]
+  }'
+
+# 2. Create a renewal policy (defines issuer, renewal thresholds, etc.)
+curl -X POST http://localhost:8443/api/v1/policies \
+  -H "Content-Type: application/json" \
+  -d '{
+    "id": "pol-internal",
+    "name": "Internal Renewal Policy",
+    "issuer_id": "iss-local",
+    "profile_id": "prof-internal",
+    "renewal_threshold_days": 30,
+    "alert_thresholds_days": [30, 14, 7, 0]
+  }'
+
+# 3. Create a certificate (triggers issuance immediately)
+curl -X POST http://localhost:8443/api/v1/certificates \
+  -H "Content-Type: application/json" \
+  -d '{
+    "common_name": "api.internal.local",
+    "sans": ["app.internal.local", "www.internal.local"],
+    "policy_id": "pol-internal"
+  }'
+
+# 4. Create a Traefik target (agent will deploy to this)
+curl -X POST http://localhost:8443/api/v1/targets \
+  -H "Content-Type: application/json" \
+  -d '{
+    "id": "target-traefik-01",
+    "name": "Traefik Primary",
+    "type": "traefik",
+    "config": {
+      "cert_dir": "/etc/traefik/certs"
+    }
+  }'
+
+# 5. Create a deployment job (agent picks this up and deploys)
+curl -X POST http://localhost:8443/api/v1/certificates/{cert-id}/deploy \
+  -H "Content-Type: application/json" \
+  -d '{
+    "target_ids": ["target-traefik-01"]
+  }'
+```
+
+Once deployed, Traefik automatically loads the new certificate from the certs directory.
+
+## How It Works
+
+### Certificate Lifecycle
+
+1. **Issue** — certctl-server generates certificate from Local CA (self-signed or sub-CA)
+2. **Store** — certificate stored in PostgreSQL with full audit trail
+3. **Deploy** — certctl-agent writes `{cert-id}.crt` + `{cert-id}.key` to `/etc/traefik/certs`
+4. **Reload** — Traefik file provider detects new files and hot-loads them (zero downtime)
+5. **Monitor** — certctl tracks deployment status and renewal timelines
+
+### Self-Signed CA
+
+- Generated automatically on first startup if `CERTCTL_CA_CERT_PATH` and `CERTCTL_CA_KEY_PATH` are not set
+- Certificate stored in server's in-memory state (not persisted)
+- All issued certs chain to this self-signed root
+- Use this for: demos, development, internal labs
+
+### Sub-CA Mode
+
+- Requires you to provide an existing CA certificate and key
+- Issued certificates chain to your enterprise root CA
+- All issued certs are trustworthy to systems with your root CA in their trust store
+- Use this for: production internal services, compliance requirements, enterprise PKI
+
+## File Organization
+
+```
+private-ca-traefik/
+├── docker-compose.yml          # Stack definition
+├── traefik-config/             # Traefik dynamic config (you create)
+│   └── default.yaml            # Routing rules and TLS settings
+├── ca-certs/                   # CA certificate and key (for sub-CA mode)
+│   ├── ca-cert.pem            # Your enterprise CA certificate
+│   └── ca-key.pem             # Your enterprise CA private key
+└── README.md                   # This file
+```
+
+## Monitoring
+
+### certctl Dashboard
+The server provides a REST API on port 8443. Example queries:
+
+```bash
+# List all certificates
+curl http://localhost:8443/api/v1/certificates
+
+# Check certificate status
+curl http://localhost:8443/api/v1/certificates/{cert-id}
+
+# View audit trail
+curl http://localhost:8443/api/v1/audit
+
+# Check renewal policy compliance
+curl http://localhost:8443/api/v1/policies/{policy-id}
+```
+
+### Traefik Dashboard
+http://localhost:8080 shows:
+- HTTP routers and services
+- TLS certificates currently loaded
+- Request/response metrics
+
+### Logs
+```bash
+# certctl server logs
+docker compose logs certctl-server
+
+# certctl agent logs
+docker compose logs certctl-agent
+
+# Traefik logs
+docker compose logs traefik
+```
+
+## Customizing Traefik Config
+
+Edit `traefik-config/default.yaml` to add routers for your services:
+
+```yaml
+http:
+  routers:
+    # Internal API
+    api:
+      rule: "Host(`api.internal.local`)"
+      service: api-service
+      tls: {}
+
+    # Web application
+    webapp:
+      rule: "Host(`app.internal.local`)"
+      service: webapp-service
+      tls: {}
+
+  services:
+    api-service:
+      loadBalancer:
+        servers:
+          - url: "http://api-backend:3000"
+
+    webapp-service:
+      loadBalancer:
+        servers:
+          - url: "http://webapp-backend:3001"
+```
+
+Changes are picked up automatically (file watcher enabled).
+
+## Production Considerations
+
+1. **Use sub-CA mode** — chain to your enterprise root for full trust
+2. **Enable API key authentication** — set `CERTCTL_AUTH_TYPE: api-key` and `CERTCTL_API_KEY`
+3. **Use agent-side key generation** — set `CERTCTL_KEYGEN_MODE: agent` (keys never leave agents)
+4. **Back up PostgreSQL** — certificate data is authoritative; database loss means certificate loss
+5. **Monitor renewal windows** — set up alerts on policy thresholds
+6. **Rotate CA keys regularly** — plan for future CA refresh (sub-CA mode)
+7. **Audit certificate usage** — review `certctl_audit_events` for compliance
+
+## Troubleshooting
+
+### Certificates not deploying
+```bash
+# Check agent is healthy
+docker compose logs certctl-agent | grep heartbeat
+
+# Check deployment job status
+curl http://localhost:8443/api/v1/jobs | jq '.[] | select(.type == "Deployment")'
+
+# Check Traefik is watching the directory
+docker compose exec traefik ls -la /etc/traefik/certs/
+```
+
+### Traefik not reloading certs
+```bash
+# Verify file provider is enabled (check docker-compose.yml command)
+# Verify certs volume is mounted at /etc/traefik/certs
+# Check Traefik logs
+docker compose logs traefik | grep "file"
+```
+
+### CA cert not loading in sub-CA mode
+```bash
+# Verify file permissions
+docker compose exec certctl-server ls -la /etc/certctl/
+
+# Check server logs for CA loading errors
+docker compose logs certctl-server | grep -i "ca\|cert"
+
+# Verify CA certificate format
+openssl x509 -in ca-certs/ca-cert.pem -text -noout | grep -A 3 "Basic Constraints"
+```
+
+## Cleanup
+
+```bash
+# Stop all services
+docker compose down
+
+# Remove all data (certificates, database, etc.)
+docker compose down -v
+
+# Remove CA cert files (if using custom CA)
+rm -rf ca-certs/
+```
+
+## Next Steps
+
+1. **Add more services** — create additional routers and backends in `traefik-config/default.yaml`
+2. **Set up renewal automation** — configure renewal policies with thresholds
+3. **Integrate with monitoring** — expose certctl metrics to Prometheus
+4. **Enable notifications** — configure email/Slack alerts on certificate events
+5. **Scale to multiple environments** — deploy separate certctl stacks per environment (dev/staging/prod)
+
+## Related Documentation
+
+- [certctl Architecture](../../docs/architecture.md)
+- [Traefik File Provider](https://doc.traefik.io/traefik/providers/file/)
+- [Local CA Sub-CA Mode](../../docs/connectors.md#local-ca)
+- [Certificate Profiles](../../docs/quickstart.md#profiles)

examples/step-ca-haproxy/docker-compose.yml

@@ -0,0 +1,204 @@
+version: '3.8'
+
+services:
+  # PostgreSQL database for certctl
+  postgres:
+    image: postgres:16-alpine
+    container_name: certctl-postgres-stepca-haproxy
+    environment:
+      POSTGRES_DB: certctl
+      POSTGRES_USER: certctl
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-certctl-dev-password}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U certctl -d certctl']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # Smallstep step-ca (internal private CA)
+  # Initialized with default admin token and provisioner configuration
+  step-ca:
+    image: smallstep/step-ca:latest
+    container_name: step-ca-stepca-haproxy
+    environment:
+      # step-ca root password (for key encryption)
+      STEPPATH: /home/step/step-ca
+      # Provisioner password will be set up below
+    volumes:
+      # Persist step-ca configuration and keys
+      - step_ca_data:/home/step/step-ca
+      - ./step-ca-init.sh:/opt/step-ca-init.sh:ro
+    entrypoint: /bin/sh
+    command:
+      - -c
+      - |
+        # Initialize step-ca if not already done
+        if [ ! -f /home/step/step-ca/config/ca.json ]; then
+          echo "Initializing step-ca..."
+          step ca init \
+            --name="certctl-demo-ca" \
+            --dns=step-ca \
+            --address=0.0.0.0:9000 \
+            --provisioner=admin \
+            --provisioner-password-file=<(echo "${STEP_CA_PASSWORD:-stepca-demo-password}") \
+            --password-file=<(echo "${STEP_CA_PASSWORD:-stepca-demo-password}") \
+            --deployment-type=standalone \
+            --acme 2>&1 || true
+        fi
+
+        # Add a JWK provisioner for certctl if not present
+        if ! step ca provisioner list 2>/dev/null | grep -q "certctl"; then
+          echo "Adding certctl JWK provisioner..."
+          step ca provisioner add certctl \
+            --type=JWK \
+            --password-file=<(echo "${STEP_CA_PROVISIONER_PASSWORD:-certctl-provisioner-demo}") \
+            2>&1 || true
+        fi
+
+        # Start step-ca
+        echo "Starting step-ca..."
+        step-ca /home/step/step-ca/config/ca.json \
+          --password-file=<(echo "${STEP_CA_PASSWORD:-stepca-demo-password}")
+    ports:
+      - '9000:9000'
+    healthcheck:
+      test: ['CMD-SHELL', 'step ca health --insecure || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # certctl server (control plane)
+  certctl-server:
+    image: ghcr.io/shankar0123/certctl-server:latest
+    container_name: certctl-server-stepca-haproxy
+    environment:
+      # Database
+      CERTCTL_DATABASE_URL: postgres://certctl:${DB_PASSWORD:-certctl-dev-password}@postgres:5432/certctl?sslmode=disable
+
+      # Server settings
+      CERTCTL_SERVER_PORT: 8443
+      CERTCTL_SERVER_HOST: 0.0.0.0
+
+      # Auth (disabled for demo; production should use API keys)
+      CERTCTL_AUTH_TYPE: none
+
+      # CORS (allow agent communication)
+      CERTCTL_CORS_ORIGINS: '*'
+
+      # Key generation mode (agent-side in production, server-side for demo)
+      CERTCTL_KEYGEN_MODE: agent
+
+      # step-ca issuer configuration
+      # step-ca runs on step-ca:9000 in this compose network
+      CERTCTL_STEPCA_URL: https://step-ca:9000
+      CERTCTL_STEPCA_ROOT_CERT_PATH: /etc/certctl/step-ca-root.crt
+      CERTCTL_STEPCA_PROVISIONER: certctl
+      CERTCTL_STEPCA_KEY_PATH: /etc/certctl/step-ca-provisioner.json
+      CERTCTL_STEPCA_PASSWORD: ${STEP_CA_PROVISIONER_PASSWORD:-certctl-provisioner-demo}
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+    volumes:
+      # Mount step-ca certs for TLS verification (auto-generated by step-ca init)
+      - step_ca_data:/home/step/step-ca/config:ro
+    ports:
+      - '${SERVER_PORT:-8443}:8443'
+    depends_on:
+      postgres:
+        condition: service_healthy
+      step-ca:
+        condition: service_healthy
+    networks:
+      - certctl-network
+    healthcheck:
+      test: ['CMD-SHELL', 'curl -sf http://localhost:8443/health || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+
+  # certctl agent (runs on the target machine with HAProxy)
+  certctl-agent:
+    image: ghcr.io/shankar0123/certctl-agent:latest
+    container_name: certctl-agent-stepca-haproxy
+    environment:
+      # Control plane connection
+      CERTCTL_SERVER_URL: http://certctl-server:8443
+      CERTCTL_API_KEY: ${AGENT_API_KEY:-agent-demo-key}
+
+      # Key generation (agent-side keys, never sent to server)
+      CERTCTL_KEYGEN_MODE: agent
+      CERTCTL_KEY_DIR: /var/lib/certctl/keys
+
+      # Discovery (scan existing certs so operator knows what's already deployed)
+      CERTCTL_DISCOVERY_DIRS: /etc/haproxy/ssl
+
+      # Heartbeat interval
+      CERTCTL_HEARTBEAT_INTERVAL: 30s
+
+      # Agent metadata (self-reported)
+      CERTCTL_AGENT_NAME: haproxy-agent-01
+
+      # Logging
+      CERTCTL_LOG_LEVEL: info
+    volumes:
+      # Mount HAProxy config and cert directories
+      # In production, these would be the actual HAProxy paths
+      - haproxy_certs:/etc/haproxy/ssl
+      - haproxy_conf:/etc/haproxy
+      # Agent key storage (persisted across restarts)
+      - agent_keys:/var/lib/certctl/keys
+    depends_on:
+      certctl-server:
+        condition: service_healthy
+    networks:
+      - certctl-network
+    restart: unless-stopped
+
+  # HAProxy reverse proxy / load balancer
+  # This is where certificates will be deployed
+  haproxy:
+    image: haproxy:2.9-alpine
+    container_name: certctl-haproxy-stepca-haproxy
+    ports:
+      - '80:80'
+      - '443:443'
+    volumes:
+      - haproxy_conf:/etc/haproxy
+      - haproxy_certs:/etc/haproxy/ssl
+      # Default HAProxy config
+      - ./haproxy.cfg:/etc/haproxy/haproxy.cfg:ro
+    depends_on:
+      - certctl-agent
+    networks:
+      - certctl-network
+    healthcheck:
+      test: ['CMD-SHELL', 'wget --quiet --tries=1 --spider http://localhost:8080/stats || exit 1']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+
+networks:
+  certctl-network:
+    driver: bridge
+
+volumes:
+  postgres_data:
+    driver: local
+  step_ca_data:
+    driver: local
+  haproxy_certs:
+    driver: local
+  haproxy_conf:
+    driver: local
+  agent_keys:
+    driver: local

examples/step-ca-haproxy/haproxy.cfg

@@ -0,0 +1,69 @@
+global
+  log stdout local0
+  log stdout local1 notice
+  chroot /var/lib/haproxy
+  stats socket /run/haproxy/admin.sock mode 660 level admin
+  stats timeout 30s
+  user haproxy
+  group haproxy
+  daemon
+
+  # Default SSL options for modern TLS
+  tune.ssl.default-dh-param 2048
+  ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
+  ssl-default-bind-options ssl-min-ver TLSv1.2
+
+defaults
+  mode  http
+  log   global
+  option  httplog
+  option  dontlognull
+  timeout connect 5000
+  timeout client  50000
+  timeout server  50000
+  errorfile 400 /etc/haproxy/errors/400.http
+  errorfile 403 /etc/haproxy/errors/403.http
+  errorfile 408 /etc/haproxy/errors/408.http
+  errorfile 500 /etc/haproxy/errors/500.http
+  errorfile 502 /etc/haproxy/errors/502.http
+  errorfile 503 /etc/haproxy/errors/503.http
+  errorfile 504 /etc/haproxy/errors/504.http
+
+# Statistics endpoint (accessible on port 8080)
+listen stats
+  bind *:8080
+  stats enable
+  stats uri /stats
+  stats refresh 30s
+  stats admin if TRUE
+
+# Example HTTPS frontend with certificate from certctl
+# This frontend will serve HTTPS on port 443 using a combined PEM file
+# deployed by certctl to /etc/haproxy/ssl/cert.pem
+frontend https_in
+  # HTTP redirect to HTTPS
+  bind *:80
+  mode http
+  acl is_http hdr(X-Forwarded-Proto) http
+  redirect scheme https code 301 if !is_https
+
+  # HTTPS with certificate
+  # In production, certctl will manage cert.pem and reload HAProxy after deployment
+  bind *:443 ssl crt /etc/haproxy/ssl/cert.pem strict-sni
+  mode http
+  option httplog
+
+  # Default backend
+  default_backend http_backend
+
+# Example backend (simple web service placeholder)
+backend http_backend
+  mode http
+  option httpchk GET /
+  server local_app 127.0.0.1:8000 check disabled
+
+# Health endpoint (useful for certctl agent deployment verification)
+frontend health
+  bind *:9999
+  mode http
+  monitor-uri /health

examples/step-ca-haproxy/step-ca-haproxy.md

@@ -0,0 +1,355 @@
+# step-ca + HAProxy Example
+
+This example demonstrates certctl managing certificates issued by **Smallstep step-ca** and deploying them to **HAProxy**.
+
+## Scenario
+
+You're a Smallstep user running step-ca as your internal PKI. You have HAProxy load balancers that need certificates. This setup:
+
+1. **step-ca** issues certificates (via JWK provisioner, no challenge solving)
+2. **certctl** manages the certificate lifecycle (renewal policies, deployment, audit)
+3. **HAProxy** serves HTTPS with certificates managed by certctl
+
+This is the natural choice if you're already invested in step-ca and want to consolidate certificate lifecycle management without learning Let's Encrypt, DNS-01 challenges, or external integrations.
+
+## What's Included
+
+| Service | Image | Purpose |
+|---------|-------|---------|
+| **step-ca** | `smallstep/step-ca:latest` | Private internal CA |
+| **certctl-server** | `ghcr.io/shankar0123/certctl-server:latest` | Certificate management control plane |
+| **certctl-agent** | `ghcr.io/shankar0123/certctl-agent:latest` | Agent running on HAProxy server |
+| **haproxy** | `haproxy:2.9-alpine` | Reverse proxy / load balancer |
+| **postgres** | `postgres:16-alpine` | certctl audit trail + config storage |
+
+## Quick Start
+
+### Prerequisites
+
+- Docker and Docker Compose
+- Curl (to interact with APIs)
+
+### 1. Start Everything
+
+```bash
+docker compose up -d
+```
+
+This will:
+- Initialize step-ca with a self-signed root CA
+- Create a JWK provisioner named `certctl` (pre-configured credentials)
+- Start certctl-server (connected to step-ca)
+- Start the certctl-agent (ready to deploy certs to HAProxy)
+- Start HAProxy with a placeholder config
+
+Monitor logs:
+
+```bash
+docker compose logs -f certctl-server
+```
+
+Wait for all services to reach healthy state:
+
+```bash
+docker compose ps
+```
+
+Expected output:
+```
+NAME                              STATUS
+certctl-postgres-...              healthy
+certctl-server-...                healthy
+step-ca-...                       healthy
+certctl-agent-...                 running
+certctl-haproxy-...               healthy
+```
+
+### 2. Access certctl Dashboard
+
+Open your browser to:
+
+```
+http://localhost:8443
+```
+
+You should see an empty dashboard. This is expected — no certificates issued yet.
+
+### 3. Create a Certificate Profile
+
+This defines what certificates certctl can issue (key algorithm, max TTL, allowed names).
+
+```bash
+curl -X POST http://localhost:8443/api/v1/profiles \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "name": "internal-web",
+    "key_type": "rsa-2048",
+    "max_ttl_days": 90,
+    "description": "Internal web services"
+  }'
+```
+
+### 4. Create an HAProxy Deployment Target
+
+This tells certctl where to deploy certificates on the HAProxy server.
+
+```bash
+curl -X POST http://localhost:8443/api/v1/targets \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "name": "haproxy-01",
+    "type": "haproxy",
+    "enabled": true,
+    "config": {
+      "pem_path": "/etc/haproxy/ssl/cert.pem",
+      "reload_command": "systemctl reload haproxy",
+      "validate_command": "haproxy -c -f /etc/haproxy/haproxy.cfg"
+    }
+  }'
+```
+
+Note: In the Docker Compose environment, reload command can be `kill -HUP $(pidof haproxy)` instead of `systemctl reload haproxy`.
+
+### 5. Create a Renewal Policy
+
+This ties a certificate profile to a deployment target and sets renewal thresholds.
+
+```bash
+curl -X POST http://localhost:8443/api/v1/renewal-policies \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "name": "haproxy-internal-web",
+    "profile_id": "<profile_id_from_step_3>",
+    "issuer_id": "iss-stepca",
+    "enabled": true,
+    "renewal_days_before_expiry": 30,
+    "alert_thresholds_days": [30, 14, 7, 0]
+  }'
+```
+
+Get the issuer ID:
+
+```bash
+curl http://localhost:8443/api/v1/issuers | jq '.'
+```
+
+You should see `iss-stepca` in the list.
+
+### 6. Issue a Certificate
+
+Request a certificate via the API. The server will sign it via step-ca.
+
+```bash
+curl -X POST http://localhost:8443/api/v1/certificates \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "common_name": "api.internal.example.com",
+    "sans": ["api.internal.example.com", "api.staging.example.com"],
+    "issuer_id": "iss-stepca",
+    "profile_id": "<profile_id_from_step_3>"
+  }'
+```
+
+### 7. Deploy to HAProxy
+
+Get the certificate ID and trigger deployment:
+
+```bash
+curl -X POST http://localhost:8443/api/v1/certificates/<cert_id>/deploy \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "target_id": "<target_id_from_step_4>"
+  }'
+```
+
+The agent will:
+1. Fetch the deployment job
+2. Generate a combined PEM (cert + chain + key) locally
+3. Write it to `/etc/haproxy/ssl/cert.pem` on HAProxy
+4. Reload HAProxy
+5. Report status back to certctl
+
+### 8. Verify in Dashboard
+
+Refresh http://localhost:8443 and you should see:
+- 1 certificate (status: Active, expiry in 90 days)
+- 1 deployment job (status: Completed)
+- 1 agent (heartbeat: recent)
+
+## Configuration Details
+
+### step-ca Integration
+
+step-ca is configured with:
+
+- **Root CA Name**: `certctl-demo-ca`
+- **Provisioner**: `certctl` (JWK type)
+- **Default Password**: `certctl-provisioner-demo` (override with `STEP_CA_PROVISIONER_PASSWORD`)
+
+To inspect step-ca:
+
+```bash
+docker compose exec step-ca step ca provisioner list
+docker compose exec step-ca step ca health --insecure
+```
+
+### HAProxy Combined PEM Format
+
+HAProxy requires a single file with certificate, chain, and key concatenated:
+
+```
+-----BEGIN CERTIFICATE-----
+[leaf certificate]
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+[intermediate CA]
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+[private key]
+-----END RSA PRIVATE KEY-----
+```
+
+The agent automatically constructs this file from the issued certificate and step-ca-provided chain.
+
+**Security**: The combined PEM is written with `0600` permissions (owner-readable only) because it contains the private key.
+
+### Environment Variables
+
+Customize behavior with:
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `DB_PASSWORD` | `certctl-dev-password` | PostgreSQL password |
+| `STEP_CA_PASSWORD` | `stepca-demo-password` | step-ca root key password |
+| `STEP_CA_PROVISIONER_PASSWORD` | `certctl-provisioner-demo` | certctl JWK provisioner password |
+| `AGENT_API_KEY` | `agent-demo-key` | Agent authentication token |
+| `SERVER_PORT` | `8443` | certctl server external port |
+
+Example:
+
+```bash
+STEP_CA_PASSWORD=myca-password AGENT_API_KEY=secret-key docker compose up -d
+```
+
+## Integrating with an Existing step-ca Instance
+
+If you already run step-ca elsewhere (not in this Compose file):
+
+1. **Extract the root certificate** from your step-ca:
+
+   ```bash
+   step ca root /tmp/step-ca-root.crt --ca-url https://ca.internal:9000 --insecure
+   ```
+
+2. **Create or retrieve the certctl JWK provisioner key**:
+
+   ```bash
+   step ca provisioner list --ca-url https://ca.internal:9000 --insecure
+   step ca provisioner describe certctl --ca-url https://ca.internal:9000 --insecure
+   ```
+
+3. **Update docker-compose.yml**:
+
+   ```yaml
+   certctl-server:
+     environment:
+       CERTCTL_STEPCA_URL: https://ca.internal:9000
+       CERTCTL_STEPCA_ROOT_CERT_PATH: /etc/certctl/step-ca-root.crt
+       CERTCTL_STEPCA_PROVISIONER_NAME: certctl
+       CERTCTL_STEPCA_PROVISIONER_KEY_PATH: /etc/certctl/step-ca-provisioner.json
+       CERTCTL_STEPCA_PROVISIONER_PASSWORD: <your-password>
+   ```
+
+4. **Mount the cert and key**:
+
+   ```yaml
+   volumes:
+     - /path/to/step-ca-root.crt:/etc/certctl/step-ca-root.crt:ro
+     - /path/to/provisioner.json:/etc/certctl/step-ca-provisioner.json:ro
+   ```
+
+## Cleanup
+
+```bash
+docker compose down -v
+```
+
+This removes all containers and volumes (step-ca config, certificates, database).
+
+## Next Steps
+
+### Production Deployment
+
+- Replace image tags (`latest` → specific version)
+- Use real TLS certificates for step-ca (self-signed is fine internally, but use proper roots for verification)
+- Configure persistent storage for step-ca keys (HSM or encrypted filesystem)
+- Set `CERTCTL_AUTH_TYPE: api-key` and rotate API keys regularly
+- Enable audit trail export for compliance
+- Configure renewal alerts (Slack, email, PagerDuty)
+- Run agents on separate machines (not in Compose)
+
+### Advanced Features
+
+- **Multiple HAProxy instances**: Create additional targets and agents
+- **Policy-based renewal**: Set different renewal windows per environment (staging vs. production)
+- **Approval workflows**: Require manual approval before deploying to production
+- **Discovery**: Scan existing HAProxy certs and bring them under management
+- **Network scanning**: Discover TLS endpoints in your network and inventory them
+
+## Troubleshooting
+
+### step-ca fails to initialize
+
+Check logs:
+
+```bash
+docker compose logs step-ca
+```
+
+Common issues:
+- Permissions on `/home/step/step-ca` volume
+- Port 9000 already in use
+
+### Agent can't reach server
+
+Verify network:
+
+```bash
+docker compose exec certctl-agent curl http://certctl-server:8443/health
+```
+
+### HAProxy config validation fails
+
+Check HAProxy config syntax:
+
+```bash
+docker compose exec haproxy haproxy -c -f /etc/haproxy/haproxy.cfg
+```
+
+### Deployment job stays in "Running" state
+
+Check agent logs:
+
+```bash
+docker compose logs certctl-agent
+```
+
+Likely causes:
+- Agent can't write to `/etc/haproxy/ssl/cert.pem` (permissions)
+- Reload command is misconfigured
+- HAProxy container is not accessible
+
+## Documentation
+
+- [certctl Architecture](../../docs/architecture.md)
+- [step-ca Connector Docs](../../docs/connectors.md#step-ca)
+- [HAProxy Target Docs](../../docs/connectors.md#haproxy)
+- [API Reference](../../api/openapi.yaml)
+
+## Support
+
+For issues or questions:
+
+1. Check the [troubleshooting guide](../../docs/troubleshooting.md)
+2. Review service logs: `docker compose logs <service>`
+3. Open an issue on GitHub

go.mod

@@ -1,6 +1,6 @@
 module github.com/shankar0123/certctl
 
-go 1.25.0
+go 1.25.9
 
 require (
 	github.com/google/uuid v1.6.0
@@ -9,12 +9,21 @@ require (
 	github.com/testcontainers/testcontainers-go v0.35.0
 )
 
-require golang.org/x/crypto v0.31.0
+require (
+	github.com/masterzen/winrm v0.0.0-20250927112105-5f8e6c707321
+	github.com/pkg/sftp v1.13.10
+	golang.org/x/crypto v0.41.0
+	software.sslmate.com/src/go-pkcs12 v0.7.0
+)
 
 require (
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/ChrisTrenkamp/goxpath v0.0.0-20210404020558-97928f7e12b6 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/bodgit/ntlmssp v0.0.0-20240506230425-31973bb52d9b // indirect
+	github.com/bodgit/windows v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/containerd/containerd v1.7.18 // indirect
 	github.com/containerd/log v0.1.0 // indirect
@@ -29,12 +38,23 @@ require (
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/gofrs/uuid v4.4.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/jsonschema-go v0.4.2 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-uuid v1.0.3 // indirect
+	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
+	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
+	github.com/jcmturner/gofork v1.7.6 // indirect
+	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
+	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
+	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
 	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/kr/fs v0.1.0 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
+	github.com/masterzen/simplexml v0.0.0-20190410153822-31eea3082786 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
@@ -51,7 +71,8 @@ require (
 	github.com/shirou/gopsutil/v3 v3.23.12 // indirect
 	github.com/shoenig/go-m1cpu v0.1.6 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/stretchr/testify v1.9.0 // indirect
+	github.com/stretchr/testify v1.10.0 // indirect
+	github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde // indirect
 	github.com/tklauser/go-sysconf v0.3.12 // indirect
 	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
@@ -60,7 +81,9 @@ require (
 	go.opentelemetry.io/otel v1.24.0 // indirect
 	go.opentelemetry.io/otel/metric v1.24.0 // indirect
 	go.opentelemetry.io/otel/trace v1.24.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sys v0.40.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -4,8 +4,16 @@ github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
+github.com/ChrisTrenkamp/goxpath v0.0.0-20210404020558-97928f7e12b6 h1:w0E0fgc1YafGEh5cROhlROMWXiNoZqApk2PDN0M1+Ns=
+github.com/ChrisTrenkamp/goxpath v0.0.0-20210404020558-97928f7e12b6/go.mod h1:nuWgzSkT5PnyOd+272uUmV0dnAnAn42Mk7PiQC5VzN4=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/bodgit/ntlmssp v0.0.0-20240506230425-31973bb52d9b h1:baFN6AnR0SeC194X2D292IUZcHDs4JjStpqtE70fjXE=
+github.com/bodgit/ntlmssp v0.0.0-20240506230425-31973bb52d9b/go.mod h1:Ram6ngyPDmP+0t6+4T2rymv0w0BS9N8Ch5vvUJccw5o=
+github.com/bodgit/windows v1.0.1 h1:tF7K6KOluPYygXa3Z2594zxlkbKPAOvqr97etrGNIz4=
+github.com/bodgit/windows v1.0.1/go.mod h1:a6JLwrB4KrTR5hBpp8FI9/9W9jJfeQ2h4XDXU74ZCdM=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/containerd/containerd v1.7.18 h1:jqjZTQNfXGoEaZdW1WwPU0RqSn1Bm2Ay/KJPUuO8nao=
@@ -39,6 +47,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
+github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
@@ -52,12 +62,35 @@ github.com/google/jsonschema-go v0.4.2 h1:tmrUohrwoLZZS/P3x7ex0WAVknEkBZM46iALbc
 github.com/google/jsonschema-go v0.4.2/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
 github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -68,6 +101,10 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/masterzen/simplexml v0.0.0-20190410153822-31eea3082786 h1:2ZKn+w/BJeL43sCxI2jhPLRv73oVVOjEKZjKkflyqxg=
+github.com/masterzen/simplexml v0.0.0-20190410153822-31eea3082786/go.mod h1:kCEbxUJlNDEBNbdQMkPSp6yaKcRXVI6f4ddk8Riv4bc=
+github.com/masterzen/winrm v0.0.0-20250927112105-5f8e6c707321 h1:AKIJL2PfBX2uie0Mn5pxtG1+zut3hAVMZbRfoXecFzI=
+github.com/masterzen/winrm v0.0.0-20250927112105-5f8e6c707321/go.mod h1:JajVhkiG2bYSNYYPYuWG7WZHr42CTjMTcCjfInRNCqc=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
@@ -88,6 +125,8 @@ github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQ
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.13.10 h1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=
+github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1HbeGA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
@@ -111,14 +150,18 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/testcontainers/testcontainers-go v0.35.0 h1:uADsZpTKFAtp8SLK+hMwSaa+X+JiERHtd4sQAFmXeMo=
 github.com/testcontainers/testcontainers-go v0.35.0/go.mod h1:oEVBj5zrfJTrgjwONs1SsRbnBtH9OKl+IGl3UMcr2B4=
+github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde h1:AMNpJRc7P+GTwVbl8DkK2I9I8BBUzNiHuH/tlxrpan0=
+github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde/go.mod h1:MvrEmduDUz4ST5pGZ7CABCnOU5f3ZiOAZzT6b1A6nX8=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
@@ -127,6 +170,7 @@ github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zI
 github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
 github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
@@ -148,45 +192,65 @@ go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v8
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
-golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
 golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
 golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
 golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
 golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -205,8 +269,11 @@ google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHh
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
 gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
+software.sslmate.com/src/go-pkcs12 v0.7.0 h1:Db8W44cB54TWD7stUFFSWxdfpdn6fZVcDl0w3R4RVM0=
+software.sslmate.com/src/go-pkcs12 v0.7.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=

install-agent.sh

@@ -0,0 +1,592 @@
+#!/bin/bash
+# certctl Agent Install Script
+# Detects OS (Linux/macOS) and architecture, downloads binary from GitHub Releases,
+# installs to system path, configures service (systemd/launchd), and prompts for config.
+
+set -euo pipefail
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Configuration
+GITHUB_REPO="shankar0123/certctl"
+RELEASE_URL="https://github.com/${GITHUB_REPO}/releases/latest/download"
+INSTALL_DIR="/usr/local/bin"
+SERVICE_NAME="certctl-agent"
+
+# Detect OS and architecture
+detect_platform() {
+    local os="$(uname -s)"
+    local arch="$(uname -m)"
+
+    case "$os" in
+        Linux*)
+            OS_TYPE="linux"
+            ;;
+        Darwin*)
+            OS_TYPE="darwin"
+            ;;
+        *)
+            echo -e "${RED}Error: Unsupported OS: $os${NC}"
+            exit 1
+            ;;
+    esac
+
+    case "$arch" in
+        x86_64)
+            ARCH_TYPE="amd64"
+            ;;
+        aarch64|arm64)
+            ARCH_TYPE="arm64"
+            ;;
+        *)
+            echo -e "${RED}Error: Unsupported architecture: $arch${NC}"
+            exit 1
+            ;;
+    esac
+}
+
+# Print usage information
+usage() {
+    cat <<EOF
+Usage: $0 [OPTIONS]
+
+Install and configure the certctl agent on your system.
+
+OPTIONS:
+    -h, --help          Show this help message
+    --server-url URL    Set CERTCTL_SERVER_URL (skips interactive prompt)
+    --api-key KEY       Set CERTCTL_API_KEY (skips interactive prompt)
+    --agent-id ID       Set CERTCTL_AGENT_ID (defaults to hostname)
+    --no-start          Install but don't start the service
+
+EXAMPLES:
+    # Interactive install (download first):
+    curl -sSLO https://raw.githubusercontent.com/${GITHUB_REPO}/master/install-agent.sh
+    chmod +x install-agent.sh
+    sudo ./install-agent.sh
+
+    # Non-interactive install (pipe via curl):
+    curl -sSL https://raw.githubusercontent.com/${GITHUB_REPO}/master/install-agent.sh \\
+      | sudo bash -s -- \\
+          --server-url https://certctl.example.com \\
+          --api-key YOUR_API_KEY
+
+EOF
+}
+
+# Parse command-line arguments
+parse_args() {
+    while [[ $# -gt 0 ]]; do
+        case $1 in
+            -h|--help)
+                usage
+                exit 0
+                ;;
+            --server-url)
+                SERVER_URL="${2:-}"
+                if [[ -z "$SERVER_URL" ]]; then
+                    echo -e "${RED}Error: --server-url requires a value${NC}" >&2
+                    exit 1
+                fi
+                shift 2
+                ;;
+            --server-url=*)
+                SERVER_URL="${1#*=}"
+                shift
+                ;;
+            --api-key)
+                API_KEY="${2:-}"
+                if [[ -z "$API_KEY" ]]; then
+                    echo -e "${RED}Error: --api-key requires a value${NC}" >&2
+                    exit 1
+                fi
+                shift 2
+                ;;
+            --api-key=*)
+                API_KEY="${1#*=}"
+                shift
+                ;;
+            --agent-id)
+                AGENT_ID="${2:-}"
+                if [[ -z "$AGENT_ID" ]]; then
+                    echo -e "${RED}Error: --agent-id requires a value${NC}" >&2
+                    exit 1
+                fi
+                shift 2
+                ;;
+            --agent-id=*)
+                AGENT_ID="${1#*=}"
+                shift
+                ;;
+            --no-start)
+                NO_START=true
+                shift
+                ;;
+            *)
+                echo -e "${RED}Error: Unknown option: $1${NC}" >&2
+                usage
+                exit 1
+                ;;
+        esac
+    done
+}
+
+# Ensure stdin is interactive before prompting. When the script is piped via
+# curl|bash, stdin is the pipe from curl, so `read` hits EOF immediately and
+# set -e aborts the script silently. Reopen stdin from the controlling terminal
+# (/dev/tty) if available; otherwise print a helpful error pointing at the
+# flag-based non-interactive install.
+ensure_interactive_input() {
+    # If all required config is already provided via flags, no prompting needed.
+    if [[ -n "${SERVER_URL:-}" && -n "${API_KEY:-}" ]]; then
+        return
+    fi
+
+    # Already interactive — nothing to do.
+    if [[ -t 0 ]]; then
+        return
+    fi
+
+    # Piped stdin — try to reopen from the controlling terminal. Actually
+    # attempt to open /dev/tty inside a subshell: the device node may exist
+    # even when the process has no controlling terminal (ENXIO on open), so
+    # `[[ -r /dev/tty ]]` is not reliable.
+    if ( exec </dev/tty ) 2>/dev/null; then
+        exec </dev/tty
+        return
+    fi
+
+    # No terminal available — emit clear guidance and exit.
+    # Use printf '%b' so the ANSI color escapes in $RED/$NC are interpreted
+    # rather than rendered as literal backslash sequences (a heredoc would
+    # keep them as raw text).
+    {
+        printf '%b\n' "${RED}Error: No interactive terminal available.${NC}"
+        printf '\n'
+        printf 'The installer was piped through curl and no controlling terminal (/dev/tty)\n'
+        printf 'is available for prompts. Pass the required values as flags instead:\n'
+        printf '\n'
+        printf '  curl -sSL https://raw.githubusercontent.com/%s/master/install-agent.sh \\\n' "$GITHUB_REPO"
+        printf '    | sudo bash -s -- \\\n'
+        printf '        --server-url https://certctl.example.com \\\n'
+        printf '        --api-key YOUR_API_KEY\n'
+        printf '\n'
+        printf 'Or download the script first and run it directly:\n'
+        printf '\n'
+        printf '  curl -sSLO https://raw.githubusercontent.com/%s/master/install-agent.sh\n' "$GITHUB_REPO"
+        printf '  chmod +x install-agent.sh\n'
+        printf '  sudo ./install-agent.sh\n'
+        printf '\n'
+    } >&2
+    exit 1
+}
+
+# Check if running as root/sudo on Linux
+check_privileges() {
+    if [[ "$OS_TYPE" == "linux" && "$EUID" -ne 0 ]]; then
+        echo -e "${RED}Error: This script must be run as root on Linux. Try: sudo $0${NC}"
+        exit 1
+    fi
+}
+
+# Download agent binary from GitHub Releases
+# IMPORTANT: main() captures this function's stdout via `binary_path=$(download_binary)`,
+# so every status/error message MUST go to stderr (>&2). Only the final
+# `echo "$temp_file"` is allowed on stdout — that's the return value.
+#
+# We deliberately do NOT register an EXIT trap to clean up $temp_file: because
+# of the command substitution, this function runs in a subshell, and any EXIT
+# trap set here fires when the subshell exits — which is *before* install_binary
+# gets a chance to cp the file. Cleanup on success is install_binary's job
+# (after the cp), and cleanup on curl failure is handled inline below.
+download_binary() {
+    local binary_name="certctl-agent-${OS_TYPE}-${ARCH_TYPE}"
+    local download_url="${RELEASE_URL}/${binary_name}"
+
+    echo -e "${YELLOW}Downloading certctl agent (${OS_TYPE}-${ARCH_TYPE})...${NC}" >&2
+
+    if ! command -v curl &> /dev/null; then
+        echo -e "${RED}Error: curl is required but not installed${NC}" >&2
+        exit 1
+    fi
+
+    local temp_file
+    temp_file=$(mktemp)
+
+    if ! curl -sSL -f "$download_url" -o "$temp_file" >&2; then
+        rm -f "$temp_file"
+        echo -e "${RED}Error: Failed to download binary from $download_url${NC}" >&2
+        echo "Make sure the latest release exists on GitHub with the binary asset for ${OS_TYPE}-${ARCH_TYPE}." >&2
+        exit 1
+    fi
+
+    chmod +x "$temp_file"
+    echo "$temp_file"
+}
+
+# Install binary to system path
+install_binary() {
+    local binary_path="$1"
+
+    echo -e "${YELLOW}Installing to $INSTALL_DIR/$SERVICE_NAME...${NC}"
+
+    if [[ "$OS_TYPE" == "linux" ]]; then
+        cp "$binary_path" "$INSTALL_DIR/$SERVICE_NAME"
+    else
+        # macOS: use sudo if not already running as root
+        if [[ "$EUID" -ne 0 ]]; then
+            sudo cp "$binary_path" "$INSTALL_DIR/$SERVICE_NAME"
+        else
+            cp "$binary_path" "$INSTALL_DIR/$SERVICE_NAME"
+        fi
+    fi
+
+    chmod +x "$INSTALL_DIR/$SERVICE_NAME"
+    echo -e "${GREEN}Binary installed: $INSTALL_DIR/$SERVICE_NAME${NC}"
+
+    # Clean up the temp file created by download_binary. We can't use an EXIT
+    # trap inside download_binary because it runs in a subshell (command
+    # substitution), so the trap would fire before we got here. Doing it
+    # explicitly after the successful cp is the simplest correct pattern.
+    rm -f "$binary_path"
+}
+
+# Prompt for configuration. Any value supplied via flag is honored as-is
+# and we only prompt for the missing pieces. `read || true` prevents set -e
+# from aborting the script on EOF — instead the empty check below fires the
+# proper "required" error message.
+prompt_for_config() {
+    if [[ -z "${SERVER_URL:-}" ]]; then
+        echo ""
+        echo -e "${YELLOW}Enter certctl server URL (e.g., https://certctl.example.com):${NC}"
+        read -r SERVER_URL || true
+        if [[ -z "${SERVER_URL:-}" ]]; then
+            echo -e "${RED}Error: Server URL is required${NC}" >&2
+            echo "Hint: pass --server-url <URL> to run non-interactively." >&2
+            exit 1
+        fi
+    fi
+
+    if [[ -z "${API_KEY:-}" ]]; then
+        echo -e "${YELLOW}Enter certctl API key:${NC}"
+        read -rs API_KEY || true
+        echo ""
+        if [[ -z "${API_KEY:-}" ]]; then
+            echo -e "${RED}Error: API key is required${NC}" >&2
+            echo "Hint: pass --api-key <KEY> to run non-interactively." >&2
+            exit 1
+        fi
+    fi
+
+    if [[ -z "${AGENT_ID:-}" ]]; then
+        local default_agent_id
+        default_agent_id="$(hostname)"
+        # If stdin is still piped (no /dev/tty was available but SERVER_URL +
+        # API_KEY arrived via flags), skip the prompt entirely and use the
+        # default — no need to block on an optional value.
+        if [[ -t 0 ]]; then
+            echo -e "${YELLOW}Enter agent ID (default: $default_agent_id):${NC}"
+            read -r AGENT_ID || true
+        fi
+        if [[ -z "${AGENT_ID:-}" ]]; then
+            AGENT_ID="$default_agent_id"
+        fi
+    fi
+}
+
+# Create configuration directory and env file (Linux)
+setup_linux_config() {
+    local config_dir="/etc/certctl"
+    local config_file="$config_dir/agent.env"
+    local key_dir="/var/lib/certctl/keys"
+
+    echo -e "${YELLOW}Creating configuration directory...${NC}"
+
+    # Create /etc/certctl with restrictive permissions
+    mkdir -p "$config_dir"
+    chmod 755 "$config_dir"
+
+    # Create key storage directory with 0700 permissions
+    mkdir -p "$key_dir"
+    chmod 700 "$key_dir"
+
+    # Write agent configuration (overwrite if exists)
+    cat > "$config_file" <<EOF
+# certctl Agent Configuration
+# Generated by install-agent.sh on $(date)
+
+# Agent ID (unique identifier in the fleet)
+CERTCTL_AGENT_ID=$AGENT_ID
+
+# Control plane server URL
+CERTCTL_SERVER_URL=$SERVER_URL
+
+# API authentication key
+CERTCTL_API_KEY=$API_KEY
+
+# Key generation mode (agent = agent-side keygen, server = server-side for demo only)
+CERTCTL_KEYGEN_MODE=agent
+
+# Key storage directory (agent-side keygen)
+CERTCTL_KEY_DIR=$key_dir
+
+# Logging level (debug, info, warn, error)
+# CERTCTL_LOG_LEVEL=info
+
+# Discovery directories (comma-separated paths to scan for existing certs)
+# CERTCTL_DISCOVERY_DIRS=/etc/letsencrypt/live,/etc/ssl/certs
+
+# Enable deployment verification (TLS endpoint check post-deployment)
+# CERTCTL_VERIFY_DEPLOYMENT=true
+EOF
+
+    # Restrict permissions on env file (contains API key)
+    chmod 600 "$config_file"
+    echo -e "${GREEN}Configuration written to: $config_file${NC}"
+}
+
+# Create configuration directory and env file (macOS)
+setup_macos_config() {
+    local config_dir="$HOME/.certctl"
+    local config_file="$config_dir/agent.env"
+    local key_dir="$config_dir/keys"
+
+    echo -e "${YELLOW}Creating configuration directory...${NC}"
+
+    # Create ~/.certctl with restrictive permissions
+    mkdir -p "$config_dir"
+    chmod 700 "$config_dir"
+
+    # Create key storage directory
+    mkdir -p "$key_dir"
+    chmod 700 "$key_dir"
+
+    # Write agent configuration (overwrite if exists)
+    cat > "$config_file" <<EOF
+# certctl Agent Configuration
+# Generated by install-agent.sh on $(date)
+
+# Agent ID (unique identifier in the fleet)
+CERTCTL_AGENT_ID=$AGENT_ID
+
+# Control plane server URL
+CERTCTL_SERVER_URL=$SERVER_URL
+
+# API authentication key
+CERTCTL_API_KEY=$API_KEY
+
+# Key generation mode (agent = agent-side keygen, server = server-side for demo only)
+CERTCTL_KEYGEN_MODE=agent
+
+# Key storage directory (agent-side keygen)
+CERTCTL_KEY_DIR=$key_dir
+
+# Logging level (debug, info, warn, error)
+# CERTCTL_LOG_LEVEL=info
+
+# Discovery directories (comma-separated paths to scan for existing certs)
+# CERTCTL_DISCOVERY_DIRS=/etc/letsencrypt/live,/etc/ssl/certs
+
+# Enable deployment verification (TLS endpoint check post-deployment)
+# CERTCTL_VERIFY_DEPLOYMENT=true
+EOF
+
+    # Restrict permissions on env file (contains API key)
+    chmod 600 "$config_file"
+    echo -e "${GREEN}Configuration written to: $config_file${NC}"
+}
+
+# Create and enable systemd service (Linux only)
+setup_systemd_service() {
+    local service_file="/etc/systemd/system/${SERVICE_NAME}.service"
+
+    echo -e "${YELLOW}Creating systemd service file...${NC}"
+
+    cat > "$service_file" <<'EOF'
+[Unit]
+Description=certctl Agent - Certificate Lifecycle Management
+Documentation=https://github.com/shankar0123/certctl
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Restart=on-failure
+RestartSec=10s
+StandardOutput=journal
+StandardError=journal
+
+# Load environment from /etc/certctl/agent.env
+EnvironmentFile=/etc/certctl/agent.env
+
+# Command to start the agent
+ExecStart=/usr/local/bin/certctl-agent
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    chmod 644 "$service_file"
+    echo -e "${GREEN}Service file created: $service_file${NC}"
+
+    # Reload systemd daemon
+    systemctl daemon-reload
+}
+
+# Create and enable launchd plist (macOS only)
+setup_launchd_service() {
+    local plist_file="$HOME/Library/LaunchAgents/com.certctl.agent.plist"
+    local config_file="$HOME/.certctl/agent.env"
+    local launcher_script="$HOME/.certctl/launcher.sh"
+    local home_dir="$HOME"
+
+    echo -e "${YELLOW}Creating launchd service file...${NC}"
+
+    mkdir -p "$(dirname "$plist_file")"
+
+    # Create wrapper script that sources env file before executing agent
+    cat > "$launcher_script" <<'LAUNCHER_SCRIPT'
+#!/bin/bash
+set -a
+source "$HOME/.certctl/agent.env"
+set +a
+exec /usr/local/bin/certctl-agent
+LAUNCHER_SCRIPT
+
+    chmod 755 "$launcher_script"
+
+    # Create plist that references the launcher script
+    cat > "$plist_file" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.certctl.agent</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>$home_dir/.certctl/launcher.sh</string>
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>PATH</key>
+        <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <key>HOME</key>
+        <string>$home_dir</string>
+    </dict>
+    <key>KeepAlive</key>
+    <true/>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>StandardErrorPath</key>
+    <string>$home_dir/.certctl/agent.log</string>
+    <key>StandardOutPath</key>
+    <string>$home_dir/.certctl/agent.log</string>
+</dict>
+</plist>
+EOF
+
+    chmod 644 "$plist_file"
+    echo -e "${GREEN}Service file created: $plist_file${NC}"
+    echo -e "${GREEN}Launcher script created: $launcher_script${NC}"
+}
+
+# Start the agent service
+start_service() {
+    if [[ "${NO_START:-false}" == "true" ]]; then
+        echo -e "${YELLOW}Service not started (--no-start flag used)${NC}"
+        return
+    fi
+
+    echo -e "${YELLOW}Starting certctl agent service...${NC}"
+
+    if [[ "$OS_TYPE" == "linux" ]]; then
+        systemctl enable "$SERVICE_NAME"
+        systemctl start "$SERVICE_NAME"
+        sleep 2
+        if systemctl is-active --quiet "$SERVICE_NAME"; then
+            echo -e "${GREEN}Service started successfully${NC}"
+        else
+            echo -e "${RED}Warning: Service may not have started. Check logs with: systemctl status $SERVICE_NAME${NC}"
+        fi
+    else
+        # macOS: load launchd service for current user
+        launchctl load "$HOME/Library/LaunchAgents/com.certctl.agent.plist" 2>/dev/null || true
+        sleep 1
+        echo -e "${GREEN}Service loaded into launchd${NC}"
+    fi
+}
+
+# Print success message with next steps
+print_summary() {
+    echo ""
+    echo -e "${GREEN}========================================${NC}"
+    echo -e "${GREEN}certctl Agent Installation Complete${NC}"
+    echo -e "${GREEN}========================================${NC}"
+    echo ""
+    echo "Configuration:"
+    if [[ "$OS_TYPE" == "linux" ]]; then
+        echo "  Config file:    /etc/certctl/agent.env"
+        echo "  Key storage:    /var/lib/certctl/keys"
+        echo "  Service:        /etc/systemd/system/${SERVICE_NAME}.service"
+        echo "  View logs:      journalctl -u ${SERVICE_NAME} -f"
+    else
+        echo "  Config file:    $HOME/.certctl/agent.env"
+        echo "  Key storage:    $HOME/.certctl/keys"
+        echo "  Service:        $HOME/Library/LaunchAgents/com.certctl.agent.plist"
+        echo "  View logs:      tail -f $HOME/.certctl/agent.log"
+    fi
+    echo ""
+    echo "Next steps:"
+    echo "  1. Verify the service is running"
+    if [[ "$OS_TYPE" == "linux" ]]; then
+        echo "     systemctl status ${SERVICE_NAME}"
+    else
+        echo "     launchctl list | grep certctl"
+    fi
+    echo ""
+    echo "  2. Visit your certctl dashboard: $SERVER_URL"
+    echo "  3. The agent should appear in the fleet overview within 30 seconds"
+    echo ""
+}
+
+# Main installation flow
+main() {
+    parse_args "$@"
+    detect_platform
+    check_privileges
+
+    echo -e "${GREEN}certctl Agent Installer${NC}"
+    echo "Detected platform: ${OS_TYPE}-${ARCH_TYPE}"
+    echo ""
+
+    ensure_interactive_input
+    prompt_for_config
+
+    # Download and install binary
+    local binary_path
+    binary_path=$(download_binary)
+    install_binary "$binary_path"
+
+    # Setup OS-specific configuration
+    if [[ "$OS_TYPE" == "linux" ]]; then
+        setup_linux_config
+        setup_systemd_service
+    else
+        setup_macos_config
+        setup_launchd_service
+    fi
+
+    # Start the service
+    start_service
+
+    # Print summary
+    print_summary
+}
+
+main "$@"

integrity_check.sql

@@ -0,0 +1,187 @@
+-- =============================================================================
+-- Comprehensive Referential Integrity Check for seed_demo.sql
+-- Run AFTER migrations and seed data are loaded
+-- =============================================================================
+
+-- 1. Verify certificate_versions.certificate_id references valid managed_certificates.id
+SELECT 'FK VIOLATION: certificate_versions.certificate_id' AS issue, cv.id, cv.certificate_id
+FROM certificate_versions cv
+WHERE cv.certificate_id NOT IN (SELECT id FROM managed_certificates)
+ORDER BY cv.id;
+
+-- 2. Verify certificate_target_mappings references valid IDs
+SELECT 'FK VIOLATION: certificate_target_mappings.certificate_id' AS issue, ctm.certificate_id
+FROM certificate_target_mappings ctm
+WHERE ctm.certificate_id NOT IN (SELECT id FROM managed_certificates)
+ORDER BY ctm.certificate_id;
+
+SELECT 'FK VIOLATION: certificate_target_mappings.target_id' AS issue, ctm.target_id
+FROM certificate_target_mappings ctm
+WHERE ctm.target_id NOT IN (SELECT id FROM deployment_targets)
+ORDER BY ctm.target_id;
+
+-- 3. Verify jobs references valid IDs
+SELECT 'FK VIOLATION: jobs.certificate_id' AS issue, j.id, j.certificate_id
+FROM jobs j
+WHERE j.certificate_id NOT IN (SELECT id FROM managed_certificates)
+ORDER BY j.id;
+
+SELECT 'FK VIOLATION: jobs.target_id' AS issue, j.id, j.target_id
+FROM jobs j
+WHERE j.target_id IS NOT NULL AND j.target_id NOT IN (SELECT id FROM deployment_targets)
+ORDER BY j.id;
+
+SELECT 'FK VIOLATION: jobs.agent_id' AS issue, j.id, j.agent_id
+FROM jobs j
+WHERE j.agent_id NOT IN (SELECT id FROM agents)
+ORDER BY j.id;
+
+-- 4. Verify discovered_certificates references valid IDs
+SELECT 'FK VIOLATION: discovered_certificates.agent_id' AS issue, dc.id, dc.agent_id
+FROM discovered_certificates dc
+WHERE dc.agent_id NOT IN (SELECT id FROM agents)
+ORDER BY dc.id;
+
+SELECT 'FK VIOLATION: discovered_certificates.discovery_scan_id' AS issue, dc.id, dc.discovery_scan_id
+FROM discovered_certificates dc
+WHERE dc.discovery_scan_id IS NOT NULL AND dc.discovery_scan_id NOT IN (SELECT id FROM discovery_scans)
+ORDER BY dc.id;
+
+-- 5. Verify notification_events references valid certificate_id
+SELECT 'FK VIOLATION: notification_events.certificate_id' AS issue, ne.id, ne.certificate_id
+FROM notification_events ne
+WHERE ne.certificate_id IS NOT NULL AND ne.certificate_id NOT IN (SELECT id FROM managed_certificates)
+ORDER BY ne.id;
+
+-- 6. Verify policy_violations references valid certificate_id
+SELECT 'FK VIOLATION: policy_violations.certificate_id' AS issue, pv.id, pv.certificate_id
+FROM policy_violations pv
+WHERE pv.certificate_id NOT IN (SELECT id FROM managed_certificates)
+ORDER BY pv.id;
+
+-- 7. Verify certificate_revocations references valid IDs
+SELECT 'FK VIOLATION: certificate_revocations.certificate_id' AS issue, cr.id, cr.certificate_id
+FROM certificate_revocations cr
+WHERE cr.certificate_id NOT IN (SELECT id FROM managed_certificates)
+ORDER BY cr.id;
+
+SELECT 'FK VIOLATION: certificate_revocations.issuer_id' AS issue, cr.id, cr.issuer_id
+FROM certificate_revocations cr
+WHERE cr.issuer_id NOT IN (SELECT id FROM issuers)
+ORDER BY cr.id;
+
+-- 8. Verify agent_group_members references valid IDs
+SELECT 'FK VIOLATION: agent_group_members.agent_group_id' AS issue, agm.agent_group_id
+FROM agent_group_members agm
+WHERE agm.agent_group_id NOT IN (SELECT id FROM agent_groups)
+ORDER BY agm.agent_group_id;
+
+SELECT 'FK VIOLATION: agent_group_members.agent_id' AS issue, agm.agent_id
+FROM agent_group_members agm
+WHERE agm.agent_id NOT IN (SELECT id FROM agents)
+ORDER BY agm.agent_id;
+
+-- 9. Verify owners.team_id references valid teams.id
+SELECT 'FK VIOLATION: owners.team_id' AS issue, o.id, o.team_id
+FROM owners o
+WHERE o.team_id IS NOT NULL AND o.team_id NOT IN (SELECT id FROM teams)
+ORDER BY o.id;
+
+-- 10. Verify deployment_targets.agent_id references valid agents.id
+SELECT 'FK VIOLATION: deployment_targets.agent_id' AS issue, dt.id, dt.agent_id
+FROM deployment_targets dt
+WHERE dt.agent_id NOT IN (SELECT id FROM agents)
+ORDER BY dt.id;
+
+-- 11. Verify managed_certificates FK columns
+SELECT 'FK VIOLATION: managed_certificates.owner_id' AS issue, mc.id, mc.owner_id
+FROM managed_certificates mc
+WHERE mc.owner_id IS NOT NULL AND mc.owner_id NOT IN (SELECT id FROM owners)
+ORDER BY mc.id;
+
+SELECT 'FK VIOLATION: managed_certificates.team_id' AS issue, mc.id, mc.team_id
+FROM managed_certificates mc
+WHERE mc.team_id IS NOT NULL AND mc.team_id NOT IN (SELECT id FROM teams)
+ORDER BY mc.id;
+
+SELECT 'FK VIOLATION: managed_certificates.issuer_id' AS issue, mc.id, mc.issuer_id
+FROM managed_certificates mc
+WHERE mc.issuer_id NOT IN (SELECT id FROM issuers)
+ORDER BY mc.id;
+
+SELECT 'FK VIOLATION: managed_certificates.renewal_policy_id' AS issue, mc.id, mc.renewal_policy_id
+FROM managed_certificates mc
+WHERE mc.renewal_policy_id IS NOT NULL AND mc.renewal_policy_id NOT IN (SELECT id FROM renewal_policies)
+ORDER BY mc.id;
+
+-- 12. Check for duplicate primary keys
+SELECT 'DUPLICATE PK: teams' AS issue, id, COUNT(*) as count
+FROM teams GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: owners' AS issue, id, COUNT(*) as count
+FROM owners GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: agents' AS issue, id, COUNT(*) as count
+FROM agents GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: deployment_targets' AS issue, id, COUNT(*) as count
+FROM deployment_targets GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: managed_certificates' AS issue, id, COUNT(*) as count
+FROM managed_certificates GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: certificate_versions' AS issue, id, COUNT(*) as count
+FROM certificate_versions GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: issuers' AS issue, id, COUNT(*) as count
+FROM issuers GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: renewal_policies' AS issue, id, COUNT(*) as count
+FROM renewal_policies GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: jobs' AS issue, id, COUNT(*) as count
+FROM jobs GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: certificate_profiles' AS issue, id, COUNT(*) as count
+FROM certificate_profiles GROUP BY id HAVING COUNT(*) > 1;
+
+SELECT 'DUPLICATE PK: certificate_revocations' AS issue, id, COUNT(*) as count
+FROM certificate_revocations GROUP BY id HAVING COUNT(*) > 1;
+
+-- 13. Check fingerprint_sha256 uniqueness in certificate_versions
+SELECT 'DUPLICATE FINGERPRINT: certificate_versions' AS issue, fingerprint_sha256, COUNT(*) as count
+FROM certificate_versions
+WHERE fingerprint_sha256 IS NOT NULL
+GROUP BY fingerprint_sha256
+HAVING COUNT(*) > 1;
+
+-- 14. Check serial number uniqueness in certificate_versions
+SELECT 'DUPLICATE SERIAL: certificate_versions' AS issue, serial_number, COUNT(*) as count
+FROM certificate_versions
+WHERE serial_number IS NOT NULL
+GROUP BY serial_number
+HAVING COUNT(*) > 1;
+
+-- 15. Verify discovery_scan_id references are valid
+SELECT 'FK VIOLATION: discovered_certificates.discovery_scan_id references' AS issue,
+  dc.id, dc.discovery_scan_id, ds.id
+FROM discovered_certificates dc
+LEFT JOIN discovery_scans ds ON dc.discovery_scan_id = ds.id
+WHERE dc.discovery_scan_id IS NOT NULL AND ds.id IS NULL;
+
+-- Summary: Count total records
+SELECT 'SUMMARY: teams' AS table_name, COUNT(*) as count FROM teams UNION ALL
+SELECT 'SUMMARY: owners', COUNT(*) FROM owners UNION ALL
+SELECT 'SUMMARY: agents', COUNT(*) FROM agents UNION ALL
+SELECT 'SUMMARY: deployment_targets', COUNT(*) FROM deployment_targets UNION ALL
+SELECT 'SUMMARY: managed_certificates', COUNT(*) FROM managed_certificates UNION ALL
+SELECT 'SUMMARY: certificate_versions', COUNT(*) FROM certificate_versions UNION ALL
+SELECT 'SUMMARY: certificate_target_mappings', COUNT(*) FROM certificate_target_mappings UNION ALL
+SELECT 'SUMMARY: issuers', COUNT(*) FROM issuers UNION ALL
+SELECT 'SUMMARY: renewal_policies', COUNT(*) FROM renewal_policies UNION ALL
+SELECT 'SUMMARY: jobs', COUNT(*) FROM jobs UNION ALL
+SELECT 'SUMMARY: certificate_profiles', COUNT(*) FROM certificate_profiles UNION ALL
+SELECT 'SUMMARY: certificate_revocations', COUNT(*) FROM certificate_revocations UNION ALL
+SELECT 'SUMMARY: audit_events', COUNT(*) FROM audit_events UNION ALL
+SELECT 'SUMMARY: discovery_scans', COUNT(*) FROM discovery_scans UNION ALL
+SELECT 'SUMMARY: discovered_certificates', COUNT(*) FROM discovered_certificates;

internal/api/handler/adversarial_est_test.go

@@ -0,0 +1,339 @@
+package handler
+
+// Adversarial EST (RFC 7030) enrollment tests — Tier 1F.
+//
+// EST is the RFC 7030 protocol for certificate enrollment over HTTPS. The
+// control-plane parser accepts PKCS#10 CSRs either as PEM or as base64-encoded
+// DER, and it's a prime target for:
+//
+//   * Malformed base64 / non-DER payloads
+//   * Valid base64 that doesn't decode to a valid CSR
+//   * PEM header spoofing (wrong block type)
+//   * Null bytes and control characters embedded in PEM or base64
+//   * Huge CSR bodies (we expect the handler's 1 MiB LimitReader to clamp them)
+//   * Truncated or partially-written PEM blocks
+//   * Unicode homoglyphs in PEM delimiters
+//   * Content-Type mismatch (handler ignores Content-Type, but attackers might
+//     still try header spoofing)
+//
+// The contract is the same as other adversarial tiers: the handler must never
+// panic and must never return 500 for a malformed CSR (500 is reserved for
+// issuer/service failures). For adversarial CSRs, the correct status is 400.
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// adversarialCSRInputs exercises the EST CSR parsing surface. None of these
+// should reach the underlying ESTService — they must be rejected by
+// readCSRFromRequest with a 400 before any service call is made.
+func adversarialCSRInputs() []struct {
+	name string
+	body string
+} {
+	// A garbage base64 string that decodes cleanly but isn't a PKCS#10 CSR.
+	// base64 of "this is definitely not a CSR" = dGhpcyBpcyBkZWZpbml0ZWx5IG5vdCBhIENTUg==
+	nonCSRBase64 := base64.StdEncoding.EncodeToString([]byte("this is definitely not a CSR"))
+
+	return []struct {
+		name string
+		body string
+	}{
+		{"garbage_string", "not-a-csr-at-all"},
+		{"base64_garbage", "!!!@@@###$$$%%%"},
+		{"base64_valid_non_csr", nonCSRBase64},
+		{"base64_very_short", "AA=="},
+		{"null_byte_only", "\x00"},
+		{"null_bytes_padding", "\x00\x00\x00\x00\x00\x00\x00\x00"},
+		{"control_chars", "\x01\x02\x03\x04\x05\x06\x07\x08"},
+		{"pem_wrong_block_type", "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n"},
+		{"pem_wrong_header_close", "-----BEGIN CERTIFICATE REQUEST-----\nMIIB\n-----END PRIVATE KEY-----\n"},
+		{"pem_empty_block", "-----BEGIN CERTIFICATE REQUEST-----\n-----END CERTIFICATE REQUEST-----\n"},
+		{"pem_garbage_body", "-----BEGIN CERTIFICATE REQUEST-----\n!!!not base64!!!\n-----END CERTIFICATE REQUEST-----\n"},
+		{"pem_truncated", "-----BEGIN CERTIFICATE REQUEST-----\nMIIBijCCAT"},
+		{"pem_no_end_marker", "-----BEGIN CERTIFICATE REQUEST-----\nMIIBijCCATICAQAwFjEUMBIGA1UE\n"},
+		{"pem_header_injection", "-----BEGIN CERTIFICATE REQUEST-----\r\nHost: evil.com\r\n\r\nMIIB\n-----END CERTIFICATE REQUEST-----\n"},
+		{"pem_embedded_null", "-----BEGIN CERTIFICATE\x00REQUEST-----\nMIIB\n-----END CERTIFICATE REQUEST-----\n"},
+		{"unicode_homoglyph_pem", "-----BEGIN CERTIFICATE REQUEST─────\nMIIB\n─────END CERTIFICATE REQUEST-----\n"},
+		{"double_pem_block", "-----BEGIN CERTIFICATE REQUEST-----\nMIIB\n-----END CERTIFICATE REQUEST-----\n-----BEGIN CERTIFICATE REQUEST-----\nMIIB\n-----END CERTIFICATE REQUEST-----\n"},
+		{"json_body", `{"csr":"MIIB","common_name":"attacker.com"}`},
+		{"xml_body", `<?xml version="1.0"?><csr>MIIB</csr>`},
+		{"shell_metacharacters", "$(whoami); rm -rf / #"},
+		{"sql_injection", "' OR 1=1; DROP TABLE certificates;--"},
+		{"long_garbage_10k", strings.Repeat("A", 10000)},
+		{"long_base64_not_csr", base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0xFF}, 5000))},
+		{"base64_with_newlines_garbage", "AAAAAAAAAAAAAAAA\nBBBBBBBBBBBBBBBB\nCCCCCCCCCCCCCCCC"},
+		{"percent_encoded_pem", "%2D%2D%2D%2D%2DBEGIN+CERTIFICATE+REQUEST%2D%2D%2D%2D%2D"},
+	}
+}
+
+// assertESTErrorResponse enforces the EST handler contract for adversarial CSRs:
+// no panic, no 500, body is valid JSON (since Error helper emits JSON errors).
+func assertESTErrorResponse(t *testing.T, w *httptest.ResponseRecorder, label string) {
+	t.Helper()
+
+	// The handler must never reach a 500 for parser-rejected CSRs — that would
+	// indicate a service call slipped through.
+	if w.Code == http.StatusInternalServerError {
+		t.Errorf("%s: handler returned 500 body=%q — adversarial CSR should not reach the service layer",
+			label, w.Body.String())
+	}
+
+	// The handler should return 400 Bad Request for adversarial CSR inputs.
+	// A 405 (method not allowed) is impossible here because we always POST.
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("%s: expected 400, got %d (body=%q)", label, w.Code, w.Body.String())
+	}
+}
+
+// newESTHandlerWithTrap returns an ESTHandler whose service panics if reached.
+// This is the core invariant for Tier 1F: adversarial CSRs must be rejected at
+// the parser, never reaching SimpleEnroll/SimpleReEnroll on the service.
+func newESTHandlerWithTrap() (ESTHandler, *trappedESTService) {
+	svc := &trappedESTService{}
+	return NewESTHandler(svc), svc
+}
+
+// trappedESTService is a mock that fails the test if any service method is
+// called with an adversarial CSR. The parser should reject these before they
+// get here.
+type trappedESTService struct {
+	serviceCalled bool
+}
+
+func (t *trappedESTService) GetCACerts(ctx context.Context) (string, error) {
+	t.serviceCalled = true
+	return "", errors.New("trap: GetCACerts should not be called from adversarial CSR tests")
+}
+
+func (t *trappedESTService) SimpleEnroll(ctx context.Context, csrPEM string) (*domain.ESTEnrollResult, error) {
+	t.serviceCalled = true
+	return nil, errors.New("trap: SimpleEnroll should not be called from adversarial CSR tests")
+}
+
+func (t *trappedESTService) SimpleReEnroll(ctx context.Context, csrPEM string) (*domain.ESTEnrollResult, error) {
+	t.serviceCalled = true
+	return nil, errors.New("trap: SimpleReEnroll should not be called from adversarial CSR tests")
+}
+
+func (t *trappedESTService) GetCSRAttrs(ctx context.Context) ([]byte, error) {
+	t.serviceCalled = true
+	return nil, errors.New("trap: GetCSRAttrs should not be called from adversarial CSR tests")
+}
+
+// TestESTSimpleEnroll_AdversarialCSRs runs each adversarial CSR through the
+// enrollment endpoint.
+func TestESTSimpleEnroll_AdversarialCSRs(t *testing.T) {
+	for _, tc := range adversarialCSRInputs() {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on body %q: %v", tc.body, r)
+				}
+			}()
+
+			h, svc := newESTHandlerWithTrap()
+
+			req := httptest.NewRequest(http.MethodPost, "/.well-known/est/simpleenroll", strings.NewReader(tc.body))
+			req.Header.Set("Content-Type", "application/pkcs10")
+
+			w := httptest.NewRecorder()
+			h.SimpleEnroll(w, req)
+
+			assertESTErrorResponse(t, w, "SimpleEnroll/"+tc.name)
+
+			if svc.serviceCalled {
+				t.Errorf("SimpleEnroll/%s: service was reached with adversarial CSR (body=%q)",
+					tc.name, tc.body)
+			}
+		})
+	}
+}
+
+// TestESTSimpleReEnroll_AdversarialCSRs runs each adversarial CSR through the
+// re-enrollment endpoint. Same contract as simpleenroll.
+func TestESTSimpleReEnroll_AdversarialCSRs(t *testing.T) {
+	for _, tc := range adversarialCSRInputs() {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on body %q: %v", tc.body, r)
+				}
+			}()
+
+			h, svc := newESTHandlerWithTrap()
+
+			req := httptest.NewRequest(http.MethodPost, "/.well-known/est/simplereenroll", strings.NewReader(tc.body))
+			req.Header.Set("Content-Type", "application/pkcs10")
+
+			w := httptest.NewRecorder()
+			h.SimpleReEnroll(w, req)
+
+			assertESTErrorResponse(t, w, "SimpleReEnroll/"+tc.name)
+
+			if svc.serviceCalled {
+				t.Errorf("SimpleReEnroll/%s: service was reached with adversarial CSR (body=%q)",
+					tc.name, tc.body)
+			}
+		})
+	}
+}
+
+// TestESTSimpleEnroll_HugeBody verifies the handler's 1 MiB limit truncates
+// oversized requests at the LimitReader boundary. We send a 2 MiB body of
+// base64 garbage and confirm the handler rejects it cleanly (400, no panic,
+// no 500) and the service is never reached.
+func TestESTSimpleEnroll_HugeBody(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("handler panicked on 2 MiB body: %v", r)
+		}
+	}()
+
+	// 2 MiB of base64-valid garbage: the LimitReader will truncate to 1 MiB, and
+	// the truncated base64 chunk won't parse as a valid PKCS#10 CSR.
+	huge := strings.Repeat("A", 2<<20)
+
+	h, svc := newESTHandlerWithTrap()
+
+	req := httptest.NewRequest(http.MethodPost, "/.well-known/est/simpleenroll", strings.NewReader(huge))
+	req.Header.Set("Content-Type", "application/pkcs10")
+
+	w := httptest.NewRecorder()
+	h.SimpleEnroll(w, req)
+
+	// Contract: 400 Bad Request (parser fail), no panic, no 500.
+	if w.Code == http.StatusInternalServerError {
+		t.Errorf("HugeBody: handler returned 500 for 2 MiB body (body=%q)", w.Body.String())
+	}
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("HugeBody: expected 400, got %d (body=%q)", w.Code, w.Body.String())
+	}
+	if svc.serviceCalled {
+		t.Error("HugeBody: service was reached with 2 MiB adversarial body")
+	}
+}
+
+// TestESTSimpleEnroll_ExactlyAtLimit sends a body exactly at the 1 MiB
+// LimitReader boundary. The body is still garbage (won't parse as CSR), but we
+// verify the handler doesn't panic or hang on the boundary case.
+func TestESTSimpleEnroll_ExactlyAtLimit(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("handler panicked on exact-limit body: %v", r)
+		}
+	}()
+
+	atLimit := strings.Repeat("A", 1<<20) // exactly 1 MiB
+
+	h, _ := newESTHandlerWithTrap()
+
+	req := httptest.NewRequest(http.MethodPost, "/.well-known/est/simpleenroll", strings.NewReader(atLimit))
+	w := httptest.NewRecorder()
+	h.SimpleEnroll(w, req)
+
+	if w.Code == http.StatusInternalServerError {
+		t.Errorf("ExactlyAtLimit: handler returned 500 (body=%q)", w.Body.String())
+	}
+}
+
+// TestESTSimpleEnroll_MultipartBody sends a multipart/form-data body that a
+// naive parser might try to unwrap. The handler should treat the raw bytes as
+// a CSR payload and reject them.
+func TestESTSimpleEnroll_MultipartBody(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("handler panicked on multipart body: %v", r)
+		}
+	}()
+
+	multipart := "--boundary\r\nContent-Disposition: form-data; name=\"csr\"\r\n\r\nMIIB\r\n--boundary--\r\n"
+
+	h, svc := newESTHandlerWithTrap()
+
+	req := httptest.NewRequest(http.MethodPost, "/.well-known/est/simpleenroll", strings.NewReader(multipart))
+	req.Header.Set("Content-Type", "multipart/form-data; boundary=boundary")
+	w := httptest.NewRecorder()
+	h.SimpleEnroll(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("MultipartBody: expected 400, got %d (body=%q)", w.Code, w.Body.String())
+	}
+	if svc.serviceCalled {
+		t.Error("MultipartBody: service was reached with multipart wrapper")
+	}
+}
+
+// TestESTCACerts_MethodAbuse verifies the /cacerts endpoint only accepts GET
+// and rejects every other method cleanly. This is a small safety check for
+// the spec invariant.
+func TestESTCACerts_MethodAbuse(t *testing.T) {
+	methods := []string{
+		http.MethodPost, http.MethodPut, http.MethodDelete,
+		http.MethodPatch, http.MethodHead, http.MethodOptions,
+		"TRACE", "CONNECT", "PROPFIND", "BOGUS",
+	}
+
+	for _, method := range methods {
+		t.Run(method, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on method %s: %v", method, r)
+				}
+			}()
+
+			h, _ := newESTHandlerWithTrap()
+
+			req := httptest.NewRequest(method, "/.well-known/est/cacerts", nil)
+			w := httptest.NewRecorder()
+			h.CACerts(w, req)
+
+			// HEAD on a GET handler in Go's stdlib is normally accepted, but
+			// this handler enforces strict GET-only — so HEAD should also get 405.
+			if w.Code != http.StatusMethodNotAllowed {
+				t.Errorf("method %s: expected 405, got %d", method, w.Code)
+			}
+		})
+	}
+}
+
+// TestESTSimpleEnroll_MethodAbuse verifies strict POST-only enforcement.
+func TestESTSimpleEnroll_MethodAbuse(t *testing.T) {
+	methods := []string{
+		http.MethodGet, http.MethodPut, http.MethodDelete,
+		http.MethodPatch, http.MethodHead, http.MethodOptions,
+		"TRACE", "CONNECT",
+	}
+
+	for _, method := range methods {
+		t.Run(method, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on method %s: %v", method, r)
+				}
+			}()
+
+			h, svc := newESTHandlerWithTrap()
+
+			req := httptest.NewRequest(method, "/.well-known/est/simpleenroll", strings.NewReader("body"))
+			w := httptest.NewRecorder()
+			h.SimpleEnroll(w, req)
+
+			if w.Code != http.StatusMethodNotAllowed {
+				t.Errorf("method %s: expected 405, got %d", method, w.Code)
+			}
+			if svc.serviceCalled {
+				t.Errorf("method %s: service was called for non-POST", method)
+			}
+		})
+	}
+}

internal/api/handler/adversarial_path_test.go

@@ -0,0 +1,337 @@
+package handler
+
+// Adversarial path-parameter and multi-segment path tests.
+//
+// These tests exercise the input parsing boundary of the certificate handler
+// against the attack categories listed in certctl-adversarial-testing-prompt.md
+// Tier 1A / 1B:
+//
+//   * Empty and whitespace-only path IDs
+//   * SQL-injection sentinels embedded in the path
+//   * Directory traversal (`../../etc/passwd`)
+//   * Null bytes and control characters
+//   * Extremely long IDs (10 KiB)
+//   * Unicode homoglyphs (visually identical substitutes)
+//   * Multi-segment paths (OCSP, DER CRL, versions, renew, deploy, revoke)
+//
+// The contract we verify is defensive, not behavioural:
+//
+//   1. The handler never panics.
+//   2. The HTTP status is one of {200, 400, 404, 405} — never 500.
+//   3. The response body is either empty or valid JSON.
+//   4. No attacker-controlled input is echoed verbatim in a 500 body.
+//
+// We do not assert the exact status code for every adversarial input because
+// the current handler intentionally delegates identifier validation to the
+// repository layer; its only job here is to stay up and well-formed.
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// adversarialPathInputs is the attack catalog shared by Tier 1A cases. Each
+// entry targets a different parsing surface; adding a new category here makes
+// every Tier 1A test below exercise it automatically.
+func adversarialPathInputs() []struct {
+	name  string
+	input string
+} {
+	return []struct {
+		name  string
+		input string
+	}{
+		{"sql_injection_drop_table", "'; DROP TABLE managed_certificates;--"},
+		{"sql_injection_or_true", "' OR 1=1--"},
+		{"sql_injection_union", "mc-001' UNION SELECT * FROM agents--"},
+		{"path_traversal_dot_dot", "../../etc/passwd"},
+		{"path_traversal_encoded", "..%2F..%2Fetc%2Fpasswd"},
+		{"null_byte_trailing", "mc-001\x00"},
+		{"null_byte_embedded", "mc-\x00-001"},
+		{"long_id_10k", strings.Repeat("A", 10000)},
+		{"unicode_homoglyph_hyphen", "mc\u2010001"},          // U+2010 HYPHEN
+		{"unicode_homoglyph_fullwidth", "mc\uFF0D001"},       // U+FF0D FULLWIDTH HYPHEN-MINUS
+		{"control_char_newline", "mc-001\n"},
+		{"control_char_tab", "mc\t001"},
+		{"control_char_bell", "mc\x07001"},
+		{"percent_encoded_null", "mc-001%00"},
+		{"whitespace_only", "   "},
+		{"shell_metacharacters", "mc-001;`rm -rf /`"},
+		{"leading_slash", "/mc-001"},
+		{"trailing_slash", "mc-001/"},
+		{"double_slash", "mc//001"},
+	}
+}
+
+// assertSafeResponse is the core defensive check. Any adversarial input is
+// allowed to produce a 4xx, but must not panic or leak through as a 500.
+func assertSafeResponse(t *testing.T, w *httptest.ResponseRecorder, label string) {
+	t.Helper()
+
+	// 1. No 500 (500 implies the handler reached an unexpected internal state).
+	if w.Code == http.StatusInternalServerError {
+		t.Errorf("%s: handler returned 500, body=%q — adversarial input should not reach an internal error path",
+			label, w.Body.String())
+	}
+
+	// 2. Status must be in the expected safe set.
+	switch w.Code {
+	case http.StatusOK, http.StatusCreated, http.StatusAccepted, http.StatusNoContent,
+		http.StatusBadRequest, http.StatusNotFound, http.StatusMethodNotAllowed, http.StatusNotImplemented:
+		// ok
+	default:
+		t.Errorf("%s: unexpected status %d (body=%q)", label, w.Code, w.Body.String())
+	}
+
+	// 3. Non-empty bodies must be valid JSON (no template leakage, no raw panics).
+	if body := bytes.TrimSpace(w.Body.Bytes()); len(body) > 0 {
+		var discard interface{}
+		if err := json.Unmarshal(body, &discard); err != nil {
+			t.Errorf("%s: response body is not valid JSON: %v (body=%q)", label, err, w.Body.String())
+		}
+	}
+}
+
+// newCertHandlerWithMock builds a handler whose mock service returns nothing.
+// This keeps every adversarial test focused on the handler's parsing layer
+// rather than service behaviour.
+func newCertHandlerWithMock() (CertificateHandler, *MockCertificateService) {
+	mock := &MockCertificateService{}
+	return NewCertificateHandler(mock), mock
+}
+
+// TestGetCertificate_PathInjection runs each adversarial path through the
+// certificate GET handler.
+func TestGetCertificate_PathInjection(t *testing.T) {
+	for _, tc := range adversarialPathInputs() {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on input %q: %v", tc.input, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			// Force a 404 so we can distinguish "service was called" from
+			// "parser accepted the ID"; a 200 with null body is also fine.
+			mock.GetCertificateFn = func(_ context.Context, id string) (*domain.ManagedCertificate, error) {
+				return nil, ErrMockNotFound
+			}
+
+			// Build the URL by string concatenation to keep attacker-controlled
+			// bytes intact (httptest.NewRequest uses url.Parse under the hood,
+			// which normalises some characters — we want the raw path on the
+			// request object).
+			req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates/x", nil)
+			req.URL.Path = "/api/v1/certificates/" + tc.input
+			req = req.WithContext(contextWithRequestID())
+
+			w := httptest.NewRecorder()
+			handler.GetCertificate(w, req)
+
+			assertSafeResponse(t, w, "GetCertificate/"+tc.name)
+		})
+	}
+}
+
+// TestUpdateCertificate_PathInjection exercises the PUT handler's path parser.
+// UpdateCertificate splits the path on "/" and takes parts[0]; traversal and
+// double-slash inputs must still short-circuit at the parser rather than
+// reaching the service.
+func TestUpdateCertificate_PathInjection(t *testing.T) {
+	body := `{"common_name":"example.com","owner_id":"o-alice","team_id":"t-a","issuer_id":"iss-local","name":"n","renewal_policy_id":"rp-1"}`
+
+	for _, tc := range adversarialPathInputs() {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on input %q: %v", tc.input, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.UpdateCertificateFn = func(_ context.Context, id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+				return nil, ErrMockNotFound
+			}
+
+			req := httptest.NewRequest(http.MethodPut, "/api/v1/certificates/x", bytes.NewBufferString(body))
+			req.URL.Path = "/api/v1/certificates/" + tc.input
+			req.Header.Set("Content-Type", "application/json")
+			req = req.WithContext(contextWithRequestID())
+
+			w := httptest.NewRecorder()
+			handler.UpdateCertificate(w, req)
+
+			assertSafeResponse(t, w, "UpdateCertificate/"+tc.name)
+		})
+	}
+}
+
+// TestArchiveCertificate_PathInjection exercises DELETE.
+func TestArchiveCertificate_PathInjection(t *testing.T) {
+	for _, tc := range adversarialPathInputs() {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on input %q: %v", tc.input, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.ArchiveCertificateFn = func(_ context.Context, id string) error { return ErrMockNotFound }
+
+			req := httptest.NewRequest(http.MethodDelete, "/api/v1/certificates/x", nil)
+			req.URL.Path = "/api/v1/certificates/" + tc.input
+			req = req.WithContext(contextWithRequestID())
+
+			w := httptest.NewRecorder()
+			handler.ArchiveCertificate(w, req)
+
+			assertSafeResponse(t, w, "ArchiveCertificate/"+tc.name)
+		})
+	}
+}
+
+// TestGetCertificateVersions_MultiSegment is a Tier 1B test: the versions
+// handler requires a 2-segment path (certID/versions). The parser uses
+// strings.Split(path, "/") and checks len(parts) < 2 — but an adversarial
+// caller can inject extra slashes to either produce an empty parts[0] or a
+// very long parts slice. Either way we must not panic.
+func TestGetCertificateVersions_MultiSegment(t *testing.T) {
+	cases := []struct {
+		name string
+		path string
+	}{
+		{"missing_segment", "/api/v1/certificates/versions"},
+		{"empty_cert_id", "/api/v1/certificates//versions"},
+		{"traversal_cert_id", "/api/v1/certificates/..%2F..%2Fversions/versions"},
+		{"sql_injection_cert_id", "/api/v1/certificates/'%20OR%201=1--/versions"},
+		{"null_byte_cert_id", "/api/v1/certificates/mc\x00001/versions"},
+		{"very_long_cert_id", "/api/v1/certificates/" + strings.Repeat("A", 5000) + "/versions"},
+		{"trailing_segments", "/api/v1/certificates/mc-001/versions/extra/trailing"},
+		{"deep_nesting", "/api/v1/certificates/" + strings.Repeat("a/", 50) + "versions"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on path %q: %v", tc.path, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.GetCertificateVersionsFn = func(_ context.Context, certID string, page, perPage int) ([]domain.CertificateVersion, int64, error) {
+				return []domain.CertificateVersion{}, 0, nil
+			}
+
+			// Use a dummy safe URL in NewRequest to avoid url.Parse panics
+			// on control chars, then overwrite with the raw attacker path.
+			req := httptest.NewRequest(http.MethodGet, "/safe", nil)
+			req.URL.Path = tc.path
+			req = req.WithContext(contextWithRequestID())
+
+			w := httptest.NewRecorder()
+			handler.GetCertificateVersions(w, req)
+
+			assertSafeResponse(t, w, "GetCertificateVersions/"+tc.name)
+		})
+	}
+}
+
+// TestHandleOCSP_MultiSegment exercises the OCSP responder's 2-segment path
+// parser (/.well-known/pki/ocsp/{issuer_id}/{serial_hex}). Each leg is
+// attacker-controlled and the serial can be arbitrary length. This is a key
+// adversarial surface because the serial is passed directly to the
+// CA-operations service, which is expected to treat it as an opaque
+// identifier.
+//
+// M-006 relocation: these paths were previously served at /api/v1/ocsp/*;
+// under RFC 8615 and RFC 6960 they now live under /.well-known/pki/ocsp/*.
+func TestHandleOCSP_MultiSegment(t *testing.T) {
+	cases := []struct {
+		name string
+		path string
+	}{
+		{"missing_serial", "/.well-known/pki/ocsp/iss-local"},
+		{"missing_both", "/.well-known/pki/ocsp/"},
+		{"empty_issuer", "/.well-known/pki/ocsp//01ABCDEF"},
+		{"empty_serial", "/.well-known/pki/ocsp/iss-local/"},
+		{"traversal_issuer", "/.well-known/pki/ocsp/..%2F..%2Fetc/passwd/01"},
+		{"null_byte_serial", "/.well-known/pki/ocsp/iss-local/01\x00FF"},
+		{"sql_injection_serial", "/.well-known/pki/ocsp/iss-local/01'; DROP TABLE--"},
+		{"negative_hex_serial", "/.well-known/pki/ocsp/iss-local/-1"},
+		{"unicode_serial", "/.well-known/pki/ocsp/iss-local/01\u2010FF"},
+		{"extremely_long_serial", "/.well-known/pki/ocsp/iss-local/" + strings.Repeat("F", 10000)},
+		{"extra_segments", "/.well-known/pki/ocsp/iss-local/01FF/extra/segments"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on path %q: %v", tc.path, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.GetOCSPResponseFn = func(_ context.Context, issuerID, serialHex string) ([]byte, error) {
+				return nil, ErrMockNotFound
+			}
+
+			req := httptest.NewRequest(http.MethodGet, "/safe", nil)
+			req.URL.Path = tc.path
+			req = req.WithContext(contextWithRequestID())
+
+			w := httptest.NewRecorder()
+			handler.HandleOCSP(w, req)
+
+			// OCSP does NOT guarantee JSON responses (pkix-crl uses binary),
+			// so we only check status safety, not body structure.
+			if w.Code == http.StatusInternalServerError {
+				t.Errorf("HandleOCSP/%s: returned 500 body=%q", tc.name, w.Body.String())
+			}
+			if w.Code >= 500 {
+				t.Errorf("HandleOCSP/%s: unexpected 5xx %d", tc.name, w.Code)
+			}
+		})
+	}
+}
+
+// TestGetDERCRL_IssuerPathInjection exercises
+// /.well-known/pki/crl/{issuer_id} (RFC 5280 CRL; M-006 relocation from
+// /api/v1/crl/{issuer_id}).
+func TestGetDERCRL_IssuerPathInjection(t *testing.T) {
+	for _, tc := range adversarialPathInputs() {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("handler panicked on input %q: %v", tc.input, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.GenerateDERCRLFn = func(_ context.Context, issuerID string) ([]byte, error) {
+				return nil, ErrMockNotFound
+			}
+
+			req := httptest.NewRequest(http.MethodGet, "/.well-known/pki/crl/x", nil)
+			req.URL.Path = "/.well-known/pki/crl/" + tc.input
+			req = req.WithContext(contextWithRequestID())
+
+			w := httptest.NewRecorder()
+			handler.GetDERCRL(w, req)
+
+			if w.Code >= 500 {
+				t.Errorf("GetDERCRL/%s: unexpected 5xx %d (body=%q)", tc.name, w.Code, w.Body.String())
+			}
+		})
+	}
+}

internal/api/handler/adversarial_query_test.go

@@ -0,0 +1,539 @@
+package handler
+
+// Adversarial query-parameter, request-body, and revocation-reason tests.
+//
+// These tests exercise the second boundary of the certificate handler:
+//
+//   * Numeric pagination parsing (page, per_page, page_size)
+//   * Sort direction and field whitelist
+//   * Time-range filters (expires_before, expires_after, created_after, updated_after)
+//   * Cursor pagination
+//   * Sparse-field projection (?fields=...)
+//   * Request-body JSON parsing (create/update) — null, malformed, deep nesting,
+//     unicode, oversized
+//   * Revocation reason abuse
+//
+// The handler silently ignores malformed pagination values (it falls back to
+// defaults) and ignores invalid RFC3339 time values. These tests lock in that
+// behaviour so a future "fail-closed" change has to be deliberate.
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/shankar0123/certctl/internal/domain"
+	"github.com/shankar0123/certctl/internal/repository"
+)
+
+// buildListRequest constructs a GET /api/v1/certificates request with the
+// given raw query string. We use raw query strings (not url.Values.Encode)
+// so adversarial inputs like "page=abc&page=-1" or "%00" pass through
+// unchanged.
+func buildListRequest(rawQuery string) *http.Request {
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates", nil)
+	req.URL.RawQuery = rawQuery
+	return req.WithContext(contextWithRequestID())
+}
+
+// TestListCertificates_PaginationAbuse verifies adversarial pagination values
+// never produce a 500 and the handler always falls back to sane defaults.
+func TestListCertificates_PaginationAbuse(t *testing.T) {
+	cases := []struct {
+		name     string
+		rawQuery string
+	}{
+		{"negative_page", "page=-1"},
+		{"zero_page", "page=0"},
+		{"non_numeric_page", "page=abc"},
+		{"huge_page", "page=99999999999"},
+		{"int_overflow_page", "page=9223372036854775808"}, // int64 max + 1
+		{"negative_per_page", "per_page=-1"},
+		{"zero_per_page", "per_page=0"},
+		{"per_page_cap_at_500", "per_page=500"},
+		{"per_page_above_cap", "per_page=501"},
+		{"per_page_absurd", "per_page=1000000"},
+		{"non_numeric_per_page", "per_page=xyz"},
+		{"mixed_numeric_per_page", "per_page=10abc"},
+		{"negative_page_size", "page_size=-1"},
+		{"page_size_above_cap", "page_size=501"},
+		{"float_page", "page=1.5"},
+		{"exponent_page", "page=1e10"},
+		{"hex_page", "page=0xff"},
+		{"unicode_digits_page", "page=\u0661\u0662\u0663"}, // Arabic-Indic digits
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("panicked on %q: %v", tc.rawQuery, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.ListCertificatesWithFilterFn = func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+				// Sanity: page/perPage on the filter must never be negative
+				// and perPage must never exceed 500 after parsing.
+				if filter.Page < 1 {
+					t.Errorf("filter.Page=%d (must be >=1)", filter.Page)
+				}
+				if filter.PerPage < 1 || filter.PerPage > 500 {
+					t.Errorf("filter.PerPage=%d (must be in [1,500])", filter.PerPage)
+				}
+				return []domain.ManagedCertificate{}, 0, nil
+			}
+
+			w := httptest.NewRecorder()
+			handler.ListCertificates(w, buildListRequest(tc.rawQuery))
+
+			assertSafeResponse(t, w, "ListCertificates/"+tc.name)
+			if w.Code != http.StatusOK {
+				t.Errorf("%s: expected 200, got %d (body=%q)", tc.name, w.Code, w.Body.String())
+			}
+		})
+	}
+}
+
+// TestListCertificates_SortAbuse verifies the sort field (which feeds into a
+// whitelist in the repository layer) handles adversarial input safely at the
+// handler boundary. The handler accepts the raw value and forwards it; the
+// repository is expected to whitelist it, but at THIS layer we just verify
+// we don't crash or leak.
+func TestListCertificates_SortAbuse(t *testing.T) {
+	cases := []struct {
+		name     string
+		rawQuery string
+	}{
+		{"sql_injection_sort", "sort=notAfter;DROP TABLE managed_certificates--"},
+		{"sql_injection_or", "sort=notAfter' OR '1'='1"},
+		{"path_traversal_sort", "sort=../../etc/passwd"},
+		{"null_byte_sort", "sort=notAfter%00"},
+		{"unicode_sort", "sort=notAfter\u2010desc"},
+		{"leading_dash_only", "sort=-"},
+		{"leading_dashes", "sort=---notAfter"},
+		{"empty_sort", "sort="},
+		{"very_long_sort", "sort=" + strings.Repeat("a", 5000)},
+		{"sort_desc_flag", "sort=notAfter&sort_desc=true"},
+		{"conflicting_sort_desc", "sort=-notAfter&sort_desc=false"},
+		{"unknown_field", "sort=gibberish"},
+		{"shell_metacharacters_sort", "sort=notAfter;rm -rf /"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("panicked on %q: %v", tc.rawQuery, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.ListCertificatesWithFilterFn = func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+				return []domain.ManagedCertificate{}, 0, nil
+			}
+
+			w := httptest.NewRecorder()
+			handler.ListCertificates(w, buildListRequest(tc.rawQuery))
+
+			assertSafeResponse(t, w, "ListCertificates/"+tc.name)
+		})
+	}
+}
+
+// TestListCertificates_FieldsAbuse verifies sparse field projection handles
+// adversarial field lists safely.
+func TestListCertificates_FieldsAbuse(t *testing.T) {
+	cases := []struct {
+		name     string
+		rawQuery string
+	}{
+		{"sql_injection_fields", "fields=id,name' OR 1=1--"},
+		{"path_traversal_fields", "fields=../../etc/passwd"},
+		{"empty_fields", "fields="},
+		{"single_comma", "fields=,"},
+		{"trailing_comma", "fields=id,name,"},
+		{"leading_comma", "fields=,id,name"},
+		{"whitespace_fields", "fields= id , name "},
+		{"duplicate_fields", "fields=id,id,id,id,id"},
+		{"unknown_fields", "fields=totally_not_a_field"},
+		{"many_fields", "fields=" + strings.Repeat("x,", 200) + "id"},
+		{"unicode_fields", "fields=id,n\u00e4me"},
+		{"null_byte_fields", "fields=id%00name"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("panicked on %q: %v", tc.rawQuery, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.ListCertificatesWithFilterFn = func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+				return []domain.ManagedCertificate{}, 0, nil
+			}
+
+			w := httptest.NewRecorder()
+			handler.ListCertificates(w, buildListRequest(tc.rawQuery))
+
+			assertSafeResponse(t, w, "ListCertificates/"+tc.name)
+		})
+	}
+}
+
+// TestListCertificates_TimeRangeAbuse verifies RFC3339 time-range filters
+// handle malformed input by silently falling back to no filter (current
+// behaviour).
+func TestListCertificates_TimeRangeAbuse(t *testing.T) {
+	cases := []struct {
+		name     string
+		rawQuery string
+	}{
+		{"invalid_expires_before", "expires_before=not-a-date"},
+		{"empty_expires_before", "expires_before="},
+		{"garbage_expires_before", "expires_before=%00%00"},
+		{"sql_injection_time", "expires_before=2026-01-01T00:00:00Z';DROP TABLE managed_certificates--"},
+		{"year_zero", "expires_before=0000-01-01T00:00:00Z"},
+		{"year_negative", "expires_before=-0001-01-01T00:00:00Z"},
+		{"year_huge", "expires_before=99999-12-31T23:59:59Z"},
+		{"invalid_month", "expires_before=2026-13-01T00:00:00Z"},
+		{"invalid_day", "expires_before=2026-02-30T00:00:00Z"},
+		{"valid_utc", "expires_before=2026-06-15T12:00:00Z"},
+		{"valid_with_offset", "expires_before=2026-06-15T12:00:00-07:00"},
+		{"unix_seconds_not_rfc3339", "expires_before=1767225600"},
+		{"all_four_filters", "expires_before=garbage&expires_after=garbage&created_after=garbage&updated_after=garbage"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("panicked on %q: %v", tc.rawQuery, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.ListCertificatesWithFilterFn = func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+				return []domain.ManagedCertificate{}, 0, nil
+			}
+
+			w := httptest.NewRecorder()
+			handler.ListCertificates(w, buildListRequest(tc.rawQuery))
+
+			assertSafeResponse(t, w, "ListCertificates/"+tc.name)
+			if w.Code != http.StatusOK {
+				t.Errorf("%s: expected 200, got %d", tc.name, w.Code)
+			}
+		})
+	}
+}
+
+// TestListCertificates_CursorAbuse exercises cursor-based pagination with
+// adversarial cursor tokens. The handler forwards the cursor to the
+// repository; we verify no 500 at the boundary and that the response type
+// switches correctly.
+func TestListCertificates_CursorAbuse(t *testing.T) {
+	cases := []struct {
+		name   string
+		cursor string
+	}{
+		{"empty_not_set", ""}, // special-cased: should return PagedResponse
+		{"garbage_cursor", "not-a-valid-cursor"},
+		{"base64_garbage", "dGhpcyBpcyBub3QgYSB2YWxpZCBjdXJzb3I="},
+		{"sql_injection_cursor", "2026-01-01T00:00:00Z:mc-001';DROP TABLE--"},
+		{"path_traversal_cursor", "../../etc/passwd"},
+		{"null_byte_cursor", "valid%00cursor"},
+		{"very_long_cursor", strings.Repeat("A", 8192)},
+		{"unicode_cursor", "2026-01-01T00:00:00Z:mc\u20100001"},
+		{"valid_looking_cursor", "2026-01-01T00:00:00.000000000Z:mc-001"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("panicked on %q: %v", tc.cursor, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.ListCertificatesWithFilterFn = func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+				return []domain.ManagedCertificate{}, 0, nil
+			}
+
+			rawQuery := "cursor=" + url.QueryEscape(tc.cursor) + "&page_size=50"
+			if tc.cursor == "" {
+				rawQuery = "page=1&per_page=50"
+			}
+			w := httptest.NewRecorder()
+			handler.ListCertificates(w, buildListRequest(rawQuery))
+
+			assertSafeResponse(t, w, "ListCertificates/"+tc.name)
+			if w.Code != http.StatusOK {
+				t.Errorf("%s: expected 200, got %d", tc.name, w.Code)
+			}
+		})
+	}
+}
+
+// TestListCertificates_FilterInjection verifies the basic string filters
+// (status, environment, owner_id, team_id, issuer_id, agent_id, profile_id)
+// are forwarded as-is without causing any handler-layer failures. These go
+// into parameterized SQL at the repo layer.
+func TestListCertificates_FilterInjection(t *testing.T) {
+	filters := []string{
+		"status", "environment", "owner_id", "team_id",
+		"issuer_id", "agent_id", "profile_id",
+	}
+	payloads := []string{
+		"' OR 1=1--",
+		"'; DROP TABLE managed_certificates;--",
+		"../../etc/passwd",
+		strings.Repeat("A", 5000),
+		"\u2010hyphen",
+		"%00null",
+	}
+
+	for _, f := range filters {
+		for _, p := range payloads {
+			name := f + "__" + p
+			if len(name) > 80 {
+				name = name[:80]
+			}
+			t.Run(name, func(t *testing.T) {
+				defer func() {
+					if r := recover(); r != nil {
+						t.Fatalf("panicked: %v", r)
+					}
+				}()
+
+				handler, mock := newCertHandlerWithMock()
+				mock.ListCertificatesWithFilterFn = func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+					return []domain.ManagedCertificate{}, 0, nil
+				}
+
+				rawQuery := f + "=" + url.QueryEscape(p)
+				w := httptest.NewRecorder()
+				handler.ListCertificates(w, buildListRequest(rawQuery))
+
+				assertSafeResponse(t, w, "ListCertificates/"+f)
+			})
+		}
+	}
+}
+
+// ---------- Request body abuse (Tier 1D) ----------
+
+// TestCreateCertificate_BodyAbuse sends adversarial JSON bodies to
+// POST /api/v1/certificates. Every case must respond with 400 (not 500,
+// not 200). This proves we reject malformed input before reaching the
+// service layer.
+func TestCreateCertificate_BodyAbuse(t *testing.T) {
+	cases := []struct {
+		name string
+		body string
+	}{
+		{"null_body", "null"},
+		{"empty_body", ""},
+		{"not_json", "not json at all"},
+		{"truncated_json", `{"common_name":"exa`},
+		{"unclosed_object", `{"common_name":"example.com"`},
+		{"array_not_object", `["example.com"]`},
+		{"number_not_object", `42`},
+		{"string_not_object", `"hello"`},
+		{"boolean_not_object", `true`},
+		{"duplicate_keys", `{"common_name":"evil.com","common_name":"example.com"}`},
+		{"unicode_bom", "\ufeff{\"common_name\":\"example.com\"}"},
+		{"deep_nesting", strings.Repeat("{\"x\":", 100) + "null" + strings.Repeat("}", 100)},
+		{"nested_array_bomb", `{"common_name":"x","sans":[[[[[[[[[[]]]]]]]]]]}`},
+		{"sql_injection_cn", `{"common_name":"'; DROP TABLE managed_certificates;--"}`},
+		{"empty_cn", `{"common_name":""}`},
+		{"null_cn", `{"common_name":null}`},
+		{"whitespace_cn", `{"common_name":"   "}`},
+		{"cn_too_long", fmt.Sprintf(`{"common_name":%q}`, strings.Repeat("a", 500))},
+		{"cn_path_traversal", `{"common_name":"../../etc/passwd"}`},
+		{"cn_null_byte", "{\"common_name\":\"example\\u0000.com\"}"},
+		{"cn_newline", "{\"common_name\":\"example\\n.com\"}"},
+		{"cn_only_missing_others", `{"common_name":"example.com"}`},
+		{"extra_unknown_fields", `{"common_name":"example.com","__proto__":{"polluted":true},"eval":"alert(1)"}`},
+		{"unicode_homoglyph_cn", "{\"common_name\":\"ex\u0430mple.com\"}"}, // Cyrillic а
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("panicked on %q: %v", tc.name, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			mock.CreateCertificateFn = func(_ context.Context, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+				// If we ever reach this, the handler accepted a malformed
+				// body. Return a sentinel that passes but flag it.
+				c := cert
+				c.ID = "mc-accepted"
+				return &c, nil
+			}
+
+			req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates", bytes.NewBufferString(tc.body))
+			req.Header.Set("Content-Type", "application/json")
+			req = req.WithContext(contextWithRequestID())
+			w := httptest.NewRecorder()
+			handler.CreateCertificate(w, req)
+
+			assertSafeResponse(t, w, "CreateCertificate/"+tc.name)
+			// Must NOT be 201 — all these bodies should be rejected.
+			if w.Code == http.StatusCreated {
+				t.Errorf("%s: handler accepted malformed body (201) body=%q", tc.name, w.Body.String())
+			}
+		})
+	}
+}
+
+// TestCreateCertificate_HugeBody sends a 2 MiB JSON body. The body-limit
+// middleware is not in this handler-unit test, so we just verify the handler
+// doesn't OOM/panic on a large but well-formed body.
+func TestCreateCertificate_HugeBody(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("panicked on huge body: %v", r)
+		}
+	}()
+
+	// 2 MiB of SANs — well-formed JSON, technically valid, just huge.
+	var sb strings.Builder
+	sb.WriteString(`{"common_name":"example.com","owner_id":"o","team_id":"t","issuer_id":"iss","name":"n","renewal_policy_id":"rp","sans":[`)
+	for i := 0; i < 20000; i++ {
+		if i > 0 {
+			sb.WriteByte(',')
+		}
+		fmt.Fprintf(&sb, `"host%d.example.com"`, i)
+	}
+	sb.WriteString(`]}`)
+
+	handler, mock := newCertHandlerWithMock()
+	mock.CreateCertificateFn = func(_ context.Context, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+		c := cert
+		c.ID = "mc-huge"
+		return &c, nil
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates", strings.NewReader(sb.String()))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+	handler.CreateCertificate(w, req)
+
+	assertSafeResponse(t, w, "CreateCertificate/huge_body")
+}
+
+// ---------- Revocation reason abuse (Tier 1E) ----------
+
+// TestRevokeCertificate_ReasonAbuse sends adversarial revocation reasons to
+// POST /api/v1/certificates/{id}/revoke. The handler forwards the reason
+// string to the service layer, which validates against RFC 5280. Errors
+// from the service containing "invalid revocation reason" must map to 400,
+// never 500.
+func TestRevokeCertificate_ReasonAbuse(t *testing.T) {
+	cases := []struct {
+		name string
+		body string
+	}{
+		{"empty_reason", `{"reason":""}`},
+		{"null_reason", `{"reason":null}`},
+		{"nonexistent_reason", `{"reason":"totally made up"}`},
+		{"case_variant", `{"reason":"KEYCOMPROMISE"}`},
+		{"with_spaces", `{"reason":"key compromise"}`},
+		{"with_dashes", `{"reason":"key-compromise"}`},
+		{"mixed_case", `{"reason":"KeyCompromise"}`},
+		{"lowercase_valid", `{"reason":"keycompromise"}`},
+		{"unicode_homoglyph", "{\"reason\":\"keyCompr\u043emise\"}"},
+		{"sql_injection", `{"reason":"keyCompromise';DROP TABLE revocations--"}`},
+		{"very_long", fmt.Sprintf(`{"reason":%q}`, strings.Repeat("a", 10000))},
+		{"integer_reason", `{"reason":1}`},
+		{"array_reason", `{"reason":["keyCompromise"]}`},
+		{"object_reason", `{"reason":{"code":1}}`},
+		{"extra_fields", `{"reason":"keyCompromise","admin":true,"bypass":true}`},
+		{"no_body", ``},
+		{"malformed_json", `{"reason":`},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("panicked on %q: %v", tc.name, r)
+				}
+			}()
+
+			handler, mock := newCertHandlerWithMock()
+			// The mock always returns "invalid revocation reason" so we
+			// verify the handler's errMsg→status mapping turns it into a 400.
+			mock.RevokeCertificateFn = func(_ context.Context, id string, reason string, _ string) error {
+				// The service uses domain.IsValidRevocationReason. If we got
+				// through to here with something bogus, simulate a real
+				// service error.
+				return fmt.Errorf("invalid revocation reason: %q", reason)
+			}
+
+			req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-001/revoke", bytes.NewBufferString(tc.body))
+			req.URL.Path = "/api/v1/certificates/mc-001/revoke"
+			req.Header.Set("Content-Type", "application/json")
+			req = req.WithContext(contextWithRequestID())
+			w := httptest.NewRecorder()
+			handler.RevokeCertificate(w, req)
+
+			assertSafeResponse(t, w, "RevokeCertificate/"+tc.name)
+		})
+	}
+}
+
+// TestRevokeCertificate_AlreadyRevoked locks in the specific error->status
+// mapping for "already revoked". The handler uses substring matching on the
+// service error message, which is fragile — this test catches regressions.
+func TestRevokeCertificate_AlreadyRevoked(t *testing.T) {
+	handler, mock := newCertHandlerWithMock()
+	mock.RevokeCertificateFn = func(_ context.Context, id string, reason string, _ string) error {
+		return fmt.Errorf("cannot revoke: certificate is already revoked")
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-001/revoke", strings.NewReader(`{"reason":"keyCompromise"}`))
+	req.URL.Path = "/api/v1/certificates/mc-001/revoke"
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+	handler.RevokeCertificate(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for already-revoked, got %d (body=%q)", w.Code, w.Body.String())
+	}
+	assertSafeResponse(t, w, "RevokeCertificate/already_revoked")
+}
+
+// TestRevokeCertificate_NotFound verifies 404 mapping.
+func TestRevokeCertificate_NotFound(t *testing.T) {
+	handler, mock := newCertHandlerWithMock()
+	mock.RevokeCertificateFn = func(_ context.Context, id string, reason string, _ string) error {
+		return fmt.Errorf("certificate not found")
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-missing/revoke", strings.NewReader(`{"reason":"keyCompromise"}`))
+	req.URL.Path = "/api/v1/certificates/mc-missing/revoke"
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+	handler.RevokeCertificate(w, req)
+
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404 for not-found, got %d (body=%q)", w.Code, w.Body.String())
+	}
+	assertSafeResponse(t, w, "RevokeCertificate/not_found")
+}

internal/api/handler/agents.go

@@ -3,6 +3,7 @@ package handler
 import (
 	"context"
 	"encoding/json"
+	"log/slog"
 	"net/http"
 	"strconv"
 	"strings"
@@ -134,6 +135,11 @@ func (h AgentHandler) RegisterAgent(w http.ResponseWriter, r *http.Request) {
 
 	created, err := h.svc.RegisterAgent(r.Context(), agent)
 	if err != nil {
+		errMsg := err.Error()
+		if strings.Contains(errMsg, "unique") || strings.Contains(errMsg, "duplicate") || strings.Contains(errMsg, "already exists") {
+			ErrorWithRequestID(w, http.StatusConflict, "Agent with this name already exists", requestID)
+			return
+		}
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to register agent", requestID)
 		return
 	}
@@ -184,6 +190,11 @@ func (h AgentHandler) Heartbeat(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := h.svc.Heartbeat(r.Context(), agentID, metadata); err != nil {
+		if strings.Contains(err.Error(), "not found") {
+			ErrorWithRequestID(w, http.StatusNotFound, "Agent not found", requestID)
+			return
+		}
+		slog.Error("Heartbeat failed", "agent_id", agentID, "error", err.Error())
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to record heartbeat", requestID)
 		return
 	}
@@ -241,6 +252,7 @@ func (h AgentHandler) AgentCSRSubmit(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err != nil {
+		slog.Error("CSR submission failed", "agent_id", agentID, "certificate_id", req.CertificateID, "error", err.Error())
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to submit CSR", requestID)
 		return
 	}
@@ -263,9 +275,10 @@ func (h AgentHandler) AgentCertificatePickup(w http.ResponseWriter, r *http.Requ
 	requestID := middleware.GetRequestID(r.Context())
 
 	// Extract agent ID and certificate ID from path /api/v1/agents/{id}/certificates/{cert_id}
+	// After TrimPrefix, path is "{id}/certificates/{cert_id}" → split gives [id, "certificates", cert_id]
 	path := strings.TrimPrefix(r.URL.Path, "/api/v1/agents/")
 	parts := strings.Split(path, "/")
-	if len(parts) < 4 || parts[0] == "" || parts[2] == "" {
+	if len(parts) < 3 || parts[0] == "" || parts[2] == "" {
 		ErrorWithRequestID(w, http.StatusBadRequest, "Agent ID and Certificate ID are required", requestID)
 		return
 	}

internal/api/handler/audit.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"context"
 	"net/http"
 	"strconv"
 	"strings"
@@ -11,8 +12,8 @@ import (
 
 // AuditService defines the service interface for audit event operations.
 type AuditService interface {
-	ListAuditEvents(page, perPage int) ([]domain.AuditEvent, int64, error)
-	GetAuditEvent(id string) (*domain.AuditEvent, error)
+	ListAuditEvents(ctx context.Context, page, perPage int) ([]domain.AuditEvent, int64, error)
+	GetAuditEvent(ctx context.Context, id string) (*domain.AuditEvent, error)
 }
 
 // AuditHandler handles HTTP requests for audit event operations.
@@ -49,7 +50,7 @@ func (h AuditHandler) ListAuditEvents(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	events, total, err := h.svc.ListAuditEvents(page, perPage)
+	events, total, err := h.svc.ListAuditEvents(r.Context(), page, perPage)
 	if err != nil {
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list audit events", requestID)
 		return
@@ -83,7 +84,7 @@ func (h AuditHandler) GetAuditEvent(w http.ResponseWriter, r *http.Request) {
 	}
 	id = parts[0]
 
-	event, err := h.svc.GetAuditEvent(id)
+	event, err := h.svc.GetAuditEvent(r.Context(), id)
 	if err != nil {
 		ErrorWithRequestID(w, http.StatusNotFound, "Audit event not found", requestID)
 		return

internal/api/handler/audit_handler_test.go

@@ -0,0 +1,419 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/shankar0123/certctl/internal/domain"
+	"github.com/shankar0123/certctl/internal/api/middleware"
+)
+
+// mockAuditService implements AuditService for testing.
+type mockAuditService struct {
+	listFunc  func(page, perPage int) ([]domain.AuditEvent, int64, error)
+	getFunc   func(id string) (*domain.AuditEvent, error)
+}
+
+func (m *mockAuditService) ListAuditEvents(_ context.Context, page, perPage int) ([]domain.AuditEvent, int64, error) {
+	if m.listFunc != nil {
+		return m.listFunc(page, perPage)
+	}
+	return nil, 0, nil
+}
+
+func (m *mockAuditService) GetAuditEvent(_ context.Context, id string) (*domain.AuditEvent, error) {
+	if m.getFunc != nil {
+		return m.getFunc(id)
+	}
+	return nil, nil
+}
+
+func TestListAuditEvents_Success(t *testing.T) {
+	events := []domain.AuditEvent{
+		{
+			ID:           "ev-1",
+			Action:       "certificate_issued",
+			Actor:        "user@example.com",
+			ActorType:    domain.ActorTypeUser,
+			ResourceID:   "mc-api-prod",
+			ResourceType: "Certificate",
+			Timestamp:    time.Now(),
+		},
+		{
+			ID:           "ev-2",
+			Action:       "certificate_renewed",
+			Actor:        "user@example.com",
+			ActorType:    domain.ActorTypeUser,
+			ResourceID:   "mc-api-prod",
+			ResourceType: "Certificate",
+			Timestamp:    time.Now(),
+		},
+	}
+
+	mockSvc := &mockAuditService{
+		listFunc: func(page, perPage int) ([]domain.AuditEvent, int64, error) {
+			if page != 1 || perPage != 50 {
+				t.Errorf("ListAuditEvents called with page=%d, perPage=%d, expected 1, 50", page, perPage)
+			}
+			return events, 2, nil
+		},
+	}
+
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodGet, "/api/v1/audit", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	// Add request ID to context
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.ListAuditEvents(w, req)
+
+	if status := w.Code; status != http.StatusOK {
+		t.Errorf("ListAuditEvents returned status %d, want %d", status, http.StatusOK)
+	}
+
+	var result PagedResponse
+	if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+
+	if result.Total != 2 {
+		t.Errorf("Total = %d, want 2", result.Total)
+	}
+
+	if result.Page != 1 {
+		t.Errorf("Page = %d, want 1", result.Page)
+	}
+
+	if result.PerPage != 50 {
+		t.Errorf("PerPage = %d, want 50", result.PerPage)
+	}
+
+	// Check data is present
+	if result.Data == nil {
+		t.Error("Data is nil, want events slice")
+	}
+}
+
+func TestListAuditEvents_WithPagination(t *testing.T) {
+	events := []domain.AuditEvent{
+		{
+			ID:           "ev-5",
+			Action:       "certificate_issued",
+			Actor:        "user@example.com",
+			ActorType:    domain.ActorTypeUser,
+			ResourceID:   "mc-api-prod",
+			ResourceType: "Certificate",
+			Timestamp:    time.Now(),
+		},
+	}
+
+	mockSvc := &mockAuditService{
+		listFunc: func(page, perPage int) ([]domain.AuditEvent, int64, error) {
+			if page != 2 || perPage != 25 {
+				t.Errorf("ListAuditEvents called with page=%d, perPage=%d, expected 2, 25", page, perPage)
+			}
+			return events, 100, nil
+		},
+	}
+
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodGet, "/api/v1/audit?page=2&per_page=25", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.ListAuditEvents(w, req)
+
+	if status := w.Code; status != http.StatusOK {
+		t.Errorf("ListAuditEvents returned status %d, want %d", status, http.StatusOK)
+	}
+
+	var result PagedResponse
+	if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+
+	if result.Page != 2 {
+		t.Errorf("Page = %d, want 2", result.Page)
+	}
+
+	if result.PerPage != 25 {
+		t.Errorf("PerPage = %d, want 25", result.PerPage)
+	}
+}
+
+func TestListAuditEvents_PerPageMaxLimit(t *testing.T) {
+	mockSvc := &mockAuditService{
+		listFunc: func(page, perPage int) ([]domain.AuditEvent, int64, error) {
+			// Should be capped at 500
+			if perPage > 500 {
+				t.Errorf("perPage = %d, expected <= 500", perPage)
+			}
+			return []domain.AuditEvent{}, 0, nil
+		},
+	}
+
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodGet, "/api/v1/audit?per_page=1000", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.ListAuditEvents(w, req)
+
+	if status := w.Code; status != http.StatusOK {
+		t.Errorf("ListAuditEvents returned status %d, want %d", status, http.StatusOK)
+	}
+
+	var result PagedResponse
+	if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+
+	if result.PerPage > 500 {
+		t.Errorf("PerPage = %d, want <= 500", result.PerPage)
+	}
+}
+
+func TestListAuditEvents_EmptyResult(t *testing.T) {
+	mockSvc := &mockAuditService{
+		listFunc: func(page, perPage int) ([]domain.AuditEvent, int64, error) {
+			return []domain.AuditEvent{}, 0, nil
+		},
+	}
+
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodGet, "/api/v1/audit", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.ListAuditEvents(w, req)
+
+	if status := w.Code; status != http.StatusOK {
+		t.Errorf("ListAuditEvents returned status %d, want %d", status, http.StatusOK)
+	}
+
+	var result PagedResponse
+	if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+
+	if result.Total != 0 {
+		t.Errorf("Total = %d, want 0", result.Total)
+	}
+}
+
+func TestListAuditEvents_ServiceError(t *testing.T) {
+	mockSvc := &mockAuditService{
+		listFunc: func(page, perPage int) ([]domain.AuditEvent, int64, error) {
+			return nil, 0, errors.New("database error")
+		},
+	}
+
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodGet, "/api/v1/audit", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.ListAuditEvents(w, req)
+
+	if status := w.Code; status != http.StatusInternalServerError {
+		t.Errorf("ListAuditEvents returned status %d, want %d", status, http.StatusInternalServerError)
+	}
+
+	var errResp ErrorResponse
+	if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil {
+		t.Fatalf("failed to decode error response: %v", err)
+	}
+
+	if errResp.Message != "Failed to list audit events" {
+		t.Errorf("Message = %q, want 'Failed to list audit events'", errResp.Message)
+	}
+}
+
+func TestListAuditEvents_MethodNotAllowed(t *testing.T) {
+	mockSvc := &mockAuditService{}
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodPost, "/api/v1/audit", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.ListAuditEvents(w, req)
+
+	if status := w.Code; status != http.StatusMethodNotAllowed {
+		t.Errorf("ListAuditEvents returned status %d, want %d", status, http.StatusMethodNotAllowed)
+	}
+}
+
+func TestGetAuditEvent_Success(t *testing.T) {
+	event := &domain.AuditEvent{
+		ID:           "ev-123",
+		Action:       "certificate_issued",
+		Actor:        "user@example.com",
+		ActorType:    domain.ActorTypeUser,
+		ResourceID:   "mc-api-prod",
+		ResourceType: "Certificate",
+		Timestamp:    time.Now(),
+	}
+
+	mockSvc := &mockAuditService{
+		getFunc: func(id string) (*domain.AuditEvent, error) {
+			if id != "ev-123" {
+				t.Errorf("GetAuditEvent called with id=%q, expected ev-123", id)
+			}
+			return event, nil
+		},
+	}
+
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodGet, "/api/v1/audit/ev-123", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.GetAuditEvent(w, req)
+
+	if status := w.Code; status != http.StatusOK {
+		t.Errorf("GetAuditEvent returned status %d, want %d", status, http.StatusOK)
+	}
+
+	var result domain.AuditEvent
+	if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+
+	if result.ID != "ev-123" {
+		t.Errorf("ID = %q, want ev-123", result.ID)
+	}
+
+	if result.Action != "certificate_issued" {
+		t.Errorf("Action = %q, want certificate_issued", result.Action)
+	}
+}
+
+func TestGetAuditEvent_NotFound(t *testing.T) {
+	mockSvc := &mockAuditService{
+		getFunc: func(id string) (*domain.AuditEvent, error) {
+			return nil, errors.New("not found")
+		},
+	}
+
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodGet, "/api/v1/audit/nonexistent", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.GetAuditEvent(w, req)
+
+	if status := w.Code; status != http.StatusNotFound {
+		t.Errorf("GetAuditEvent returned status %d, want %d", status, http.StatusNotFound)
+	}
+
+	var errResp ErrorResponse
+	if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil {
+		t.Fatalf("failed to decode error response: %v", err)
+	}
+
+	if errResp.Message != "Audit event not found" {
+		t.Errorf("Message = %q, want 'Audit event not found'", errResp.Message)
+	}
+}
+
+func TestGetAuditEvent_MethodNotAllowed(t *testing.T) {
+	mockSvc := &mockAuditService{}
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodDelete, "/api/v1/audit/ev-123", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.GetAuditEvent(w, req)
+
+	if status := w.Code; status != http.StatusMethodNotAllowed {
+		t.Errorf("GetAuditEvent returned status %d, want %d", status, http.StatusMethodNotAllowed)
+	}
+}
+
+func TestGetAuditEvent_EmptyID(t *testing.T) {
+	mockSvc := &mockAuditService{}
+	handler := NewAuditHandler(mockSvc)
+
+	req, err := http.NewRequest(http.MethodGet, "/api/v1/audit/", nil)
+	if err != nil {
+		t.Fatalf("NewRequest failed: %v", err)
+	}
+
+	ctx := context.WithValue(req.Context(), middleware.RequestIDKey{}, "test-req-id")
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	handler.GetAuditEvent(w, req)
+
+	if status := w.Code; status != http.StatusBadRequest {
+		t.Errorf("GetAuditEvent returned status %d, want %d", status, http.StatusBadRequest)
+	}
+
+	var errResp ErrorResponse
+	if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil {
+		t.Fatalf("failed to decode error response: %v", err)
+	}
+
+	if errResp.Message != "Audit event ID is required" {
+		t.Errorf("Message = %q, want 'Audit event ID is required'", errResp.Message)
+	}
+}

internal/api/handler/bulk_revocation.go

@@ -0,0 +1,106 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// BulkRevocationService defines the service interface for bulk certificate revocation.
+type BulkRevocationService interface {
+	BulkRevoke(ctx context.Context, criteria domain.BulkRevocationCriteria, reason string, actor string) (*domain.BulkRevocationResult, error)
+}
+
+// BulkRevocationHandler handles HTTP requests for bulk revocation operations.
+type BulkRevocationHandler struct {
+	svc BulkRevocationService
+}
+
+// NewBulkRevocationHandler creates a new BulkRevocationHandler.
+func NewBulkRevocationHandler(svc BulkRevocationService) BulkRevocationHandler {
+	return BulkRevocationHandler{svc: svc}
+}
+
+// bulkRevokeRequest represents the JSON request body for bulk revocation.
+type bulkRevokeRequest struct {
+	Reason         string   `json:"reason"`
+	ProfileID      string   `json:"profile_id,omitempty"`
+	OwnerID        string   `json:"owner_id,omitempty"`
+	AgentID        string   `json:"agent_id,omitempty"`
+	IssuerID       string   `json:"issuer_id,omitempty"`
+	TeamID         string   `json:"team_id,omitempty"`
+	CertificateIDs []string `json:"certificate_ids,omitempty"`
+}
+
+// BulkRevoke handles bulk certificate revocation.
+// POST /api/v1/certificates/bulk-revoke
+//
+// M-003: admin-only. Bulk revocation is a fleet-scale destructive operation —
+// a non-admin caller must not be able to invalidate certificates across
+// profiles/owners/agents. The gate is enforced here (before body parsing) so a
+// non-admin never sees its request criteria evaluated.
+func (h BulkRevocationHandler) BulkRevoke(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// M-003: admin-only gate. Non-admin callers are rejected before any
+	// criteria/body processing to avoid leaking validation behavior to
+	// unauthorized actors.
+	if !middleware.IsAdmin(r.Context()) {
+		ErrorWithRequestID(w, http.StatusForbidden,
+			"Bulk revocation requires admin privileges",
+			requestID)
+		return
+	}
+
+	var req bulkRevokeRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid request body", requestID)
+		return
+	}
+
+	// Validate reason is present
+	if req.Reason == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Revocation reason is required", requestID)
+		return
+	}
+
+	// Validate reason is a valid RFC 5280 code
+	if !domain.IsValidRevocationReason(req.Reason) {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Invalid revocation reason: "+req.Reason, requestID)
+		return
+	}
+
+	criteria := domain.BulkRevocationCriteria{
+		ProfileID:      req.ProfileID,
+		OwnerID:        req.OwnerID,
+		AgentID:        req.AgentID,
+		IssuerID:       req.IssuerID,
+		TeamID:         req.TeamID,
+		CertificateIDs: req.CertificateIDs,
+	}
+
+	// Safety guard: at least one criterion required
+	if criteria.IsEmpty() {
+		ErrorWithRequestID(w, http.StatusBadRequest, "At least one filter criterion is required (profile_id, owner_id, agent_id, issuer_id, team_id, or certificate_ids)", requestID)
+		return
+	}
+
+	// Extract actor from auth context (M-002: named-key identity → audit trail)
+	actor := resolveActor(r.Context())
+
+	result, err := h.svc.BulkRevoke(r.Context(), criteria, req.Reason, actor)
+	if err != nil {
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Bulk revocation failed: "+err.Error(), requestID)
+		return
+	}
+
+	JSON(w, http.StatusOK, result)
+}

internal/api/handler/bulk_revocation_handler_test.go

@@ -0,0 +1,289 @@
+package handler
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// mockBulkRevocationService is a test implementation of BulkRevocationService
+type mockBulkRevocationService struct {
+	BulkRevokeFn func(ctx context.Context, criteria domain.BulkRevocationCriteria, reason string, actor string) (*domain.BulkRevocationResult, error)
+}
+
+func (m *mockBulkRevocationService) BulkRevoke(ctx context.Context, criteria domain.BulkRevocationCriteria, reason string, actor string) (*domain.BulkRevocationResult, error) {
+	if m.BulkRevokeFn != nil {
+		return m.BulkRevokeFn(ctx, criteria, reason, actor)
+	}
+	return &domain.BulkRevocationResult{}, nil
+}
+
+// adminContext returns a context carrying the admin flag, mimicking what the
+// auth middleware sets for named-key callers whose entry is admin-tagged.
+// M-003: bulk revocation handler requires admin context to reach the service.
+func adminContext() context.Context {
+	ctx := context.WithValue(context.Background(), middleware.RequestIDKey{}, "test-request-id-bulk")
+	ctx = context.WithValue(ctx, middleware.AdminKey{}, true)
+	return ctx
+}
+
+func TestBulkRevoke_Success_WithIDs(t *testing.T) {
+	svc := &mockBulkRevocationService{
+		BulkRevokeFn: func(ctx context.Context, criteria domain.BulkRevocationCriteria, reason string, actor string) (*domain.BulkRevocationResult, error) {
+			if len(criteria.CertificateIDs) != 2 {
+				t.Errorf("expected 2 IDs, got %d", len(criteria.CertificateIDs))
+			}
+			if reason != "keyCompromise" {
+				t.Errorf("expected reason keyCompromise, got %s", reason)
+			}
+			return &domain.BulkRevocationResult{
+				TotalMatched: 2,
+				TotalRevoked: 2,
+			}, nil
+		},
+	}
+	h := NewBulkRevocationHandler(svc)
+
+	body := `{"reason":"keyCompromise","certificate_ids":["mc-1","mc-2"]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(adminContext())
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d", w.Code)
+	}
+
+	var result domain.BulkRevocationResult
+	if err := json.NewDecoder(w.Body).Decode(&result); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if result.TotalMatched != 2 {
+		t.Errorf("expected TotalMatched=2, got %d", result.TotalMatched)
+	}
+	if result.TotalRevoked != 2 {
+		t.Errorf("expected TotalRevoked=2, got %d", result.TotalRevoked)
+	}
+}
+
+func TestBulkRevoke_Success_WithProfile(t *testing.T) {
+	svc := &mockBulkRevocationService{
+		BulkRevokeFn: func(ctx context.Context, criteria domain.BulkRevocationCriteria, reason string, actor string) (*domain.BulkRevocationResult, error) {
+			if criteria.ProfileID != "prof-tls" {
+				t.Errorf("expected profile prof-tls, got %s", criteria.ProfileID)
+			}
+			return &domain.BulkRevocationResult{
+				TotalMatched: 5,
+				TotalRevoked: 4,
+				TotalSkipped: 1,
+			}, nil
+		},
+	}
+	h := NewBulkRevocationHandler(svc)
+
+	body := `{"reason":"keyCompromise","profile_id":"prof-tls"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(adminContext())
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d", w.Code)
+	}
+}
+
+func TestBulkRevoke_MissingReason_400(t *testing.T) {
+	h := NewBulkRevocationHandler(&mockBulkRevocationService{})
+
+	body := `{"certificate_ids":["mc-1"]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(adminContext())
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d", w.Code)
+	}
+}
+
+func TestBulkRevoke_EmptyCriteria_400(t *testing.T) {
+	h := NewBulkRevocationHandler(&mockBulkRevocationService{})
+
+	body := `{"reason":"keyCompromise"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(adminContext())
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d", w.Code)
+	}
+}
+
+func TestBulkRevoke_InvalidReason_400(t *testing.T) {
+	h := NewBulkRevocationHandler(&mockBulkRevocationService{})
+
+	body := `{"reason":"totallyBogus","certificate_ids":["mc-1"]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(adminContext())
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d", w.Code)
+	}
+}
+
+func TestBulkRevoke_MethodNotAllowed_405(t *testing.T) {
+	h := NewBulkRevocationHandler(&mockBulkRevocationService{})
+
+	// Method check fires before the admin gate, so 405 must hold even for a
+	// non-admin caller — asserting this keeps the ordering explicit.
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates/bulk-revoke", nil)
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Errorf("expected 405, got %d", w.Code)
+	}
+}
+
+func TestBulkRevoke_ServiceError_500(t *testing.T) {
+	svc := &mockBulkRevocationService{
+		BulkRevokeFn: func(ctx context.Context, criteria domain.BulkRevocationCriteria, reason string, actor string) (*domain.BulkRevocationResult, error) {
+			return nil, fmt.Errorf("database connection failed")
+		},
+	}
+	h := NewBulkRevocationHandler(svc)
+
+	body := `{"reason":"keyCompromise","certificate_ids":["mc-1"]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(adminContext())
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("expected 500, got %d", w.Code)
+	}
+}
+
+// --- M-003: admin-only gate on bulk revocation ---
+
+// TestBulkRevoke_NonAdmin_Returns403 is the central authorization regression
+// for M-003. A caller without an admin-tagged context must be rejected with
+// HTTP 403, regardless of how well-formed its body is, and the service layer
+// must never see the request.
+func TestBulkRevoke_NonAdmin_Returns403(t *testing.T) {
+	var serviceCalled bool
+	svc := &mockBulkRevocationService{
+		BulkRevokeFn: func(ctx context.Context, criteria domain.BulkRevocationCriteria, reason string, actor string) (*domain.BulkRevocationResult, error) {
+			serviceCalled = true
+			return &domain.BulkRevocationResult{}, nil
+		},
+	}
+	h := NewBulkRevocationHandler(svc)
+
+	// Well-formed body + well-formed reason + filter — the only thing
+	// missing is an admin-tagged context. The gate must still fire.
+	body := `{"reason":"keyCompromise","certificate_ids":["mc-1","mc-2"]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(contextWithRequestID()) // request id only, no admin flag
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("expected status 403, got %d (body=%q)", w.Code, w.Body.String())
+	}
+
+	var resp map[string]any
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	msg, _ := resp["message"].(string)
+	if !strings.Contains(strings.ToLower(msg), "admin") {
+		t.Errorf("expected message to mention admin requirement, got %q", msg)
+	}
+	if serviceCalled {
+		t.Errorf("service was invoked despite non-admin caller — gate failed open")
+	}
+}
+
+// TestBulkRevoke_AdminExplicitFalse_Returns403 pins the specific case where the
+// AdminKey exists but is set to false — e.g., a non-admin named-key caller.
+// Without this we could regress to "key missing == deny, key present == allow"
+// which would silently grant a false flag.
+func TestBulkRevoke_AdminExplicitFalse_Returns403(t *testing.T) {
+	h := NewBulkRevocationHandler(&mockBulkRevocationService{})
+
+	body := `{"reason":"keyCompromise","certificate_ids":["mc-1"]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	ctx := context.WithValue(context.Background(), middleware.RequestIDKey{}, "test-request-id")
+	ctx = context.WithValue(ctx, middleware.AdminKey{}, false)
+	req = req.WithContext(ctx)
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("expected status 403 for admin=false, got %d", w.Code)
+	}
+}
+
+// TestBulkRevoke_AdminPermitted_ForwardsActor confirms the happy path:
+// an admin-tagged context reaches the service and the actor (from the auth
+// UserKey) is propagated through to BulkRevoke. This keeps the admin gate and
+// the M-002 actor-propagation wired together in a single regression.
+func TestBulkRevoke_AdminPermitted_ForwardsActor(t *testing.T) {
+	var capturedActor string
+	svc := &mockBulkRevocationService{
+		BulkRevokeFn: func(ctx context.Context, criteria domain.BulkRevocationCriteria, reason string, actor string) (*domain.BulkRevocationResult, error) {
+			capturedActor = actor
+			return &domain.BulkRevocationResult{TotalMatched: 1, TotalRevoked: 1}, nil
+		},
+	}
+	h := NewBulkRevocationHandler(svc)
+
+	body := `{"reason":"keyCompromise","certificate_ids":["mc-1"]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/bulk-revoke", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	ctx := context.WithValue(context.Background(), middleware.RequestIDKey{}, "test-request-id")
+	ctx = context.WithValue(ctx, middleware.AdminKey{}, true)
+	ctx = context.WithValue(ctx, middleware.UserKey{}, "ops-admin")
+	req = req.WithContext(ctx)
+	w := httptest.NewRecorder()
+
+	h.BulkRevoke(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200 for admin caller, got %d (body=%q)", w.Code, w.Body.String())
+	}
+	if capturedActor != "ops-admin" {
+		t.Errorf("expected actor ops-admin, got %q", capturedActor)
+	}
+}

internal/api/handler/certificate_handler_test.go

@@ -17,116 +17,116 @@ import (
 
 // MockCertificateService is a mock implementation of CertificateService interface.
 type MockCertificateService struct {
-	ListCertificatesFn           func(status, environment, ownerID, teamID, issuerID string, page, perPage int) ([]domain.ManagedCertificate, int64, error)
-	ListCertificatesWithFilterFn func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error)
-	GetCertificateFn             func(id string) (*domain.ManagedCertificate, error)
-	CreateCertificateFn          func(cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
-	UpdateCertificateFn          func(id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
-	ArchiveCertificateFn         func(id string) error
-	GetCertificateVersionsFn     func(certID string, page, perPage int) ([]domain.CertificateVersion, int64, error)
-	TriggerRenewalFn             func(certID string) error
-	TriggerDeploymentFn          func(certID string, targetID string) error
-	RevokeCertificateFn          func(certID string, reason string) error
-	GetRevokedCertificatesFn     func() ([]*domain.CertificateRevocation, error)
-	GenerateDERCRLFn             func(issuerID string) ([]byte, error)
-	GetOCSPResponseFn            func(issuerID string, serialHex string) ([]byte, error)
-	GetCertificateDeploymentsFn  func(certID string) ([]domain.DeploymentTarget, error)
+	ListCertificatesFn           func(ctx context.Context, status, environment, ownerID, teamID, issuerID string, page, perPage int) ([]domain.ManagedCertificate, int64, error)
+	ListCertificatesWithFilterFn func(ctx context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error)
+	GetCertificateFn             func(ctx context.Context, id string) (*domain.ManagedCertificate, error)
+	CreateCertificateFn          func(ctx context.Context, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
+	UpdateCertificateFn          func(ctx context.Context, id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
+	ArchiveCertificateFn         func(ctx context.Context, id string) error
+	GetCertificateVersionsFn     func(ctx context.Context, certID string, page, perPage int) ([]domain.CertificateVersion, int64, error)
+	TriggerRenewalFn             func(ctx context.Context, certID string, actor string) error
+	TriggerDeploymentFn          func(ctx context.Context, certID string, targetID string, actor string) error
+	RevokeCertificateFn          func(ctx context.Context, certID string, reason string, actor string) error
+	GetRevokedCertificatesFn     func(ctx context.Context) ([]*domain.CertificateRevocation, error)
+	GenerateDERCRLFn             func(ctx context.Context, issuerID string) ([]byte, error)
+	GetOCSPResponseFn            func(ctx context.Context, issuerID string, serialHex string) ([]byte, error)
+	GetCertificateDeploymentsFn  func(ctx context.Context, certID string) ([]domain.DeploymentTarget, error)
 }
 
-func (m *MockCertificateService) ListCertificates(status, environment, ownerID, teamID, issuerID string, page, perPage int) ([]domain.ManagedCertificate, int64, error) {
+func (m *MockCertificateService) ListCertificates(ctx context.Context, status, environment, ownerID, teamID, issuerID string, page, perPage int) ([]domain.ManagedCertificate, int64, error) {
 	if m.ListCertificatesFn != nil {
-		return m.ListCertificatesFn(status, environment, ownerID, teamID, issuerID, page, perPage)
+		return m.ListCertificatesFn(ctx, status, environment, ownerID, teamID, issuerID, page, perPage)
 	}
 	return nil, 0, nil
 }
 
-func (m *MockCertificateService) GetCertificate(id string) (*domain.ManagedCertificate, error) {
+func (m *MockCertificateService) GetCertificate(ctx context.Context, id string) (*domain.ManagedCertificate, error) {
 	if m.GetCertificateFn != nil {
-		return m.GetCertificateFn(id)
+		return m.GetCertificateFn(ctx, id)
 	}
 	return nil, nil
 }
 
-func (m *MockCertificateService) CreateCertificate(cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+func (m *MockCertificateService) CreateCertificate(ctx context.Context, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
 	if m.CreateCertificateFn != nil {
-		return m.CreateCertificateFn(cert)
+		return m.CreateCertificateFn(ctx, cert)
 	}
 	return nil, nil
 }
 
-func (m *MockCertificateService) UpdateCertificate(id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+func (m *MockCertificateService) UpdateCertificate(ctx context.Context, id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
 	if m.UpdateCertificateFn != nil {
-		return m.UpdateCertificateFn(id, cert)
+		return m.UpdateCertificateFn(ctx, id, cert)
 	}
 	return nil, nil
 }
 
-func (m *MockCertificateService) ArchiveCertificate(id string) error {
+func (m *MockCertificateService) ArchiveCertificate(ctx context.Context, id string) error {
 	if m.ArchiveCertificateFn != nil {
-		return m.ArchiveCertificateFn(id)
+		return m.ArchiveCertificateFn(ctx, id)
 	}
 	return nil
 }
 
-func (m *MockCertificateService) GetCertificateVersions(certID string, page, perPage int) ([]domain.CertificateVersion, int64, error) {
+func (m *MockCertificateService) GetCertificateVersions(ctx context.Context, certID string, page, perPage int) ([]domain.CertificateVersion, int64, error) {
 	if m.GetCertificateVersionsFn != nil {
-		return m.GetCertificateVersionsFn(certID, page, perPage)
+		return m.GetCertificateVersionsFn(ctx, certID, page, perPage)
 	}
 	return nil, 0, nil
 }
 
-func (m *MockCertificateService) TriggerRenewal(certID string) error {
+func (m *MockCertificateService) TriggerRenewal(ctx context.Context, certID string, actor string) error {
 	if m.TriggerRenewalFn != nil {
-		return m.TriggerRenewalFn(certID)
+		return m.TriggerRenewalFn(ctx, certID, actor)
 	}
 	return nil
 }
 
-func (m *MockCertificateService) TriggerDeployment(certID string, targetID string) error {
+func (m *MockCertificateService) TriggerDeployment(ctx context.Context, certID string, targetID string, actor string) error {
 	if m.TriggerDeploymentFn != nil {
-		return m.TriggerDeploymentFn(certID, targetID)
+		return m.TriggerDeploymentFn(ctx, certID, targetID, actor)
 	}
 	return nil
 }
 
-func (m *MockCertificateService) RevokeCertificate(certID string, reason string) error {
+func (m *MockCertificateService) RevokeCertificate(ctx context.Context, certID string, reason string, actor string) error {
 	if m.RevokeCertificateFn != nil {
-		return m.RevokeCertificateFn(certID, reason)
+		return m.RevokeCertificateFn(ctx, certID, reason, actor)
 	}
 	return nil
 }
 
-func (m *MockCertificateService) GetRevokedCertificates() ([]*domain.CertificateRevocation, error) {
+func (m *MockCertificateService) GetRevokedCertificates(ctx context.Context) ([]*domain.CertificateRevocation, error) {
 	if m.GetRevokedCertificatesFn != nil {
-		return m.GetRevokedCertificatesFn()
+		return m.GetRevokedCertificatesFn(ctx)
 	}
 	return nil, nil
 }
 
-func (m *MockCertificateService) GenerateDERCRL(issuerID string) ([]byte, error) {
+func (m *MockCertificateService) GenerateDERCRL(ctx context.Context, issuerID string) ([]byte, error) {
 	if m.GenerateDERCRLFn != nil {
-		return m.GenerateDERCRLFn(issuerID)
+		return m.GenerateDERCRLFn(ctx, issuerID)
 	}
 	return nil, nil
 }
 
-func (m *MockCertificateService) GetOCSPResponse(issuerID string, serialHex string) ([]byte, error) {
+func (m *MockCertificateService) GetOCSPResponse(ctx context.Context, issuerID string, serialHex string) ([]byte, error) {
 	if m.GetOCSPResponseFn != nil {
-		return m.GetOCSPResponseFn(issuerID, serialHex)
+		return m.GetOCSPResponseFn(ctx, issuerID, serialHex)
 	}
 	return nil, nil
 }
 
-func (m *MockCertificateService) ListCertificatesWithFilter(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+func (m *MockCertificateService) ListCertificatesWithFilter(ctx context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 	if m.ListCertificatesWithFilterFn != nil {
-		return m.ListCertificatesWithFilterFn(filter)
+		return m.ListCertificatesWithFilterFn(ctx, filter)
 	}
 	return nil, 0, nil
 }
 
-func (m *MockCertificateService) GetCertificateDeployments(certID string) ([]domain.DeploymentTarget, error) {
+func (m *MockCertificateService) GetCertificateDeployments(ctx context.Context, certID string) ([]domain.DeploymentTarget, error) {
 	if m.GetCertificateDeploymentsFn != nil {
-		return m.GetCertificateDeploymentsFn(certID)
+		return m.GetCertificateDeploymentsFn(ctx, certID)
 	}
 	return nil, nil
 }
@@ -158,7 +158,7 @@ func TestListCertificates_Success(t *testing.T) {
 	}
 
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if filter.Page == 1 && filter.PerPage == 50 {
 				return []domain.ManagedCertificate{cert1, cert2}, 2, nil
 			}
@@ -197,7 +197,7 @@ func TestListCertificates_Success(t *testing.T) {
 // Test ListCertificates - with filters
 func TestListCertificates_WithFilters(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if filter.Status == "Active" && filter.Environment == "prod" {
 				return []domain.ManagedCertificate{}, 0, nil
 			}
@@ -236,7 +236,7 @@ func TestListCertificates_MethodNotAllowed(t *testing.T) {
 // Test ListCertificates - service error
 func TestListCertificates_ServiceError(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			return nil, 0, ErrMockServiceFailed
 		},
 	}
@@ -266,7 +266,7 @@ func TestGetCertificate_Success(t *testing.T) {
 	}
 
 	mock := &MockCertificateService{
-		GetCertificateFn: func(id string) (*domain.ManagedCertificate, error) {
+		GetCertificateFn: func(_ context.Context, id string) (*domain.ManagedCertificate, error) {
 			if id == "mc-prod-001" {
 				return cert, nil
 			}
@@ -298,7 +298,7 @@ func TestGetCertificate_Success(t *testing.T) {
 // Test GetCertificate - not found
 func TestGetCertificate_NotFound(t *testing.T) {
 	mock := &MockCertificateService{
-		GetCertificateFn: func(id string) (*domain.ManagedCertificate, error) {
+		GetCertificateFn: func(_ context.Context, id string) (*domain.ManagedCertificate, error) {
 			return nil, ErrMockNotFound
 		},
 	}
@@ -345,7 +345,7 @@ func TestCreateCertificate_Success(t *testing.T) {
 	}
 
 	mock := &MockCertificateService{
-		CreateCertificateFn: func(cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+		CreateCertificateFn: func(_ context.Context, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
 			return created, nil
 		},
 	}
@@ -353,11 +353,12 @@ func TestCreateCertificate_Success(t *testing.T) {
 	handler := NewCertificateHandler(mock)
 
 	certBody := domain.ManagedCertificate{
-		Name:       "Production Cert",
-		CommonName: "example.com",
-		OwnerID:    "o-alice",
-		TeamID:     "t-platform",
-		IssuerID:   "iss-local",
+		Name:            "Production Cert",
+		CommonName:      "example.com",
+		OwnerID:         "o-alice",
+		TeamID:          "t-platform",
+		IssuerID:        "iss-local",
+		RenewalPolicyID: "rp-standard",
 	}
 	body, _ := json.Marshal(certBody)
 
@@ -402,7 +403,7 @@ func TestCreateCertificate_InvalidBody(t *testing.T) {
 // Test CreateCertificate - service error
 func TestCreateCertificate_ServiceError(t *testing.T) {
 	mock := &MockCertificateService{
-		CreateCertificateFn: func(cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+		CreateCertificateFn: func(_ context.Context, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
 			return nil, ErrMockServiceFailed
 		},
 	}
@@ -410,11 +411,12 @@ func TestCreateCertificate_ServiceError(t *testing.T) {
 	handler := NewCertificateHandler(mock)
 
 	certBody := domain.ManagedCertificate{
-		Name:       "Production Cert",
-		CommonName: "example.com",
-		OwnerID:    "o-alice",
-		TeamID:     "t-platform",
-		IssuerID:   "iss-local",
+		Name:            "Production Cert",
+		CommonName:      "example.com",
+		OwnerID:         "o-alice",
+		TeamID:          "t-platform",
+		IssuerID:        "iss-local",
+		RenewalPolicyID: "rp-standard",
 	}
 	body, _ := json.Marshal(certBody)
 
@@ -430,6 +432,66 @@ func TestCreateCertificate_ServiceError(t *testing.T) {
 	}
 }
 
+// TestCreateCertificate_MissingRequiredField_Returns400 pins the C-001 handler
+// contract: handler MUST reject a create payload that omits any of the five
+// required fields (name, common_name, owner_id, team_id, issuer_id,
+// renewal_policy_id) with HTTP 400 before the service is invoked. The mock
+// service here would succeed if called; every subtest proving 400 therefore
+// proves the handler guard fires.
+func TestCreateCertificate_MissingRequiredField_Returns400(t *testing.T) {
+	baseBody := map[string]interface{}{
+		"name":              "API Prod",
+		"common_name":       "api.example.com",
+		"owner_id":          "o-alice",
+		"team_id":           "t-platform",
+		"issuer_id":         "iss-local",
+		"renewal_policy_id": "rp-standard",
+	}
+
+	cases := []struct {
+		name         string
+		missingField string
+	}{
+		{"missing name", "name"},
+		{"missing common_name", "common_name"},
+		{"missing owner_id", "owner_id"},
+		{"missing team_id", "team_id"},
+		{"missing issuer_id", "issuer_id"},
+		{"missing renewal_policy_id", "renewal_policy_id"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			body := make(map[string]interface{}, len(baseBody))
+			for k, v := range baseBody {
+				body[k] = v
+			}
+			delete(body, tc.missingField)
+			bodyBytes, _ := json.Marshal(body)
+
+			mock := &MockCertificateService{
+				CreateCertificateFn: func(_ context.Context, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+					// Would succeed if handler guard did not fire.
+					cert.ID = "mc-would-be-created"
+					return &cert, nil
+				},
+			}
+			handler := NewCertificateHandler(mock)
+
+			req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates", bytes.NewReader(bodyBytes))
+			req = req.WithContext(contextWithRequestID())
+			req.Header.Set("Content-Type", "application/json")
+			w := httptest.NewRecorder()
+
+			handler.CreateCertificate(w, req)
+
+			if w.Code != http.StatusBadRequest {
+				t.Fatalf("%s: expected 400, got %d — body=%s", tc.name, w.Code, w.Body.String())
+			}
+		})
+	}
+}
+
 // Test UpdateCertificate - success case
 func TestUpdateCertificate_Success(t *testing.T) {
 	updated := &domain.ManagedCertificate{
@@ -443,7 +505,7 @@ func TestUpdateCertificate_Success(t *testing.T) {
 	}
 
 	mock := &MockCertificateService{
-		UpdateCertificateFn: func(id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
+		UpdateCertificateFn: func(_ context.Context, id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error) {
 			if id == "mc-prod-001" {
 				return updated, nil
 			}
@@ -499,7 +561,7 @@ func TestUpdateCertificate_InvalidBody(t *testing.T) {
 // Test ArchiveCertificate - success case
 func TestArchiveCertificate_Success(t *testing.T) {
 	mock := &MockCertificateService{
-		ArchiveCertificateFn: func(id string) error {
+		ArchiveCertificateFn: func(_ context.Context, id string) error {
 			if id == "mc-prod-001" {
 				return nil
 			}
@@ -522,7 +584,7 @@ func TestArchiveCertificate_Success(t *testing.T) {
 // Test ArchiveCertificate - not found
 func TestArchiveCertificate_NotFound(t *testing.T) {
 	mock := &MockCertificateService{
-		ArchiveCertificateFn: func(id string) error {
+		ArchiveCertificateFn: func(_ context.Context, id string) error {
 			return ErrMockNotFound
 		},
 	}
@@ -534,8 +596,8 @@ func TestArchiveCertificate_NotFound(t *testing.T) {
 
 	handler.ArchiveCertificate(w, req)
 
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected status %d, got %d", http.StatusInternalServerError, w.Code)
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected status %d, got %d", http.StatusNotFound, w.Code)
 	}
 }
 
@@ -552,7 +614,7 @@ func TestGetCertificateVersions_Success(t *testing.T) {
 	}
 
 	mock := &MockCertificateService{
-		GetCertificateVersionsFn: func(certID string, page, perPage int) ([]domain.CertificateVersion, int64, error) {
+		GetCertificateVersionsFn: func(_ context.Context, certID string, page, perPage int) ([]domain.CertificateVersion, int64, error) {
 			if certID == "mc-prod-001" {
 				return []domain.CertificateVersion{ver1}, 1, nil
 			}
@@ -584,7 +646,7 @@ func TestGetCertificateVersions_Success(t *testing.T) {
 // Test GetCertificateVersions - not found
 func TestGetCertificateVersions_NotFound(t *testing.T) {
 	mock := &MockCertificateService{
-		GetCertificateVersionsFn: func(certID string, page, perPage int) ([]domain.CertificateVersion, int64, error) {
+		GetCertificateVersionsFn: func(_ context.Context, certID string, page, perPage int) ([]domain.CertificateVersion, int64, error) {
 			return nil, 0, ErrMockNotFound
 		},
 	}
@@ -604,7 +666,7 @@ func TestGetCertificateVersions_NotFound(t *testing.T) {
 // Test TriggerRenewal - success case
 func TestTriggerRenewal_Success(t *testing.T) {
 	mock := &MockCertificateService{
-		TriggerRenewalFn: func(certID string) error {
+		TriggerRenewalFn: func(_ context.Context, certID string, _ string) error {
 			if certID == "mc-prod-001" {
 				return nil
 			}
@@ -636,7 +698,7 @@ func TestTriggerRenewal_Success(t *testing.T) {
 // Test TriggerRenewal - service error
 func TestTriggerRenewal_ServiceError(t *testing.T) {
 	mock := &MockCertificateService{
-		TriggerRenewalFn: func(certID string) error {
+		TriggerRenewalFn: func(_ context.Context, certID string, _ string) error {
 			return ErrMockServiceFailed
 		},
 	}
@@ -656,7 +718,7 @@ func TestTriggerRenewal_ServiceError(t *testing.T) {
 // Test TriggerDeployment - success case
 func TestTriggerDeployment_Success(t *testing.T) {
 	mock := &MockCertificateService{
-		TriggerDeploymentFn: func(certID string, targetID string) error {
+		TriggerDeploymentFn: func(_ context.Context, certID string, targetID string, _ string) error {
 			if certID == "mc-prod-001" {
 				return nil
 			}
@@ -693,7 +755,7 @@ func TestTriggerDeployment_Success(t *testing.T) {
 // Test TriggerDeployment - without target ID
 func TestTriggerDeployment_NoTargetID(t *testing.T) {
 	mock := &MockCertificateService{
-		TriggerDeploymentFn: func(certID string, targetID string) error {
+		TriggerDeploymentFn: func(_ context.Context, certID string, targetID string, _ string) error {
 			// Should accept empty targetID (deploy to all)
 			return nil
 		},
@@ -714,7 +776,7 @@ func TestTriggerDeployment_NoTargetID(t *testing.T) {
 // Test ListCertificates - invalid page parameter
 func TestListCertificates_InvalidPageParam(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			// Should default to page 1
 			if filter.Page == 1 {
 				return []domain.ManagedCertificate{}, 0, nil
@@ -738,7 +800,7 @@ func TestListCertificates_InvalidPageParam(t *testing.T) {
 // Test ListCertificates - per_page exceeds max
 func TestListCertificates_PerPageExceedsMax(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			// Should cap perPage at 500
 			if filter.PerPage == 50 { // defaults to 50 if > 500
 				return []domain.ManagedCertificate{}, 0, nil
@@ -763,7 +825,7 @@ func TestListCertificates_PerPageExceedsMax(t *testing.T) {
 
 func TestRevokeCertificate_Handler_Success(t *testing.T) {
 	mock := &MockCertificateService{
-		RevokeCertificateFn: func(certID string, reason string) error {
+		RevokeCertificateFn: func(_ context.Context, certID string, reason string, _ string) error {
 			if certID != "mc-prod-001" {
 				t.Errorf("expected certID mc-prod-001, got %s", certID)
 			}
@@ -796,7 +858,7 @@ func TestRevokeCertificate_Handler_Success(t *testing.T) {
 
 func TestRevokeCertificate_Handler_NoBody(t *testing.T) {
 	mock := &MockCertificateService{
-		RevokeCertificateFn: func(certID string, reason string) error {
+		RevokeCertificateFn: func(_ context.Context, certID string, reason string, _ string) error {
 			// Empty reason is OK — service defaults to "unspecified"
 			return nil
 		},
@@ -816,7 +878,7 @@ func TestRevokeCertificate_Handler_NoBody(t *testing.T) {
 
 func TestRevokeCertificate_Handler_AlreadyRevoked(t *testing.T) {
 	mock := &MockCertificateService{
-		RevokeCertificateFn: func(certID string, reason string) error {
+		RevokeCertificateFn: func(_ context.Context, certID string, reason string, _ string) error {
 			return fmt.Errorf("certificate is already revoked")
 		},
 	}
@@ -837,7 +899,7 @@ func TestRevokeCertificate_Handler_AlreadyRevoked(t *testing.T) {
 
 func TestRevokeCertificate_Handler_NotFound(t *testing.T) {
 	mock := &MockCertificateService{
-		RevokeCertificateFn: func(certID string, reason string) error {
+		RevokeCertificateFn: func(_ context.Context, certID string, reason string, _ string) error {
 			return fmt.Errorf("failed to fetch certificate: not found")
 		},
 	}
@@ -856,7 +918,7 @@ func TestRevokeCertificate_Handler_NotFound(t *testing.T) {
 
 func TestRevokeCertificate_Handler_InvalidReason(t *testing.T) {
 	mock := &MockCertificateService{
-		RevokeCertificateFn: func(certID string, reason string) error {
+		RevokeCertificateFn: func(_ context.Context, certID string, reason string, _ string) error {
 			return fmt.Errorf("invalid revocation reason: badReason")
 		},
 	}
@@ -920,7 +982,7 @@ func TestRevokeCertificate_Handler_EmptyID(t *testing.T) {
 
 func TestRevokeCertificate_Handler_CannotRevokeArchived(t *testing.T) {
 	mock := &MockCertificateService{
-		RevokeCertificateFn: func(certID string, reason string) error {
+		RevokeCertificateFn: func(_ context.Context, certID string, reason string, _ string) error {
 			return fmt.Errorf("cannot revoke archived certificate")
 		},
 	}
@@ -939,7 +1001,7 @@ func TestRevokeCertificate_Handler_CannotRevokeArchived(t *testing.T) {
 
 func TestRevokeCertificate_Handler_ServerError(t *testing.T) {
 	mock := &MockCertificateService{
-		RevokeCertificateFn: func(certID string, reason string) error {
+		RevokeCertificateFn: func(_ context.Context, certID string, reason string, _ string) error {
 			return fmt.Errorf("database connection lost")
 		},
 	}
@@ -956,132 +1018,18 @@ func TestRevokeCertificate_Handler_ServerError(t *testing.T) {
 	}
 }
 
-// === CRL Handler Tests ===
-
-func TestGetCRL_Success(t *testing.T) {
-	mock := &MockCertificateService{
-		GetRevokedCertificatesFn: func() ([]*domain.CertificateRevocation, error) {
-			return []*domain.CertificateRevocation{
-				{
-					ID:            "rev-1",
-					CertificateID: "cert-1",
-					SerialNumber:  "ABC123",
-					Reason:        "keyCompromise",
-					RevokedAt:     time.Date(2026, 3, 20, 10, 0, 0, 0, time.UTC),
-				},
-				{
-					ID:            "rev-2",
-					CertificateID: "cert-2",
-					SerialNumber:  "DEF456",
-					Reason:        "superseded",
-					RevokedAt:     time.Date(2026, 3, 21, 14, 30, 0, 0, time.UTC),
-				},
-			}, nil
-		},
-	}
-
-	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/crl", nil)
-	req = req.WithContext(contextWithRequestID())
-	w := httptest.NewRecorder()
-
-	handler.GetCRL(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected status %d, got %d", http.StatusOK, w.Code)
-	}
-
-	var resp map[string]interface{}
-	json.NewDecoder(w.Body).Decode(&resp)
-
-	if resp["version"] != float64(1) {
-		t.Errorf("expected version 1, got %v", resp["version"])
-	}
-	if resp["total"] != float64(2) {
-		t.Errorf("expected total 2, got %v", resp["total"])
-	}
-
-	entries, ok := resp["entries"].([]interface{})
-	if !ok {
-		t.Fatal("expected entries to be an array")
-	}
-	if len(entries) != 2 {
-		t.Errorf("expected 2 entries, got %d", len(entries))
-	}
-
-	entry1 := entries[0].(map[string]interface{})
-	if entry1["serial_number"] != "ABC123" {
-		t.Errorf("expected serial ABC123, got %v", entry1["serial_number"])
-	}
-	if entry1["revocation_reason"] != "keyCompromise" {
-		t.Errorf("expected reason keyCompromise, got %v", entry1["revocation_reason"])
-	}
-}
-
-func TestGetCRL_Empty(t *testing.T) {
-	mock := &MockCertificateService{
-		GetRevokedCertificatesFn: func() ([]*domain.CertificateRevocation, error) {
-			return nil, nil
-		},
-	}
-
-	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/crl", nil)
-	req = req.WithContext(contextWithRequestID())
-	w := httptest.NewRecorder()
-
-	handler.GetCRL(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected status %d, got %d", http.StatusOK, w.Code)
-	}
-
-	var resp map[string]interface{}
-	json.NewDecoder(w.Body).Decode(&resp)
-	if resp["total"] != float64(0) {
-		t.Errorf("expected total 0, got %v", resp["total"])
-	}
-}
-
-func TestGetCRL_ServiceError(t *testing.T) {
-	mock := &MockCertificateService{
-		GetRevokedCertificatesFn: func() ([]*domain.CertificateRevocation, error) {
-			return nil, fmt.Errorf("revocation repository not configured")
-		},
-	}
-
-	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/crl", nil)
-	req = req.WithContext(contextWithRequestID())
-	w := httptest.NewRecorder()
-
-	handler.GetCRL(w, req)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected status %d, got %d", http.StatusInternalServerError, w.Code)
-	}
-}
-
-func TestGetCRL_MethodNotAllowed(t *testing.T) {
-	mock := &MockCertificateService{}
-	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/crl", nil)
-	req = req.WithContext(contextWithRequestID())
-	w := httptest.NewRecorder()
-
-	handler.GetCRL(w, req)
-
-	if w.Code != http.StatusMethodNotAllowed {
-		t.Errorf("expected status %d, got %d", http.StatusMethodNotAllowed, w.Code)
-	}
-}
-
-// M15b: DER CRL and OCSP Handler Tests
+// === CRL and OCSP Handler Tests (RFC 5280 / RFC 6960, served under /.well-known/pki/) ===
+//
+// M-006 relocated these endpoints from /api/v1/crl* and /api/v1/ocsp/* to the
+// RFC-compliant /.well-known/pki/ namespace and deleted the non-standard JSON
+// CRL endpoint. The DER-encoded X.509 CRL (application/pkix-crl) and the
+// DER-encoded OCSP response (application/ocsp-response) are the only wire
+// formats certctl supports for revocation data.
 
 func TestGetDERCRL_Success(t *testing.T) {
 	derCRLData := []byte{0x30, 0x82, 0x01, 0x00} // Mock DER CRL bytes
 	mock := &MockCertificateService{
-		GenerateDERCRLFn: func(issuerID string) ([]byte, error) {
+		GenerateDERCRLFn: func(_ context.Context, issuerID string) ([]byte, error) {
 			if issuerID == "iss-local" {
 				return derCRLData, nil
 			}
@@ -1090,7 +1038,7 @@ func TestGetDERCRL_Success(t *testing.T) {
 	}
 
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/crl/iss-local", nil)
+	req := httptest.NewRequest(http.MethodGet, "/.well-known/pki/crl/iss-local", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1105,17 +1053,20 @@ func TestGetDERCRL_Success(t *testing.T) {
 	if len(responseBody) == 0 {
 		t.Error("expected non-empty response body")
 	}
+	if ct := w.Header().Get("Content-Type"); ct != "application/pkix-crl" {
+		t.Errorf("expected Content-Type application/pkix-crl, got %q", ct)
+	}
 }
 
 func TestGetDERCRL_IssuerNotFound(t *testing.T) {
 	mock := &MockCertificateService{
-		GenerateDERCRLFn: func(issuerID string) ([]byte, error) {
+		GenerateDERCRLFn: func(_ context.Context, issuerID string) ([]byte, error) {
 			return nil, fmt.Errorf("issuer not found")
 		},
 	}
 
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/crl/nonexistent", nil)
+	req := httptest.NewRequest(http.MethodGet, "/.well-known/pki/crl/nonexistent", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1128,13 +1079,13 @@ func TestGetDERCRL_IssuerNotFound(t *testing.T) {
 
 func TestGetDERCRL_NotSupported(t *testing.T) {
 	mock := &MockCertificateService{
-		GenerateDERCRLFn: func(issuerID string) ([]byte, error) {
+		GenerateDERCRLFn: func(_ context.Context, issuerID string) ([]byte, error) {
 			return nil, fmt.Errorf("issuer does not support CRL generation")
 		},
 	}
 
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/crl/iss-acme", nil)
+	req := httptest.NewRequest(http.MethodGet, "/.well-known/pki/crl/iss-acme", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1149,7 +1100,7 @@ func TestGetDERCRL_NotSupported(t *testing.T) {
 func TestGetDERCRL_MethodNotAllowed(t *testing.T) {
 	mock := &MockCertificateService{}
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/crl/iss-local", nil)
+	req := httptest.NewRequest(http.MethodPost, "/.well-known/pki/crl/iss-local", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1163,7 +1114,7 @@ func TestGetDERCRL_MethodNotAllowed(t *testing.T) {
 func TestHandleOCSP_Success(t *testing.T) {
 	ocspResponseBytes := []byte{0x30, 0x82, 0x02, 0x00} // Mock OCSP response
 	mock := &MockCertificateService{
-		GetOCSPResponseFn: func(issuerID string, serialHex string) ([]byte, error) {
+		GetOCSPResponseFn: func(_ context.Context, issuerID string, serialHex string) ([]byte, error) {
 			if issuerID == "iss-local" && serialHex == "12345" {
 				return ocspResponseBytes, nil
 			}
@@ -1172,7 +1123,7 @@ func TestHandleOCSP_Success(t *testing.T) {
 	}
 
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/ocsp/iss-local/12345", nil)
+	req := httptest.NewRequest(http.MethodGet, "/.well-known/pki/ocsp/iss-local/12345", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1186,12 +1137,15 @@ func TestHandleOCSP_Success(t *testing.T) {
 	if len(responseBody) == 0 {
 		t.Error("expected non-empty OCSP response body")
 	}
+	if ct := w.Header().Get("Content-Type"); ct != "application/ocsp-response" {
+		t.Errorf("expected Content-Type application/ocsp-response, got %q", ct)
+	}
 }
 
 func TestHandleOCSP_MissingSerial(t *testing.T) {
 	mock := &MockCertificateService{}
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/ocsp/iss-local/", nil)
+	req := httptest.NewRequest(http.MethodGet, "/.well-known/pki/ocsp/iss-local/", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1204,13 +1158,13 @@ func TestHandleOCSP_MissingSerial(t *testing.T) {
 
 func TestHandleOCSP_IssuerNotFound(t *testing.T) {
 	mock := &MockCertificateService{
-		GetOCSPResponseFn: func(issuerID string, serialHex string) ([]byte, error) {
+		GetOCSPResponseFn: func(_ context.Context, issuerID string, serialHex string) ([]byte, error) {
 			return nil, fmt.Errorf("issuer not found")
 		},
 	}
 
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/ocsp/nonexistent/ABC123", nil)
+	req := httptest.NewRequest(http.MethodGet, "/.well-known/pki/ocsp/nonexistent/ABC123", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1223,13 +1177,13 @@ func TestHandleOCSP_IssuerNotFound(t *testing.T) {
 
 func TestHandleOCSP_CertNotFound(t *testing.T) {
 	mock := &MockCertificateService{
-		GetOCSPResponseFn: func(issuerID string, serialHex string) ([]byte, error) {
+		GetOCSPResponseFn: func(_ context.Context, issuerID string, serialHex string) ([]byte, error) {
 			return nil, fmt.Errorf("certificate not found")
 		},
 	}
 
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/ocsp/iss-local/UNKNOWN", nil)
+	req := httptest.NewRequest(http.MethodGet, "/.well-known/pki/ocsp/iss-local/UNKNOWN", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1243,7 +1197,7 @@ func TestHandleOCSP_CertNotFound(t *testing.T) {
 func TestHandleOCSP_MethodNotAllowed(t *testing.T) {
 	mock := &MockCertificateService{}
 	handler := NewCertificateHandler(mock)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/ocsp/iss-local/12345", nil)
+	req := httptest.NewRequest(http.MethodPost, "/.well-known/pki/ocsp/iss-local/12345", nil)
 	req = req.WithContext(contextWithRequestID())
 	w := httptest.NewRecorder()
 
@@ -1259,7 +1213,7 @@ func TestHandleOCSP_MethodNotAllowed(t *testing.T) {
 // TestListCertificates_SortParam tests sort parameter parsing and passing to service.
 func TestListCertificates_SortParam(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			// Handler strips the '-' prefix and sets SortDesc = true
 			if filter.Sort != "notAfter" || !filter.SortDesc {
 				t.Errorf("expected sort=notAfter desc=true, got sort=%s desc=%v", filter.Sort, filter.SortDesc)
@@ -1282,7 +1236,7 @@ func TestListCertificates_SortParam(t *testing.T) {
 // TestListCertificates_SortParam_Ascending tests sort parameter without '-' prefix (ascending).
 func TestListCertificates_SortParam_Ascending(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if filter.Sort != "createdAt" || filter.SortDesc {
 				t.Errorf("expected sort=createdAt desc=false, got sort=%s desc=%v", filter.Sort, filter.SortDesc)
 			}
@@ -1307,7 +1261,7 @@ func TestListCertificates_TimeRangeFilters(t *testing.T) {
 	after := time.Now().AddDate(0, 0, -90)
 
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if filter.ExpiresBefore == nil {
 				t.Error("expected ExpiresBefore to be set")
 			}
@@ -1337,7 +1291,7 @@ func TestListCertificates_CreatedAfterFilter(t *testing.T) {
 	past := time.Now().AddDate(-1, 0, 0)
 
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if filter.CreatedAfter == nil {
 				t.Error("expected CreatedAfter to be set")
 			}
@@ -1367,7 +1321,7 @@ func TestListCertificates_CursorPagination(t *testing.T) {
 	}
 
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			return []domain.ManagedCertificate{cert}, 1, nil
 		},
 	}
@@ -1407,7 +1361,7 @@ func TestListCertificates_SparseFields(t *testing.T) {
 	}
 
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if len(filter.Fields) != 2 {
 				t.Errorf("expected 2 fields, got %d", len(filter.Fields))
 			}
@@ -1454,7 +1408,7 @@ func TestListCertificates_SparseFields(t *testing.T) {
 // TestListCertificates_ProfileFilter tests profile_id filter.
 func TestListCertificates_ProfileFilter(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if filter.ProfileID != "prof-standard" {
 				t.Errorf("expected ProfileID=prof-standard, got %s", filter.ProfileID)
 			}
@@ -1477,7 +1431,7 @@ func TestListCertificates_ProfileFilter(t *testing.T) {
 // TestListCertificates_AgentIDFilter tests agent_id filter.
 func TestListCertificates_AgentIDFilter(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if filter.AgentID != "agent-prod-001" {
 				t.Errorf("expected AgentID=agent-prod-001, got %s", filter.AgentID)
 			}
@@ -1500,7 +1454,7 @@ func TestListCertificates_AgentIDFilter(t *testing.T) {
 // TestListCertificates_CombinedFilters tests multiple filters together.
 func TestListCertificates_CombinedFilters(t *testing.T) {
 	mock := &MockCertificateService{
-		ListCertificatesWithFilterFn: func(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
+		ListCertificatesWithFilterFn: func(_ context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error) {
 			if filter.Status != "Active" || filter.Environment != "production" || filter.ProfileID != "prof-standard" {
 				t.Error("expected all filters to be set")
 			}
@@ -1538,7 +1492,7 @@ func TestGetCertificateDeployments_Success(t *testing.T) {
 	}
 
 	mock := &MockCertificateService{
-		GetCertificateDeploymentsFn: func(certID string) ([]domain.DeploymentTarget, error) {
+		GetCertificateDeploymentsFn: func(_ context.Context, certID string) ([]domain.DeploymentTarget, error) {
 			if certID != "mc-prod-001" {
 				return nil, ErrMockNotFound
 			}
@@ -1574,7 +1528,7 @@ func TestGetCertificateDeployments_Success(t *testing.T) {
 // TestGetCertificateDeployments_NotFound tests 404 for nonexistent certificate.
 func TestGetCertificateDeployments_NotFound(t *testing.T) {
 	mock := &MockCertificateService{
-		GetCertificateDeploymentsFn: func(certID string) ([]domain.DeploymentTarget, error) {
+		GetCertificateDeploymentsFn: func(_ context.Context, certID string) ([]domain.DeploymentTarget, error) {
 			return nil, fmt.Errorf("certificate not found")
 		},
 	}
@@ -1594,7 +1548,7 @@ func TestGetCertificateDeployments_NotFound(t *testing.T) {
 // TestGetCertificateDeployments_Empty tests successful response with no deployments.
 func TestGetCertificateDeployments_Empty(t *testing.T) {
 	mock := &MockCertificateService{
-		GetCertificateDeploymentsFn: func(certID string) ([]domain.DeploymentTarget, error) {
+		GetCertificateDeploymentsFn: func(_ context.Context, certID string) ([]domain.DeploymentTarget, error) {
 			if certID == "mc-no-deployments" {
 				return []domain.DeploymentTarget{}, nil
 			}

internal/api/handler/certificates.go

@@ -1,7 +1,9 @@
 package handler
 
 import (
+	"context"
 	"encoding/json"
+	"log/slog"
 	"net/http"
 	"strconv"
 	"strings"
@@ -14,20 +16,20 @@ import (
 
 // CertificateService defines the service interface for certificate operations.
 type CertificateService interface {
-	ListCertificates(status, environment, ownerID, teamID, issuerID string, page, perPage int) ([]domain.ManagedCertificate, int64, error)
-	ListCertificatesWithFilter(filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error)
-	GetCertificate(id string) (*domain.ManagedCertificate, error)
-	CreateCertificate(cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
-	UpdateCertificate(id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
-	ArchiveCertificate(id string) error
-	GetCertificateVersions(certID string, page, perPage int) ([]domain.CertificateVersion, int64, error)
-	TriggerRenewal(certID string) error
-	TriggerDeployment(certID string, targetID string) error
-	RevokeCertificate(certID string, reason string) error
-	GetRevokedCertificates() ([]*domain.CertificateRevocation, error)
-	GenerateDERCRL(issuerID string) ([]byte, error)
-	GetOCSPResponse(issuerID string, serialHex string) ([]byte, error)
-	GetCertificateDeployments(certID string) ([]domain.DeploymentTarget, error)
+	ListCertificates(ctx context.Context, status, environment, ownerID, teamID, issuerID string, page, perPage int) ([]domain.ManagedCertificate, int64, error)
+	ListCertificatesWithFilter(ctx context.Context, filter *repository.CertificateFilter) ([]domain.ManagedCertificate, int, error)
+	GetCertificate(ctx context.Context, id string) (*domain.ManagedCertificate, error)
+	CreateCertificate(ctx context.Context, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
+	UpdateCertificate(ctx context.Context, id string, cert domain.ManagedCertificate) (*domain.ManagedCertificate, error)
+	ArchiveCertificate(ctx context.Context, id string) error
+	GetCertificateVersions(ctx context.Context, certID string, page, perPage int) ([]domain.CertificateVersion, int64, error)
+	TriggerRenewal(ctx context.Context, certID string, actor string) error
+	TriggerDeployment(ctx context.Context, certID string, targetID string, actor string) error
+	RevokeCertificate(ctx context.Context, certID string, reason string, actor string) error
+	GetRevokedCertificates(ctx context.Context) ([]*domain.CertificateRevocation, error)
+	GenerateDERCRL(ctx context.Context, issuerID string) ([]byte, error)
+	GetOCSPResponse(ctx context.Context, issuerID string, serialHex string) ([]byte, error)
+	GetCertificateDeployments(ctx context.Context, certID string) ([]domain.DeploymentTarget, error)
 }
 
 // CertificateHandler handles HTTP requests for certificate operations.
@@ -127,7 +129,7 @@ func (h CertificateHandler) ListCertificates(w http.ResponseWriter, r *http.Requ
 		filter.Fields = strings.Split(fieldsStr, ",")
 	}
 
-	certs, total, err := h.svc.ListCertificatesWithFilter(filter)
+	certs, total, err := h.svc.ListCertificatesWithFilter(r.Context(), filter)
 	if err != nil {
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to list certificates", requestID)
 		return
@@ -185,7 +187,7 @@ func (h CertificateHandler) GetCertificate(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	cert, err := h.svc.GetCertificate(id)
+	cert, err := h.svc.GetCertificate(r.Context(), id)
 	if err != nil {
 		ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
 		return
@@ -231,9 +233,18 @@ func (h CertificateHandler) CreateCertificate(w http.ResponseWriter, r *http.Req
 		ErrorWithRequestID(w, http.StatusBadRequest, err.Error(), requestID)
 		return
 	}
+	if err := ValidateRequired("name", cert.Name); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, err.Error(), requestID)
+		return
+	}
+	if err := ValidateRequired("renewal_policy_id", cert.RenewalPolicyID); err != nil {
+		ErrorWithRequestID(w, http.StatusBadRequest, err.Error(), requestID)
+		return
+	}
 
-	created, err := h.svc.CreateCertificate(cert)
+	created, err := h.svc.CreateCertificate(r.Context(), cert)
 	if err != nil {
+		slog.Error("failed to create certificate", "error", err, "request_id", requestID, "common_name", cert.CommonName, "name", cert.Name)
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to create certificate", requestID)
 		return
 	}
@@ -285,8 +296,13 @@ func (h CertificateHandler) UpdateCertificate(w http.ResponseWriter, r *http.Req
 		}
 	}
 
-	updated, err := h.svc.UpdateCertificate(id, cert)
+	updated, err := h.svc.UpdateCertificate(r.Context(), id, cert)
 	if err != nil {
+		if strings.Contains(err.Error(), "not found") {
+			ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
+			return
+		}
+		slog.Error("UpdateCertificate failed", "cert_id", id, "error", err.Error())
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to update certificate", requestID)
 		return
 	}
@@ -310,7 +326,11 @@ func (h CertificateHandler) ArchiveCertificate(w http.ResponseWriter, r *http.Re
 		return
 	}
 
-	if err := h.svc.ArchiveCertificate(id); err != nil {
+	if err := h.svc.ArchiveCertificate(r.Context(), id); err != nil {
+		if strings.Contains(err.Error(), "not found") {
+			ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
+			return
+		}
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to archive certificate", requestID)
 		return
 	}
@@ -351,9 +371,14 @@ func (h CertificateHandler) GetCertificateVersions(w http.ResponseWriter, r *htt
 		}
 	}
 
-	versions, total, err := h.svc.GetCertificateVersions(certID, page, perPage)
+	versions, total, err := h.svc.GetCertificateVersions(r.Context(), certID, page, perPage)
 	if err != nil {
-		ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
+		if strings.Contains(err.Error(), "not found") {
+			ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
+			return
+		}
+		slog.Error("GetCertificateVersions failed", "cert_id", certID, "error", err.Error())
+		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to get certificate versions", requestID)
 		return
 	}
 
@@ -386,7 +411,22 @@ func (h CertificateHandler) TriggerRenewal(w http.ResponseWriter, r *http.Reques
 	}
 	certID := parts[0]
 
-	if err := h.svc.TriggerRenewal(certID); err != nil {
+	actor := resolveActor(r.Context())
+
+	if err := h.svc.TriggerRenewal(r.Context(), certID, actor); err != nil {
+		errMsg := err.Error()
+		if strings.Contains(errMsg, "not found") {
+			ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
+			return
+		}
+		if strings.Contains(errMsg, "cannot renew") {
+			ErrorWithRequestID(w, http.StatusBadRequest, errMsg, requestID)
+			return
+		}
+		if strings.Contains(errMsg, "already in progress") {
+			ErrorWithRequestID(w, http.StatusConflict, errMsg, requestID)
+			return
+		}
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to trigger renewal", requestID)
 		return
 	}
@@ -429,7 +469,9 @@ func (h CertificateHandler) TriggerDeployment(w http.ResponseWriter, r *http.Req
 		}
 	}
 
-	if err := h.svc.TriggerDeployment(certID, req.TargetID); err != nil {
+	actor := resolveActor(r.Context())
+
+	if err := h.svc.TriggerDeployment(r.Context(), certID, req.TargetID, actor); err != nil {
 		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to trigger deployment", requestID)
 		return
 	}
@@ -471,7 +513,9 @@ func (h CertificateHandler) RevokeCertificate(w http.ResponseWriter, r *http.Req
 		}
 	}
 
-	if err := h.svc.RevokeCertificate(certID, req.Reason); err != nil {
+	actor := resolveActor(r.Context())
+
+	if err := h.svc.RevokeCertificate(r.Context(), certID, req.Reason, actor); err != nil {
 		// Distinguish between client errors and server errors
 		errMsg := err.Error()
 		if strings.Contains(errMsg, "already revoked") ||
@@ -480,7 +524,7 @@ func (h CertificateHandler) RevokeCertificate(w http.ResponseWriter, r *http.Req
 			ErrorWithRequestID(w, http.StatusBadRequest, errMsg, requestID)
 			return
 		}
-		if strings.Contains(errMsg, "not found") || strings.Contains(errMsg, "failed to fetch") {
+		if strings.Contains(errMsg, "not found") || strings.Contains(errMsg, "failed to fetch") || strings.Contains(errMsg, "failed to get") {
 			ErrorWithRequestID(w, http.StatusNotFound, "Certificate not found", requestID)
 			return
 		}
@@ -491,49 +535,12 @@ func (h CertificateHandler) RevokeCertificate(w http.ResponseWriter, r *http.Req
 	JSON(w, http.StatusOK, map[string]string{"status": "revoked"})
 }
 
-// GetCRL returns the Certificate Revocation List as structured JSON.
-// GET /api/v1/crl
-// Note: DER-encoded X.509 CRL generation (requiring CA key access) is planned for M15b
-// alongside the embedded OCSP responder. This endpoint provides the same data in JSON format.
-func (h CertificateHandler) GetCRL(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
-		return
-	}
-
-	requestID := middleware.GetRequestID(r.Context())
-
-	revocations, err := h.svc.GetRevokedCertificates()
-	if err != nil {
-		ErrorWithRequestID(w, http.StatusInternalServerError, "Failed to generate CRL", requestID)
-		return
-	}
-
-	type CRLEntry struct {
-		SerialNumber     string `json:"serial_number"`
-		RevocationDate   string `json:"revocation_date"`
-		RevocationReason string `json:"revocation_reason"`
-	}
-
-	entries := make([]CRLEntry, 0, len(revocations))
-	for _, rev := range revocations {
-		entries = append(entries, CRLEntry{
-			SerialNumber:     rev.SerialNumber,
-			RevocationDate:   rev.RevokedAt.Format("2006-01-02T15:04:05Z"),
-			RevocationReason: rev.Reason,
-		})
-	}
-
-	JSON(w, http.StatusOK, map[string]interface{}{
-		"version":      1,
-		"entries":      entries,
-		"total":        len(entries),
-		"generated_at": time.Now().UTC().Format("2006-01-02T15:04:05Z"),
-	})
-}
-
 // GetDERCRL returns a DER-encoded X.509 CRL signed by the specified issuer.
-// GET /api/v1/crl/{issuer_id}
+// GET /.well-known/pki/crl/{issuer_id}
+//
+// RFC 5280 § 5. Served unauthenticated under the /.well-known/pki/ namespace so
+// relying parties (browsers, OpenSSL, OCSP stapling sidecars) can fetch the CRL
+// without presenting certctl API credentials.
 func (h CertificateHandler) GetDERCRL(w http.ResponseWriter, r *http.Request) {
 	requestID, _ := r.Context().Value("request_id").(string)
 
@@ -542,13 +549,13 @@ func (h CertificateHandler) GetDERCRL(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	issuerID := strings.TrimPrefix(r.URL.Path, "/api/v1/crl/")
+	issuerID := strings.TrimPrefix(r.URL.Path, "/.well-known/pki/crl/")
 	if issuerID == "" {
 		ErrorWithRequestID(w, http.StatusBadRequest, "Issuer ID is required", requestID)
 		return
 	}
 
-	derBytes, err := h.svc.GenerateDERCRL(issuerID)
+	derBytes, err := h.svc.GenerateDERCRL(r.Context(), issuerID)
 	if err != nil {
 		errMsg := err.Error()
 		if strings.Contains(errMsg, "not found") {
@@ -570,8 +577,11 @@ func (h CertificateHandler) GetDERCRL(w http.ResponseWriter, r *http.Request) {
 }
 
 // HandleOCSP processes OCSP requests.
-// GET /api/v1/ocsp/{issuer_id}/{serial_hex}
-// For simplicity, use GET with path params instead of binary POST.
+// GET /.well-known/pki/ocsp/{issuer_id}/{serial_hex}
+//
+// RFC 6960. Served unauthenticated under the /.well-known/pki/ namespace. For
+// simplicity we accept GET with path params rather than the binary POST body
+// form — the response is a valid DER-encoded OCSP response either way.
 func (h CertificateHandler) HandleOCSP(w http.ResponseWriter, r *http.Request) {
 	requestID, _ := r.Context().Value("request_id").(string)
 
@@ -580,8 +590,8 @@ func (h CertificateHandler) HandleOCSP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Extract issuer_id and serial from path: /api/v1/ocsp/{issuer_id}/{serial_hex}
-	path := strings.TrimPrefix(r.URL.Path, "/api/v1/ocsp/")
+	// Extract issuer_id and serial from path: /.well-known/pki/ocsp/{issuer_id}/{serial_hex}
+	path := strings.TrimPrefix(r.URL.Path, "/.well-known/pki/ocsp/")
 	parts := strings.SplitN(path, "/", 2)
 	if len(parts) < 2 || parts[0] == "" || parts[1] == "" {
 		ErrorWithRequestID(w, http.StatusBadRequest, "Issuer ID and serial number are required", requestID)
@@ -590,7 +600,7 @@ func (h CertificateHandler) HandleOCSP(w http.ResponseWriter, r *http.Request) {
 	issuerID := parts[0]
 	serialHex := parts[1]
 
-	derBytes, err := h.svc.GetOCSPResponse(issuerID, serialHex)
+	derBytes, err := h.svc.GetOCSPResponse(r.Context(), issuerID, serialHex)
 	if err != nil {
 		errMsg := err.Error()
 		if strings.Contains(errMsg, "not found") {
@@ -630,7 +640,7 @@ func (h CertificateHandler) GetCertificateDeployments(w http.ResponseWriter, r *
 	}
 	certID := parts[0]
 
-	deployments, err := h.svc.GetCertificateDeployments(certID)
+	deployments, err := h.svc.GetCertificateDeployments(r.Context(), certID)
 	if err != nil {
 		errMsg := err.Error()
 		if strings.Contains(errMsg, "not found") {

internal/api/handler/digest.go

@@ -0,0 +1,76 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+)
+
+// DigestServicer defines the interface for digest operations used by the handler.
+type DigestServicer interface {
+	PreviewDigest(ctx context.Context) (string, error)
+	SendDigest(ctx context.Context) error
+}
+
+// DigestHandler provides HTTP endpoints for certificate digest operations.
+type DigestHandler struct {
+	service DigestServicer
+}
+
+// NewDigestHandler creates a new digest handler.
+func NewDigestHandler(service DigestServicer) *DigestHandler {
+	return &DigestHandler{service: service}
+}
+
+// PreviewDigest renders the digest HTML without sending it.
+// GET /api/v1/digest/preview
+func (h *DigestHandler) PreviewDigest(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	if h.service == nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusServiceUnavailable)
+		json.NewEncoder(w).Encode(map[string]string{"error": "digest service not configured"})
+		return
+	}
+
+	html, err := h.service.PreviewDigest(r.Context())
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(html))
+}
+
+// SendDigest triggers an immediate digest send.
+// POST /api/v1/digest/send
+func (h *DigestHandler) SendDigest(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	if h.service == nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusServiceUnavailable)
+		json.NewEncoder(w).Encode(map[string]string{"error": "digest service not configured"})
+		return
+	}
+
+	if err := h.service.SendDigest(r.Context()); err != nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+		json.NewEncoder(w).Encode(map[string]string{"error": err.Error()})
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(map[string]string{"status": "sent"})
+}

internal/api/handler/digest_handler_test.go

@@ -0,0 +1,157 @@
+package handler
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// mockDigestService implements DigestServicer for testing.
+type mockDigestService struct {
+	previewHTML string
+	previewErr  error
+	sendErr     error
+	sendCalled  bool
+}
+
+func (m *mockDigestService) PreviewDigest(ctx context.Context) (string, error) {
+	if m.previewErr != nil {
+		return "", m.previewErr
+	}
+	return m.previewHTML, nil
+}
+
+func (m *mockDigestService) SendDigest(ctx context.Context) error {
+	m.sendCalled = true
+	return m.sendErr
+}
+
+func TestDigestHandler_PreviewDigest_Success(t *testing.T) {
+	svc := &mockDigestService{
+		previewHTML: "<html><body>Digest Preview</body></html>",
+	}
+	h := NewDigestHandler(svc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/digest/preview", nil)
+	w := httptest.NewRecorder()
+
+	h.PreviewDigest(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected status 200, got %d", w.Code)
+	}
+
+	if w.Header().Get("Content-Type") != "text/html; charset=utf-8" {
+		t.Errorf("expected Content-Type text/html, got %s", w.Header().Get("Content-Type"))
+	}
+
+	if w.Body.String() != "<html><body>Digest Preview</body></html>" {
+		t.Errorf("unexpected body: %s", w.Body.String())
+	}
+}
+
+func TestDigestHandler_PreviewDigest_MethodNotAllowed(t *testing.T) {
+	svc := &mockDigestService{}
+	h := NewDigestHandler(svc)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/digest/preview", nil)
+	w := httptest.NewRecorder()
+
+	h.PreviewDigest(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Errorf("expected status 405, got %d", w.Code)
+	}
+}
+
+func TestDigestHandler_PreviewDigest_ServiceError(t *testing.T) {
+	svc := &mockDigestService{
+		previewErr: errors.New("stats unavailable"),
+	}
+	h := NewDigestHandler(svc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/digest/preview", nil)
+	w := httptest.NewRecorder()
+
+	h.PreviewDigest(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("expected status 500, got %d", w.Code)
+	}
+}
+
+func TestDigestHandler_PreviewDigest_NotConfigured(t *testing.T) {
+	h := NewDigestHandler(nil)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/digest/preview", nil)
+	w := httptest.NewRecorder()
+
+	h.PreviewDigest(w, req)
+
+	if w.Code != http.StatusServiceUnavailable {
+		t.Errorf("expected status 503, got %d", w.Code)
+	}
+}
+
+func TestDigestHandler_SendDigest_Success(t *testing.T) {
+	svc := &mockDigestService{}
+	h := NewDigestHandler(svc)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/digest/send", nil)
+	w := httptest.NewRecorder()
+
+	h.SendDigest(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected status 200, got %d", w.Code)
+	}
+
+	if !svc.sendCalled {
+		t.Error("expected SendDigest to be called")
+	}
+}
+
+func TestDigestHandler_SendDigest_MethodNotAllowed(t *testing.T) {
+	svc := &mockDigestService{}
+	h := NewDigestHandler(svc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/digest/send", nil)
+	w := httptest.NewRecorder()
+
+	h.SendDigest(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Errorf("expected status 405, got %d", w.Code)
+	}
+}
+
+func TestDigestHandler_SendDigest_ServiceError(t *testing.T) {
+	svc := &mockDigestService{
+		sendErr: errors.New("SMTP connection refused"),
+	}
+	h := NewDigestHandler(svc)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/digest/send", nil)
+	w := httptest.NewRecorder()
+
+	h.SendDigest(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("expected status 500, got %d", w.Code)
+	}
+}
+
+func TestDigestHandler_SendDigest_NotConfigured(t *testing.T) {
+	h := NewDigestHandler(nil)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/digest/send", nil)
+	w := httptest.NewRecorder()
+
+	h.SendDigest(w, req)
+
+	if w.Code != http.StatusServiceUnavailable {
+		t.Errorf("expected status 503, got %d", w.Code)
+	}
+}