Let's Encrypt certificates

Tools gives you access to the latest certificate bundles assigned to your account.

View your certificates

Open:

/letsencrypt

The page shows information such as:

the certificate's main name,
all included domains,
expiry date,
expected renewal date,
latest upload,
current status.

If a certificate is missing, an administrator needs to confirm that it has been imported and assigned to the correct owner.

Download the latest certificate

Use the download button for the certificate.

The ZIP bundle can contain:

cert.pem
chain.pem
fullchain.pem
privkey.pem
metadata.json

The bundle contains private key material. Store it securely and never place it in a public directory or public Git repository.

Automated download

For automated downloads you need:

the certificate UUID,
a fetch token,
the Tools base URL.

Create or rotate the token from the certificate view. The plaintext token is displayed only when it is created, so save it immediately in a secure location.

The endpoint format is:

https://tools.tornevall.net/api/letsencrypt/certificates/CERTIFICATE_UUID/latest

Send the token as a Bearer token.

curl --fail --location \
  --header "Authorization: Bearer CERTIFICATE_TOKEN" \
  "https://tools.tornevall.net/api/letsencrypt/certificates/CERTIFICATE_UUID/latest" \
  --output certificate-latest.zip

Shell sample

A ready-to-use sample is available at:

bin/letsencrypt/examples/fetch-latest-certificate.sh

Run it with:

chmod 750 bin/letsencrypt/examples/fetch-latest-certificate.sh

bin/letsencrypt/examples/fetch-latest-certificate.sh \
  "https://tools.tornevall.net" \
  "CERTIFICATE_UUID" \
  "CERTIFICATE_TOKEN" \
  "/etc/ssl/private/example-latest.zip"

Windows batch sample

The Windows sample is available at:

bin/letsencrypt/examples/fetch-latest-certificate.bat

Run it from Command Prompt:

bin\letsencrypt\examples\fetch-latest-certificate.bat ^
  "https://tools.tornevall.net" ^
  "CERTIFICATE_UUID" ^
  "CERTIFICATE_TOKEN" ^
  "C:\certificates\example-latest.zip"

The sample uses curl.exe, which is normally included with current Windows versions.

When the certificate is renewed

After a new certificate is published, it becomes the latest version in Tools. The same UUID and fetch token can continue to be used to retrieve the current certificate bundle. The owner of that certificate receives a successful-renewal email when the fingerprint changes.

If an older individual certificate is not renewed because its domains have been consolidated into other active certificate bundles, Tools does not send a missing-renewal warning while every exact DNS name from the old certificate remains covered. Wildcard names are matched exactly.

If the download fails

Check that:

the certificate is still enabled,
the UUID is correct,
the token has not been rotated,
the token is sent as a Bearer token,
the destination directory is writable,
the Tools site is reachable from the downloading machine.

An HTTP 401 normally means that the token is missing or incorrect. A 404 normally means that the certificate does not exist, is disabled, or the UUID is incorrect.

For administrators

Administrators use:

/admin/letsencrypt

There they can assign owners, enable or disable certificates, and create new fetch tokens.

Local certificate recovery

When Certbot and Tools share a filesystem, administrators can use the local scheduled reconciliation process to recover a missed certificate publication without issuing another certificate or sending an HTTP upload token. The existing Tornevall cron runs Laravel's scheduler, which checks local certificate fingerprints twice per hour before overdue-renewal alerts. On the Tools server, use php artisan letsencrypt:reconcile --dry-run to inspect mismatches, or php artisan letsencrypt:reconcile --certificate=LINEAGE to import one lineage. The command must run with restricted read access to Certbot's private material. The default source is /var/tornevall/system/etc/letsencrypt; installations using another path must pass --root. This is an operator CLI action, not an exposed browser button.

Tornevall Networks