pure-certd(8)

💅 pure-certd(8) — the Pure-FTPd manual, but make it make sense 🎀

okay so bestie, you're reading the pure-certd(8) page from Pure-FTPd, and honestly? It's giving "quiet little daemon that does one job extremely well." Let's get into it. ✨

---

🌸 NAME 🌸

pure-certd — the TLS certificate agent for Pure-FTPd. That's it, that's the whole personality. 👑

---

🦋 SYNTAX 🦋

pure-certd [-p </path/to/pidfile>] [-u uid] [-g gid] [-B] <-s
/path/to/socket> -r /program/to/run

(yes, -p really does show up in the synopsis, and yes, we'll get to the options list later where it is not hanging out. Not me noticing things 🙈 — it's in the syntax, so it's here, periodt.)

---

💖 DESCRIPTION 💖

okay so here's the whole vibe: pure-certd is a daemon that forks an authentication program, waits for a certificate path to come back as the reply, and then hands that path over to an application server. Like a little certificate delivery service. iconic. 🚚✨

pure-certd listens to a local Unix socket. When a new connection hits that socket, it should send pure-authd the following structure — ngl, that's literally what the page says, pure-authd, and we are not editorializing:

sni_name:xxx end

That content gets passed to the authentication program as an environment variable:

CERTD_SNI_NAME

Then the authentication program should do its little thing to pick out a TLS certificate, and reply on standard output in this format:

action:strict cert_file:/path/to/cert.pem
key_file:/path/to/cert.pem end

and here's the field-by-field breakdown, no skips, we're thorough like that 💅

• cert_file:xxx — the absolute path to the certificate, PEM format. absolute. path. write it down. 🎀
• key_file:xxx — optional! because a certificate and its key can just be concatenated into the same file. cozy.
• action:xxx — okay so this one's got lore:
  • if action is "deny", a certificate for that name was not found and access is denied.
  • if xxx is "default", the default certificate gets used.
  • if xxx is "strict", the certificate whose path is indicated in "cert_path" gets used. If it's absent or invalid, access will be denied. 🔥 no vibes, just denial.
  • if xxx is "fallback", the certificate whose path is indicated in "cert_path" gets used. If it's absent or invalid, the default certificate gets used instead. graceful king behavior.
• uid:xxx — the system uid to be assigned to that user. must be > 0. 🚫 zero.
• gid:xxx — the primary system gid. must be > 0. same energy.
• dir:xxx — the absolute path to the home directory. can contain /./ for a chroot jail. fancy. 🧚

and the big caveat, bestie, read it twice:

Only one authentication program is forked at a time. It must return quickly. ⏰

fr fr — one at a time, and it's gotta be fast. no main character monologue in that program, just get in, answer, get out.

---

✨ OPTIONS ✨

• -u <uid> — have the daemon run with that uid.
• -g <gid> — have the daemon run with that gid.
• -B — fork in background (daemonization). classic.
• -s </path/to/socket> — set the full path to the local Unix socket.
• -r </path/to/program> — set the full path to the authentication program.
• -h — output help information and exit. the polite escape hatch. 🫶

---

🌈 EXAMPLES 🌈

to run this program the standard way, type:

pure-certd -s /var/run/certd.sock -r /usr/bin/my-cert-program &

pure-ftpd -lextcert:/var/run/certd.sock &

and /usr/bin/my-cert-program can be as simple as — seriously, this simple:

#! /bin/sh

echo 'action:strict'

echo 'cert_file:/etc/ssl/private/pure-ftpd/cert.pem'

echo 'end'

look at that little script go. ate and left no crumbs. 🍓

---

👑 AUTHORS 👑

Frank DENIS <j at pureftpd dot org> — the icon, the legend. 💜

---

⭐ SEE ALSO ⭐

ftp(1), pure-ftpd(8) pure-ftpwho(8) pure-mrtginfo(8) pure-uploadscript(8) pure-statsdecode(8) pure-pw(8) pure-quotacheck(8) pure-authd(8)

---

💌 and that's the page, bestie — compiled by Frank Denis, version 1.0.54, pure-certd(8). go forth and serve those certs. 🦋✨