devnomads-cli 0.7.0__tar.gz → 0.9.0__tar.gz

{devnomads_cli-0.7.0 → devnomads_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.7.0
+Version: 0.9.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -11,7 +11,7 @@ Requires-Dist: typer>=0.12
 Requires-Dist: httpx>=0.27
 Requires-Dist: rich>=13
 Requires-Dist: cryptography>=42
-Requires-Dist: devnomads[acme]>=0.2.5
+Requires-Dist: devnomads[acme]>=0.5.0
 Dynamic: license-file
 
 # dncli
@@ -148,11 +148,13 @@ dncli services list | jq -r '.[].entity'
 `dncli` issues Let's Encrypt certificates using the DNS-01 challenge:
 
 ```sh
-dncli cert issue example.com -d www.example.com -d "*.example.com"
+dncli certs issue example.com -d www.example.com --wildcard
 ```
 
 The first argument is the primary domain (the certificate CN); add
-extra names (SANs) by repeating `--san`/`-d`. Every name must live in
+extra names (SANs) by repeating `--san`/`-d`. `--wildcard`/`-w` is a
+shortcut that adds `*.<domain>` as a SAN - a wildcard is never
+accepted as the CN itself. Every name must live in
 one of your DevNomads DNS zones, and that zone must be delegated to the
 DevNomads nameservers (`one.dns.infrapod.nl`, `two.dns.infrapod.nl`,
 `three.dns.infrapod.eu`) - otherwise issuance is refused, since the
@@ -176,37 +178,41 @@ and `--eab-hmac-key` or the `DN_ZEROSSL_EAB_KID` and
 `DN_ZEROSSL_EAB_HMAC_KEY` environment variables:
 
 ```sh
-dncli cert issue example.com --provider zerossl \
+dncli certs issue example.com --provider zerossl \
   --eab-kid <kid> --eab-hmac-key <hmac>
 ```
 
 `--staging` (the Let's Encrypt staging CA) applies only to the
-letsencrypt provider. `cert renew` takes the same `--provider` and EAB
+letsencrypt provider. `certs renew` takes the same `--provider` and EAB
 options.
 
 Each CA gets its own ACME account: the key lives in
 `~/.config/dncli/acme/` as `account.pem` for Let's Encrypt production
 and `account-<provider>.pem` for ZeroSSL and the staging CA.
 
-Re-running `cert issue` is a no-op while the existing certificate is
+Re-running `certs issue` is a no-op while the existing certificate is
 still valid for more than 21 days; pass `--force` to re-issue anyway.
 
 List what you have issued and re-export any of them - as a PEM bundle
-or a PKCS#12 (`.pfx`) file - without re-issuing. `cert list` includes a
+or a PKCS#12 (`.pfx`) file - without re-issuing. `certs list` includes a
 `provider` column showing the issuing CA (recorded at issue time, or
 inferred from the certificate's issuer for older certificates):
 
 ```sh
-dncli cert list
-dncli cert export example.com --out bundle.pem    # omit --out to print
-dncli cert export example.com --format pfx --out bundle.pfx
-dncli cert export example.com --format pfx --out bundle.pfx --passphrase secret
+dncli certs list
+dncli certs export example.com --out bundle.pem    # omit --out to print
+dncli certs export example.com --format pfx --out bundle.pfx
+dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 `--password`). Both bundle formats carry the same three items: key,
 certificate, and the issuing intermediate.
 
+`dncli certs delete <domain>` removes a stored certificate and its
+private key from disk (after confirmation; `--yes` skips it). It only
+deletes the local files - the certificate itself is not revoked.
+
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 
 ```sh

{devnomads_cli-0.7.0 → devnomads_cli-0.9.0}/README.md

@@ -132,11 +132,13 @@ dncli services list | jq -r '.[].entity'
 `dncli` issues Let's Encrypt certificates using the DNS-01 challenge:
 
 ```sh
-dncli cert issue example.com -d www.example.com -d "*.example.com"
+dncli certs issue example.com -d www.example.com --wildcard
 ```
 
 The first argument is the primary domain (the certificate CN); add
-extra names (SANs) by repeating `--san`/`-d`. Every name must live in
+extra names (SANs) by repeating `--san`/`-d`. `--wildcard`/`-w` is a
+shortcut that adds `*.<domain>` as a SAN - a wildcard is never
+accepted as the CN itself. Every name must live in
 one of your DevNomads DNS zones, and that zone must be delegated to the
 DevNomads nameservers (`one.dns.infrapod.nl`, `two.dns.infrapod.nl`,
 `three.dns.infrapod.eu`) - otherwise issuance is refused, since the
@@ -160,37 +162,41 @@ and `--eab-hmac-key` or the `DN_ZEROSSL_EAB_KID` and
 `DN_ZEROSSL_EAB_HMAC_KEY` environment variables:
 
 ```sh
-dncli cert issue example.com --provider zerossl \
+dncli certs issue example.com --provider zerossl \
   --eab-kid <kid> --eab-hmac-key <hmac>
 ```
 
 `--staging` (the Let's Encrypt staging CA) applies only to the
-letsencrypt provider. `cert renew` takes the same `--provider` and EAB
+letsencrypt provider. `certs renew` takes the same `--provider` and EAB
 options.
 
 Each CA gets its own ACME account: the key lives in
 `~/.config/dncli/acme/` as `account.pem` for Let's Encrypt production
 and `account-<provider>.pem` for ZeroSSL and the staging CA.
 
-Re-running `cert issue` is a no-op while the existing certificate is
+Re-running `certs issue` is a no-op while the existing certificate is
 still valid for more than 21 days; pass `--force` to re-issue anyway.
 
 List what you have issued and re-export any of them - as a PEM bundle
-or a PKCS#12 (`.pfx`) file - without re-issuing. `cert list` includes a
+or a PKCS#12 (`.pfx`) file - without re-issuing. `certs list` includes a
 `provider` column showing the issuing CA (recorded at issue time, or
 inferred from the certificate's issuer for older certificates):
 
 ```sh
-dncli cert list
-dncli cert export example.com --out bundle.pem    # omit --out to print
-dncli cert export example.com --format pfx --out bundle.pfx
-dncli cert export example.com --format pfx --out bundle.pfx --passphrase secret
+dncli certs list
+dncli certs export example.com --out bundle.pem    # omit --out to print
+dncli certs export example.com --format pfx --out bundle.pfx
+dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 `--password`). Both bundle formats carry the same three items: key,
 certificate, and the issuing intermediate.
 
+`dncli certs delete <domain>` removes a stored certificate and its
+private key from disk (after confirmation; `--yes` skips it). It only
+deletes the local files - the certificate itself is not revoked.
+
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 
 ```sh

{devnomads_cli-0.7.0 → devnomads_cli-0.9.0}/devnomads_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.7.0
+Version: 0.9.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -11,7 +11,7 @@ Requires-Dist: typer>=0.12
 Requires-Dist: httpx>=0.27
 Requires-Dist: rich>=13
 Requires-Dist: cryptography>=42
-Requires-Dist: devnomads[acme]>=0.2.5
+Requires-Dist: devnomads[acme]>=0.5.0
 Dynamic: license-file
 
 # dncli
@@ -148,11 +148,13 @@ dncli services list | jq -r '.[].entity'
 `dncli` issues Let's Encrypt certificates using the DNS-01 challenge:
 
 ```sh
-dncli cert issue example.com -d www.example.com -d "*.example.com"
+dncli certs issue example.com -d www.example.com --wildcard
 ```
 
 The first argument is the primary domain (the certificate CN); add
-extra names (SANs) by repeating `--san`/`-d`. Every name must live in
+extra names (SANs) by repeating `--san`/`-d`. `--wildcard`/`-w` is a
+shortcut that adds `*.<domain>` as a SAN - a wildcard is never
+accepted as the CN itself. Every name must live in
 one of your DevNomads DNS zones, and that zone must be delegated to the
 DevNomads nameservers (`one.dns.infrapod.nl`, `two.dns.infrapod.nl`,
 `three.dns.infrapod.eu`) - otherwise issuance is refused, since the
@@ -176,37 +178,41 @@ and `--eab-hmac-key` or the `DN_ZEROSSL_EAB_KID` and
 `DN_ZEROSSL_EAB_HMAC_KEY` environment variables:
 
 ```sh
-dncli cert issue example.com --provider zerossl \
+dncli certs issue example.com --provider zerossl \
   --eab-kid <kid> --eab-hmac-key <hmac>
 ```
 
 `--staging` (the Let's Encrypt staging CA) applies only to the
-letsencrypt provider. `cert renew` takes the same `--provider` and EAB
+letsencrypt provider. `certs renew` takes the same `--provider` and EAB
 options.
 
 Each CA gets its own ACME account: the key lives in
 `~/.config/dncli/acme/` as `account.pem` for Let's Encrypt production
 and `account-<provider>.pem` for ZeroSSL and the staging CA.
 
-Re-running `cert issue` is a no-op while the existing certificate is
+Re-running `certs issue` is a no-op while the existing certificate is
 still valid for more than 21 days; pass `--force` to re-issue anyway.
 
 List what you have issued and re-export any of them - as a PEM bundle
-or a PKCS#12 (`.pfx`) file - without re-issuing. `cert list` includes a
+or a PKCS#12 (`.pfx`) file - without re-issuing. `certs list` includes a
 `provider` column showing the issuing CA (recorded at issue time, or
 inferred from the certificate's issuer for older certificates):
 
 ```sh
-dncli cert list
-dncli cert export example.com --out bundle.pem    # omit --out to print
-dncli cert export example.com --format pfx --out bundle.pfx
-dncli cert export example.com --format pfx --out bundle.pfx --passphrase secret
+dncli certs list
+dncli certs export example.com --out bundle.pem    # omit --out to print
+dncli certs export example.com --format pfx --out bundle.pfx
+dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 `--password`). Both bundle formats carry the same three items: key,
 certificate, and the issuing intermediate.
 
+`dncli certs delete <domain>` removes a stored certificate and its
+private key from disk (after confirmation; `--yes` skips it). It only
+deletes the local files - the certificate itself is not revoked.
+
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 
 ```sh

{devnomads_cli-0.7.0 → devnomads_cli-0.9.0}/devnomads_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12
 httpx>=0.27
 rich>=13
 cryptography>=42
-devnomads[acme]>=0.2.5
+devnomads[acme]>=0.5.0

{devnomads_cli-0.7.0 → devnomads_cli-0.9.0}/dncli.py

@@ -29,6 +29,7 @@ import logging
 import os
 import re
 import secrets
+import shutil
 import stat
 import sys
 import time
@@ -52,7 +53,7 @@ from rich.markup import escape
 from rich.table import Table
 from typer.core import TyperGroup
 
-__version__ = "0.7.0"
+__version__ = "0.9.0"
 
 # Distribution names, for reporting versions via `dncli version`.
 CLI_PACKAGE = "devnomads-cli"
@@ -1725,12 +1726,14 @@ def dns_hook(
 
 
 # ---------------------------------------------------------------------------
-# Certificate issuance (`dncli cert ...`), behind the `cert` extra.
+# Certificate issuance (`dncli certs ...`), behind the `cert` extra.
 
 cert_app = typer.Typer(
     cls=PrefixGroup, help="Issue and renew TLS certificates.", no_args_is_help=True
 )
-app.add_typer(cert_app, name="cert")
+# the singular `dncli cert ...` keeps working (hidden from help) because
+# PrefixGroup resolves it as a unique prefix of `certs`
+app.add_typer(cert_app, name="certs")
 
 CERT_RENEW_WINDOW_DAYS = 30
 # `cert issue` skips a domain whose current certificate is still valid for
@@ -1785,6 +1788,18 @@ class KeyType(str, Enum):
     rsa4096 = "rsa4096"
 
 
+class PreferredChain(str, Enum):
+    """Terminating root to pin the served certificate chain to (Let's Encrypt).
+
+    This only selects which offered chain is served, not the certificate
+    itself. `ISRG Root X1` gives the broadest compatibility with older clients;
+    the ECDSA-only `ISRG Root X2` chain is smaller but needs a post-2022 trust
+    store. Left unset, the CA's default chain is used unchanged."""
+
+    isrg_root_x1 = "ISRG Root X1"
+    isrg_root_x2 = "ISRG Root X2"
+
+
 class ExportFormat(str, Enum):
     """Bundle formats for `cert export`."""
 
@@ -1799,6 +1814,18 @@ ProviderOption = Annotated[
         help="ACME certificate authority: letsencrypt (default) or zerossl.",
     ),
 ]
+PreferredChainOption = Annotated[
+    PreferredChain | None,
+    typer.Option(
+        "--preferred-chain",
+        help=(
+            "Pin the served chain to this terminating root (Let's Encrypt): "
+            "'ISRG Root X1' for the broadest old-client compatibility, or "
+            "'ISRG Root X2' for the smaller ECDSA-only chain. Unset keeps the "
+            "CA default."
+        ),
+    ),
+]
 EabKidOption = Annotated[
     str | None,
     typer.Option(
@@ -2022,6 +2049,22 @@ def _cert_provider(cert_path: Path, cert: Any) -> str:
     return _provider_from_cert(cert)
 
 
+def _cert_sans(cert_path: Path) -> list[str]:
+    """DNS SANs of the stored leaf at ``cert_path`` ([] if unreadable)."""
+
+    from cryptography import x509
+
+    try:
+        cert = x509.load_pem_x509_certificate(cert_path.read_bytes())
+        return list(
+            cert.extensions.get_extension_for_class(
+                x509.SubjectAlternativeName
+            ).value.get_values_for_type(x509.DNSName)
+        )
+    except (OSError, ValueError, x509.ExtensionNotFound):
+        return []
+
+
 def _cert_info(cert_path: Path) -> dict[str, Any]:
     """Summarize a stored leaf certificate for `cert list`."""
 
@@ -2069,6 +2112,7 @@ def _issue_certificate(
     provider: str = CertProvider.letsencrypt.value,
     eab_kid: str | None = None,
     eab_hmac_key: str | None = None,
+    preferred_chain: str | None = None,
     out_dir: Path,
     export_path: Path | None = None,
     verbose: bool = False,
@@ -2076,6 +2120,13 @@ def _issue_certificate(
     """Obtain a DNS-01 certificate for ``domain`` and write it to ``out_dir``;
     optionally also export a single combined PEM to ``export_path``."""
 
+    if domain.startswith("*."):
+        base = domain[2:]
+        raise CliError(
+            f"a wildcard cannot be the certificate common name; issue for the "
+            f"base domain with the wildcard as a SAN: "
+            f"dncli certs issue {base} --wildcard"
+        )
     acme = _load_acme()
     _enable_progress_logging(verbose)
 
@@ -2085,6 +2136,8 @@ def _issue_certificate(
 
     provider_name = provider
     client_kwargs: dict[str, Any] = {"contact_email": email}
+    if preferred_chain:
+        client_kwargs["preferred_chain"] = preferred_chain
     if staging:
         if provider != CertProvider.letsencrypt.value:
             raise CliError("--staging only applies to the letsencrypt provider")
@@ -2150,11 +2203,24 @@ def _issue_certificate(
 @cert_app.command("issue")
 def cert_issue(
     ctx: typer.Context,
-    domain: Annotated[str, typer.Argument(help="Primary domain (certificate CN).")],
+    domain: Annotated[
+        str,
+        typer.Argument(
+            help="Primary domain (certificate CN); use --wildcard for *.<domain>."
+        ),
+    ],
     san: Annotated[
         list[str] | None,
         typer.Option("--san", "-d", help="Additional SAN; repeat for more."),
     ] = None,
+    wildcard: Annotated[
+        bool,
+        typer.Option(
+            "--wildcard",
+            "-w",
+            help="Also request *.<domain> as a SAN (shortcut for --san '*.<domain>').",
+        ),
+    ] = False,
     email: Annotated[
         str | None, typer.Option("--email", help="ACME account contact email.")
     ] = None,
@@ -2172,6 +2238,7 @@ def cert_issue(
     provider: ProviderOption = CertProvider.letsencrypt,
     eab_kid: EabKidOption = None,
     eab_hmac_key: EabHmacKeyOption = None,
+    preferred_chain: PreferredChainOption = None,
     force: Annotated[
         bool,
         typer.Option(
@@ -2197,6 +2264,9 @@ def cert_issue(
     default, or ZeroSSL with --provider zerossl)."""
 
     state = state_from(ctx)
+    sans = list(san or [])
+    if wildcard and f"*.{domain}" not in sans:
+        sans.append(f"*.{domain}")
     out_dir = _cert_dir(domain)
     cert_path = out_dir / "cert.pem"
     if (
@@ -2212,12 +2282,13 @@ def cert_issue(
     _issue_certificate(
         state,
         domain,
-        sans=list(san or []),
+        sans=sans,
         email=email,
         key_type=key_type.value,
         provider=provider.value,
         eab_kid=eab_kid,
         eab_hmac_key=eab_hmac_key,
+        preferred_chain=preferred_chain.value if preferred_chain else None,
         staging=staging,
         out_dir=out_dir,
         export_path=out,
@@ -2268,6 +2339,7 @@ def cert_renew(
     provider: ProviderOption = CertProvider.letsencrypt,
     eab_kid: EabKidOption = None,
     eab_hmac_key: EabHmacKeyOption = None,
+    preferred_chain: PreferredChainOption = None,
     verbose: Annotated[
         bool,
         typer.Option("--verbose", "-v", help="Show detailed ACME progress."),
@@ -2295,13 +2367,14 @@ def cert_renew(
         _issue_certificate(
             state,
             name,
-            sans=[],
+            sans=[s for s in _cert_sans(cert_path) if s != name],
             email=email,
             key_type=key_type.value,
             staging=staging,
             provider=provider.value,
             eab_kid=eab_kid,
             eab_hmac_key=eab_hmac_key,
+            preferred_chain=preferred_chain.value if preferred_chain else None,
             out_dir=out_dir,
             verbose=verbose,
         )
@@ -2377,7 +2450,7 @@ def cert_export(
     if not (privkey.is_file() and leaf.is_file()):
         raise CliError(
             f"no certificate for {domain} in {cert_dir}; "
-            "issue one with `dncli cert issue`"
+            "issue one with `dncli certs issue`"
         )
     key_text = privkey.read_text()
     leaf_text = leaf.read_text()
@@ -2406,6 +2479,28 @@ def cert_export(
         sys.stdout.write(_combined_pem(key_text, leaf_text, chain_text))
 
 
+@cert_app.command("delete")
+def cert_delete(
+    domain: Annotated[
+        str, typer.Argument(help="Domain of a previously issued certificate.")
+    ],
+    yes: Annotated[
+        bool, typer.Option("--yes", "-y", help="Do not ask for confirmation.")
+    ] = False,
+) -> None:
+    """Delete a stored certificate and its private key from this machine.
+
+    This only removes the local files; the certificate itself is not revoked.
+    """
+
+    cert_dir = _cert_dir(domain)
+    if not cert_dir.is_dir():
+        raise CliError(f"no certificate for {domain} in {cert_dir}")
+    _confirm(f"Delete the certificate and private key for {domain}?", yes)
+    shutil.rmtree(cert_dir)
+    err_console.print(f"deleted {cert_dir}")
+
+
 # ---------------------------------------------------------------------------
 # Generated commands. tools/generate.py renders one thin command per
 # OpenAPI operation between the markers below, from openapi.json plus

{devnomads_cli-0.7.0 → devnomads_cli-0.9.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devnomads-cli"
-version = "0.7.0"
+version = "0.9.0"
 description = "Manage your DevNomads services from the command line"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -11,7 +11,7 @@ dependencies = [
     "httpx>=0.27",
     "rich>=13",
     "cryptography>=42",
-    "devnomads[acme]>=0.2.5",
+    "devnomads[acme]>=0.5.0",
 ]
 
 [project.scripts]

{devnomads_cli-0.7.0 → devnomads_cli-0.9.0}/tests/test_cert.py

@@ -49,7 +49,7 @@ def captured(monkeypatch):
     return calls
 
 
-def _write_cert(cert_dir, *, days, with_key_chain=False):
+def _write_cert(cert_dir, *, days, with_key_chain=False, sans=("example.com",)):
     """Write a self-signed leaf (and optionally key+chain) into ``cert_dir``,
     valid until ``days`` from now."""
 
@@ -72,7 +72,8 @@ def _write_cert(cert_dir, *, days, with_key_chain=False):
         .not_valid_before(now - datetime.timedelta(days=1))
         .not_valid_after(now + datetime.timedelta(days=days))
         .add_extension(
-            x509.SubjectAlternativeName([x509.DNSName("example.com")]), critical=False
+            x509.SubjectAlternativeName([x509.DNSName(s) for s in sans]),
+            critical=False,
         )
         .sign(key, hashes.SHA256())
     )
@@ -90,10 +91,28 @@ def _write_cert(cert_dir, *, days, with_key_chain=False):
     return cert
 
 
-def test_issue_dns01_default_uses_dns_provider(configured, captured, isolated_config):
+def test_cert_singular_resolves_to_certs(configured, captured, isolated_config):
+    # `certs` is the registered name; the singular works as a unique prefix,
+    # so this fails if another top-level command starting with `cert` appears
     result = runner.invoke(app, ["cert", "issue", "example.com"])
     assert result.exit_code == 0, result.output
     assert captured["challenge"] == "dns-01"
+
+
+def test_certs_is_the_advertised_name():
+    import re
+
+    result = runner.invoke(app, ["--help"])
+    assert result.exit_code == 0, result.output
+    assert "certs" in result.output
+    # the singular alias must not be listed as a command of its own
+    assert not re.search(r"^\s*│?\s*cert\s", result.output, re.MULTILINE)
+
+
+def test_issue_dns01_default_uses_dns_provider(configured, captured, isolated_config):
+    result = runner.invoke(app, ["certs", "issue", "example.com"])
+    assert result.exit_code == 0, result.output
+    assert captured["challenge"] == "dns-01"
     assert captured["kwargs"]["dns_provider"] is not None
     out_dir = dncli.config_dir() / "certs" / "example.com"
     assert (out_dir / "cert.pem").read_text() == LEAF
@@ -119,7 +138,7 @@ def test_issue_default_key_type_is_ecdsa384(
 ):
     seen = {}
     _spy_generate_key(monkeypatch, seen)
-    result = runner.invoke(app, ["cert", "issue", "example.com"])
+    result = runner.invoke(app, ["certs", "issue", "example.com"])
     assert result.exit_code == 0, result.output
     assert seen["algo"] == "ecdsa384"
 
@@ -128,7 +147,7 @@ def test_issue_key_type_ecdsa521(configured, captured, isolated_config, monkeypa
     seen = {}
     _spy_generate_key(monkeypatch, seen)
     result = runner.invoke(
-        app, ["cert", "issue", "example.com", "--key-type", "ecdsa521"]
+        app, ["certs", "issue", "example.com", "--key-type", "ecdsa521"]
     )
     assert result.exit_code == 0, result.output
     assert seen["algo"] == "ecdsa521"
@@ -140,7 +159,7 @@ def test_issue_key_type_is_selectable(
     seen = {}
     _spy_generate_key(monkeypatch, seen)
     result = runner.invoke(
-        app, ["cert", "issue", "example.com", "--key-type", "rsa4096"]
+        app, ["certs", "issue", "example.com", "--key-type", "rsa4096"]
     )
     assert result.exit_code == 0, result.output
     assert seen["algo"] == "rsa4096"
@@ -148,14 +167,14 @@ def test_issue_key_type_is_selectable(
 
 def test_issue_rejects_unknown_key_type():
     result = runner.invoke(
-        app, ["cert", "issue", "example.com", "--key-type", "ed25519"]
+        app, ["certs", "issue", "example.com", "--key-type", "ed25519"]
     )
     assert result.exit_code != 0
     assert "ed25519" in result.output
 
 
 def test_issue_is_always_dns01(configured, captured, isolated_config):
-    result = runner.invoke(app, ["cert", "issue", "example.com"])
+    result = runner.invoke(app, ["certs", "issue", "example.com"])
     assert result.exit_code == 0, result.output
     assert captured["challenge"] == "dns-01"
     assert captured["kwargs"]["dns_provider"] is not None
@@ -164,7 +183,7 @@ def test_issue_is_always_dns01(configured, captured, isolated_config):
 def test_issue_rejects_http01_options(configured, isolated_config):
     # HTTP-01 was removed; these flags must no longer be accepted.
     for flag in (["--http-01"], ["--standalone"], ["--webroot", "/tmp/x"]):
-        result = runner.invoke(app, ["cert", "issue", "example.com", *flag])
+        result = runner.invoke(app, ["certs", "issue", "example.com", *flag])
         assert result.exit_code != 0, f"{flag} should be rejected: {result.output}"
 
 
@@ -172,7 +191,7 @@ def test_issue_passes_sans(configured, captured, isolated_config):
     result = runner.invoke(
         app,
         [
-            "cert",
+            "certs",
             "issue",
             "example.com",
             "-d",
@@ -185,10 +204,52 @@ def test_issue_passes_sans(configured, captured, isolated_config):
     assert captured["kwargs"]["sans"] == ["www.example.com", "a.example.com"]
 
 
+def test_issue_rejects_wildcard_cn(configured, captured, isolated_config):
+    result = runner.invoke(app, ["certs", "issue", "*.example.com"])
+    assert result.exit_code != 0
+    assert "certs issue example.com --wildcard" in result.output
+    assert "challenge" not in captured  # obtain_certificate was not called
+
+
+def test_issue_accepts_wildcard_as_san(configured, captured, isolated_config):
+    result = runner.invoke(
+        app, ["certs", "issue", "example.com", "--san", "*.example.com"]
+    )
+    assert result.exit_code == 0, result.output
+    assert captured["domain"] == "example.com"
+    assert captured["kwargs"]["sans"] == ["*.example.com"]
+
+
+def test_issue_wildcard_flag_adds_san(configured, captured, isolated_config):
+    result = runner.invoke(app, ["certs", "issue", "example.com", "--wildcard"])
+    assert result.exit_code == 0, result.output
+    assert captured["domain"] == "example.com"
+    assert captured["kwargs"]["sans"] == ["*.example.com"]
+
+
+def test_issue_wildcard_flag_dedupes_explicit_san(
+    configured, captured, isolated_config
+):
+    result = runner.invoke(
+        app,
+        ["certs", "issue", "example.com", "--wildcard", "--san", "*.example.com"],
+    )
+    assert result.exit_code == 0, result.output
+    assert captured["kwargs"]["sans"] == ["*.example.com"]
+
+
+def test_issue_wildcard_flag_composes_with_sans(configured, captured, isolated_config):
+    result = runner.invoke(
+        app, ["certs", "issue", "example.com", "-w", "-d", "www.example.com"]
+    )
+    assert result.exit_code == 0, result.output
+    assert captured["kwargs"]["sans"] == ["www.example.com", "*.example.com"]
+
+
 def test_issue_staging_switches_directory(configured, captured, isolated_config):
     import devnomads.acme as acme
 
-    result = runner.invoke(app, ["cert", "issue", "example.com", "--staging"])
+    result = runner.invoke(app, ["certs", "issue", "example.com", "--staging"])
     assert result.exit_code == 0, result.output
     assert captured["directory_url"] == acme.LETSENCRYPT_STAGING_DIRECTORY_URL
 
@@ -196,7 +257,7 @@ def test_issue_staging_switches_directory(configured, captured, isolated_config)
 def test_issue_defaults_to_letsencrypt(configured, captured, isolated_config):
     import devnomads.acme as acme
 
-    result = runner.invoke(app, ["cert", "issue", "example.com"])
+    result = runner.invoke(app, ["certs", "issue", "example.com"])
     assert result.exit_code == 0, result.output
     assert captured["directory_url"] == acme.LETSENCRYPT_DIRECTORY_URL
     # Let's Encrypt keeps the original account key path for back-compat
@@ -224,7 +285,7 @@ def test_issue_zerossl_uses_directory_and_eab(configured, captured, isolated_con
     result = runner.invoke(
         app,
         [
-            "cert",
+            "certs",
             "issue",
             "example.com",
             "--provider",
@@ -251,7 +312,7 @@ def test_issue_zerossl_reads_eab_from_env(
     monkeypatch.setenv(dncli.ENV_EAB_KID, "kid-env")
     monkeypatch.setenv(dncli.ENV_EAB_HMAC_KEY, "hmac-env")
     result = runner.invoke(
-        app, ["cert", "issue", "example.com", "--provider", "zerossl"]
+        app, ["certs", "issue", "example.com", "--provider", "zerossl"]
     )
     assert result.exit_code == 0, result.output
     assert captured["directory_url"] == acme.ZEROSSL_DIRECTORY_URL
@@ -259,7 +320,7 @@ def test_issue_zerossl_reads_eab_from_env(
 
 def test_issue_zerossl_without_eab_errors(configured, captured, isolated_config):
     result = runner.invoke(
-        app, ["cert", "issue", "example.com", "--provider", "zerossl"]
+        app, ["certs", "issue", "example.com", "--provider", "zerossl"]
     )
     assert result.exit_code == 1
     assert "external account binding" in result.output
@@ -269,7 +330,7 @@ def test_issue_zerossl_without_eab_errors(configured, captured, isolated_config)
 def test_issue_zerossl_with_staging_errors(configured, captured, isolated_config):
     result = runner.invoke(
         app,
-        ["cert", "issue", "example.com", "--provider", "zerossl", "--staging"],
+        ["certs", "issue", "example.com", "--provider", "zerossl", "--staging"],
     )
     assert result.exit_code == 1
     assert "--staging only applies to the letsencrypt provider" in result.output
@@ -279,7 +340,7 @@ def test_issue_out_exports_combined_pem(
     configured, captured, isolated_config, tmp_path
 ):
     out = tmp_path / "bundle.pem"
-    result = runner.invoke(app, ["cert", "issue", "example.com", "--out", str(out)])
+    result = runner.invoke(app, ["certs", "issue", "example.com", "--out", str(out)])
     assert result.exit_code == 0, result.output
     # the default per-domain dir is still written (with the full chain)...
     default_dir = dncli.config_dir() / "certs" / "example.com"
@@ -371,7 +432,7 @@ def test_load_acme_import_error_message(monkeypatch):
         return real_import(name, *args, **kwargs)
 
     monkeypatch.setattr(builtins, "__import__", fake_import)
-    result = runner.invoke(app, ["cert", "issue", "example.com"])
+    result = runner.invoke(app, ["certs", "issue", "example.com"])
     assert result.exit_code == 1
     assert "devnomads.acme" in result.output
 
@@ -405,7 +466,7 @@ def test_renew_skips_valid_cert(configured, captured, isolated_config):
     out_dir.mkdir(parents=True)
     (out_dir / "cert.pem").write_bytes(cert.public_bytes(serialization.Encoding.PEM))
 
-    result = runner.invoke(app, ["cert", "renew", "example.com"])
+    result = runner.invoke(app, ["certs", "renew", "example.com"])
     assert result.exit_code == 0, result.output
     assert "still valid" in result.output
     assert "challenge" not in captured  # obtain_certificate was not called
@@ -439,15 +500,38 @@ def test_renew_reissues_expiring_cert(configured, captured, isolated_config):
     out_dir.mkdir(parents=True)
     (out_dir / "cert.pem").write_bytes(cert.public_bytes(serialization.Encoding.PEM))
 
-    result = runner.invoke(app, ["cert", "renew", "example.com"])
+    result = runner.invoke(app, ["certs", "renew", "example.com"])
     assert result.exit_code == 0, result.output
     assert captured["challenge"] == "dns-01"
     assert (out_dir / "fullchain.pem").read_text() == FULLCHAIN
 
 
+def test_renew_preserves_sans(configured, captured, isolated_config):
+    _write_cert(
+        dncli.config_dir() / "certs" / "example.com",
+        days=5,
+        sans=("example.com", "*.example.com", "www.example.com"),
+    )
+    result = runner.invoke(app, ["certs", "renew", "example.com"])
+    assert result.exit_code == 0, result.output
+    assert captured["kwargs"]["sans"] == ["*.example.com", "www.example.com"]
+
+
+def test_renew_rejects_wildcard_cn(configured, captured, isolated_config):
+    # a legacy cert dir issued with a wildcard CN must not renew as-is
+    _write_cert(
+        dncli.config_dir() / "certs" / "*.example.com",
+        days=5,
+        sans=("*.example.com",),
+    )
+    result = runner.invoke(app, ["certs", "renew", "*.example.com"])
+    assert result.exit_code != 0
+    assert "challenge" not in captured  # obtain_certificate was not called
+
+
 def test_issue_skips_when_valid_beyond_window(configured, captured, isolated_config):
     _write_cert(dncli.config_dir() / "certs" / "example.com", days=60)
-    result = runner.invoke(app, ["cert", "issue", "example.com"])
+    result = runner.invoke(app, ["certs", "issue", "example.com"])
     assert result.exit_code == 0, result.output
     assert "still valid" in result.output
     assert "challenge" not in captured  # obtain_certificate was not called
@@ -455,14 +539,14 @@ def test_issue_skips_when_valid_beyond_window(configured, captured, isolated_con
 
 def test_issue_force_reissues_valid_cert(configured, captured, isolated_config):
     _write_cert(dncli.config_dir() / "certs" / "example.com", days=60)
-    result = runner.invoke(app, ["cert", "issue", "example.com", "--force"])
+    result = runner.invoke(app, ["certs", "issue", "example.com", "--force"])
     assert result.exit_code == 0, result.output
     assert captured["challenge"] == "dns-01"
 
 
 def test_issue_reissues_when_within_window(configured, captured, isolated_config):
     _write_cert(dncli.config_dir() / "certs" / "example.com", days=10)
-    result = runner.invoke(app, ["cert", "issue", "example.com"])
+    result = runner.invoke(app, ["certs", "issue", "example.com"])
     assert result.exit_code == 0, result.output
     assert captured["challenge"] == "dns-01"
 
@@ -471,7 +555,7 @@ def test_cert_list_shows_issued(configured, isolated_config):
     import json
 
     _write_cert(dncli.config_dir() / "certs" / "example.com", days=45)
-    result = runner.invoke(app, ["cert", "list", "--out", "json"])
+    result = runner.invoke(app, ["certs", "list", "--out", "json"])
     assert result.exit_code == 0, result.output
     rows = json.loads(result.output)
     assert rows[0]["domain"] == "example.com"
@@ -486,7 +570,7 @@ def test_cert_list_shows_recorded_provider(configured, isolated_config):
     cert_dir = dncli.config_dir() / "certs" / "example.com"
     _write_cert(cert_dir, days=45)
     (cert_dir / "provider").write_text("zerossl\n")
-    result = runner.invoke(app, ["cert", "list", "--out", "json"])
+    result = runner.invoke(app, ["certs", "list", "--out", "json"])
     assert result.exit_code == 0, result.output
     assert json.loads(result.output)[0]["provider"] == "zerossl"
 
@@ -523,7 +607,7 @@ def test_provider_inferred_from_issuer_when_unrecorded():
 
 
 def test_cert_list_empty(isolated_config):
-    result = runner.invoke(app, ["cert", "list"])
+    result = runner.invoke(app, ["certs", "list"])
     assert result.exit_code == 0, result.output
     assert "no certificates" in result.output
 
@@ -533,7 +617,7 @@ def test_cert_export_to_file(configured, isolated_config, tmp_path):
         dncli.config_dir() / "certs" / "example.com", days=30, with_key_chain=True
     )
     out = tmp_path / "bundle.pem"
-    result = runner.invoke(app, ["cert", "export", "example.com", "--out", str(out)])
+    result = runner.invoke(app, ["certs", "export", "example.com", "--out", str(out)])
     assert result.exit_code == 0, result.output
     text = out.read_text()
     # order: private key, then leaf certificate, then the one intermediate
@@ -548,7 +632,7 @@ def test_cert_export_to_stdout(configured, isolated_config):
     _write_cert(
         dncli.config_dir() / "certs" / "example.com", days=30, with_key_chain=True
     )
-    result = runner.invoke(app, ["cert", "export", "example.com"])
+    result = runner.invoke(app, ["certs", "export", "example.com"])
     assert result.exit_code == 0, result.output
     assert "BEGIN CERTIFICATE" in result.stdout
     assert "INTER" in result.stdout
@@ -556,7 +640,7 @@ def test_cert_export_to_stdout(configured, isolated_config):
 
 
 def test_cert_export_missing(isolated_config):
-    result = runner.invoke(app, ["cert", "export", "nope.com"])
+    result = runner.invoke(app, ["certs", "export", "nope.com"])
     assert result.exit_code != 0
     assert "no certificate" in result.output
 
@@ -568,7 +652,7 @@ def test_cert_export_passphrase_rejected_for_pem(configured, isolated_config, tm
     result = runner.invoke(
         app,
         [
-            "cert",
+            "certs",
             "export",
             "example.com",
             "--passphrase",
@@ -633,7 +717,7 @@ def test_cert_export_pfx_no_passphrase(configured, isolated_config, tmp_path):
     leaf, inter, root = _write_real_chain(dncli.config_dir() / "certs" / "example.com")
     out = tmp_path / "bundle.pfx"
     result = runner.invoke(
-        app, ["cert", "export", "example.com", "--format", "pfx", "--out", str(out)]
+        app, ["certs", "export", "example.com", "--format", "pfx", "--out", str(out)]
     )
     assert result.exit_code == 0, result.output
     key, cert, cas = pkcs12.load_key_and_certificates(out.read_bytes(), None)
@@ -652,7 +736,7 @@ def test_cert_export_pfx_with_passphrase(configured, isolated_config, tmp_path):
     result = runner.invoke(
         app,
         [
-            "cert",
+            "certs",
             "export",
             "example.com",
             "--format",
@@ -672,6 +756,30 @@ def test_cert_export_pfx_with_passphrase(configured, isolated_config, tmp_path):
 
 def test_cert_export_pfx_requires_out(configured, isolated_config):
     _write_real_chain(dncli.config_dir() / "certs" / "example.com")
-    result = runner.invoke(app, ["cert", "export", "example.com", "--format", "pfx"])
+    result = runner.invoke(app, ["certs", "export", "example.com", "--format", "pfx"])
     assert result.exit_code != 0
     assert "out" in result.output.lower()
+
+
+def test_cert_delete_removes_stored_cert(isolated_config):
+    cert_dir = dncli.config_dir() / "certs" / "example.com"
+    _write_cert(cert_dir, days=45, with_key_chain=True)
+    result = runner.invoke(app, ["certs", "delete", "example.com", "--yes"])
+    assert result.exit_code == 0, result.output
+    assert not cert_dir.exists()
+
+
+def test_cert_delete_missing(isolated_config):
+    result = runner.invoke(app, ["certs", "delete", "example.com", "--yes"])
+    assert result.exit_code != 0
+    assert "no certificate for example.com" in result.output
+
+
+def test_cert_delete_requires_confirmation(isolated_config):
+    # without --yes and without a TTY the command must refuse and keep the files
+    cert_dir = dncli.config_dir() / "certs" / "example.com"
+    _write_cert(cert_dir, days=45, with_key_chain=True)
+    result = runner.invoke(app, ["certs", "delete", "example.com"])
+    assert result.exit_code != 0
+    assert "confirmation required" in result.output
+    assert (cert_dir / "privkey.pem").is_file()