The Certificates facade

RoundlyConsulting\Certificates\Facades\Certificates is the recommended entry point. Its root is CertificatesManager, a container singleton, and every state-changing method runs through an action — so the facade, an injected manager and Certificates::fake() all see the same calls. A tour of the surface:

use RoundlyConsulting\Certificates\DataTransferObjects\IssueCertificateData;
use RoundlyConsulting\Certificates\Facades\Certificates;

// Issue
Certificates::issueIfMissing('app.example.com');
Certificates::issue(IssueCertificateData::make('app.example.com'));

// Lifecycle — a registry Certificate or a domain (its most recent row)
Certificates::renew('app.example.com');
Certificates::renewLater('app.example.com');
Certificates::revoke($certificate, 'key compromise');
Certificates::expire('app.example.com');

// The whole registry
Certificates::expiring(14);            // Collection<int, Certificate>, soonest first
Certificates::renewDue();              // RenewalReport
Certificates::sync('kubernetes');      // int rows written
Certificates::prune(30);               // int rows soft-deleted

// One domain — fluent issuance, reads and the same lifecycle verbs
Certificates::for('app.example.com')->using('acme')->issue();
Certificates::for('app.example.com')->renew();

// Reads, drivers and scoping
Certificates::find('app.example.com');
Certificates::statusReport('app.example.com', fresh: true);
Certificates::driver('acme');
Certificates::extend('vault', fn () => new VaultCertificateProvider());
Certificates::on('tenant')->renewDue();

Issuance and lifecycle

Every lifecycle verb takes a registry Certificate or a domain, which resolves to its most recent row on the bound connection — matched as the primary domain exactly, so a host that is only a SAN of another certificate is not found. An unknown domain, or a status that cannot make the move (renewing a revoked certificate, say), throws CertificateException — renewLater() included: it checks the status before it queues anything:

The domain handle, reads and drivers

Certificates::for($domain) is a handle for one domain (or a SAN set led by its first domain): fluent issuance, reads, and renew(), renewLater(), revoke() and expire() on that domain’s row — see Fluent builder. With using($driver) it only ever touches that driver’s row.

The facade also exposes the fake-only seed(), failRenewalOf() and every assert* method once Certificates::fake() is active (see Testing). The manager is macroable, so your own methods show up on the facade too (see Extending).