PHPackages blendbyte/coyotecert-laravel - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [HTTP & Networking](/categories/http) 4. / 5. blendbyte/coyotecert-laravel ActiveLibrary[HTTP & Networking](/categories/http) blendbyte/coyotecert-laravel ============================ First-party Laravel integration for CoyoteCert. HTTP-01 challenge via cache, Artisan commands, events, queue jobs, and scheduled renewal. v1.0.0(3mo ago)030MITPHPPHP ^8.3CI passing Since Apr 19Pushed 3mo agoCompare [ Source](https://github.com/blendbyte/coyotecert-laravel)[ Packagist](https://packagist.org/packages/blendbyte/coyotecert-laravel)[ RSS](/packages/blendbyte-coyotecert-laravel/feed)WikiDiscussions main Synced 1w ago READMEChangelog (2)Dependencies (10)Versions (3)Used By (0) [![coyotecert-banner-2560x1706](https://private-user-images.githubusercontent.com/4669888/579629738-d5510075-b62c-462f-a941-1d31b48bbec3.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODQzNTI3NTYsIm5iZiI6MTc4NDM1MjQ1NiwicGF0aCI6Ii80NjY5ODg4LzU3OTYyOTczOC1kNTUxMDA3NS1iNjJjLTQ2MmYtYTk0MS0xZDMxYjQ4YmJlYzMucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI2MDcxOCUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNjA3MThUMDUyNzM2WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9Zjg1MTdlZTFkYWZjM2Y4NmE3MWNhYjJlYjQ5NmRhY2MxMjdkMTBmOTUxNTBjNDk5ZjljYzZkZjBhZjhkMThkOCZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmcmVzcG9uc2UtY29udGVudC10eXBlPWltYWdlJTJGcG5nIn0.otpZNFsZegj2JQx3eFEi5qT2Z6yDAZk3lT8oVWFmrMM)](https://private-user-images.githubusercontent.com/4669888/579629738-d5510075-b62c-462f-a941-1d31b48bbec3.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODQzNTI3NTYsIm5iZiI6MTc4NDM1MjQ1NiwicGF0aCI6Ii80NjY5ODg4LzU3OTYyOTczOC1kNTUxMDA3NS1iNjJjLTQ2MmYtYTk0MS0xZDMxYjQ4YmJlYzMucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI2MDcxOCUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNjA3MThUMDUyNzM2WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9Zjg1MTdlZTFkYWZjM2Y4NmE3MWNhYjJlYjQ5NmRhY2MxMjdkMTBmOTUxNTBjNDk5ZjljYzZkZjBhZjhkMThkOCZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmcmVzcG9uc2UtY29udGVudC10eXBlPWltYWdlJTJGcG5nIn0.otpZNFsZegj2JQx3eFEi5qT2Z6yDAZk3lT8oVWFmrMM)CoyoteCert for Laravel ====================== [](#coyotecert-for-laravel) [![Latest Version on Packagist](https://camo.githubusercontent.com/c50025ae99ce14fc6b4d61cadc8c08e22b052ef1f2589b1b9e83fd6e116c876e/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f626c656e64627974652f636f796f7465636572742d6c61726176656c2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/blendbyte/coyotecert-laravel)[![License: MIT](https://camo.githubusercontent.com/a7e65aee57b11d28e4caff8b945729a66be0bb663f7f93bd24c5aa65699f148e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d626c75652e7376673f7374796c653d666c61742d737175617265)](LICENSE)[![PHP](https://camo.githubusercontent.com/6ddbc13de7b150d442633160eb3ad4ae3ee4b85dcab74b1877cceb62db79ede2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332532422d3738376362353f7374796c653d666c61742d737175617265)](https://www.php.net)[![Laravel](https://camo.githubusercontent.com/20770cf7fa9d936232e2a48758189b5ab03180ba4b38a0ab9e86a6d66c2693b5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d31322532422d4646324432303f7374796c653d666c61742d737175617265)](https://laravel.com)[![Tests](https://camo.githubusercontent.com/1a5e0dfcb293def44233e19fd5dc60d466a34fd5b78c43b3c47eb6e0de35946d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f626c656e64627974652f636f796f7465636572742d6c61726176656c2f74657374732e796d6c3f6272616e63683d6d61696e267374796c653d666c61742d737175617265266c6162656c3d7465737473)](https://github.com/blendbyte/coyotecert-laravel/actions/workflows/tests.yml)[![Static Analysis](https://camo.githubusercontent.com/8312f209fe21eb407cf9eda64b4e46d6cdbe5d9d4c501f7720f0668aae498b64/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f626c656e64627974652f636f796f7465636572742d6c61726176656c2f7374617469632d616e616c797369732e796d6c3f6272616e63683d6d61696e267374796c653d666c61742d737175617265266c6162656c3d7068707374616e)](https://github.com/blendbyte/coyotecert-laravel/actions/workflows/static-analysis.yml)[![Coverage](https://camo.githubusercontent.com/f3c8d2e1aa201165dd325820d55ffe2472554f924c04cfaeb9bff3a4e8fa9040/68747470733a2f2f696d672e736869656c64732e696f2f636f6465636f762f632f6769746875622f626c656e64627974652f636f796f7465636572742d6c61726176656c3f7374796c653d666c61742d737175617265)](https://codecov.io/gh/blendbyte/coyotecert-laravel) Free TLS certificates, straight from the ACME catalog. No nginx reloads, no cron entries, no shell scripts, no separate container. Just a service provider, a config file, and a couple of Artisan commands. --- Why the Laravel package and not the core library? ------------------------------------------------- [](#why-the-laravel-package-and-not-the-core-library) [blendbyte/coyotecert](https://github.com/blendbyte/coyotecert) is the raw ACME client. It does the cryptography, talks to the CA, validates your domains, and hands back a certificate. It is a library, so you wire everything yourself: storage, provider config, a challenge handler that can actually serve the token, a cron job to renew, error handling, logging. This package does all of that for you inside Laravel. Here is the difference: **Core library on its own:** ``` // You write this, somewhere, and you maintain it forever. $cert = CoyoteCert::with(new LetsEncrypt()) ->email(env('CERT_EMAIL')) ->storage(new DatabaseStorage($pdo, 'certs')) ->logger(Log::channel('certs')) ->identifiers('example.com') ->challenge(new MyCustomHttp01Handler('/var/www/.well-known/acme-challenge')) ->keyType(KeyType::EC_P256) ->onIssued(fn ($cert) => /* reload nginx, notify Slack, update secrets... */) ->issueOrRenew(30); ``` You also need to write `MyCustomHttp01Handler`, manage the webroot directory, configure nginx to serve those files, set up a cron job, handle the `CertificateIssued` side-effects yourself, and restart nginx when the cert changes. **This package:** ``` php artisan cert:issue example.com ``` The service provider wires the storage, the logger, the challenge handler, and the provider from your config file. The HTTP-01 challenge is served by a registered route backed by your cache store. No webroot, no nginx config, no extra cron. --- Requirements ------------ [](#requirements) - PHP 8.3+ - Laravel 12.0+ or 13.0+ --- Installation ------------ [](#installation) ``` composer require blendbyte/coyotecert-laravel ``` Publish the config file: ``` php artisan vendor:publish --tag=coyotecert-config ``` If you want to store certificates in the database, publish and run the migration: ``` php artisan vendor:publish --tag=coyotecert-migrations php artisan migrate ``` --- Configuration ------------- [](#configuration) Open `config/coyotecert.php`. Everything has a sensible default but you need to set at least your email address before the CA will issue anything. ``` return [ // Which CA to use. Required — no default, pick one consciously. // letsencrypt | letsencrypt-staging | buypass | buypass-staging // zerossl | google | custom 'provider' => env('COYOTECERT_PROVIDER'), // Your contact email. The CA uses this to warn you about expiring // certificates and account issues. Required. 'email' => env('COYOTECERT_EMAIL'), // Challenge type. http-01 works out of the box via the built-in route. // dns-01 requires you to bind a custom ChallengeHandlerInterface. 'challenge' => env('COYOTECERT_CHALLENGE', 'http-01'), // Where to persist certificates and the ACME account key. // database | filesystem 'storage' => env('COYOTECERT_STORAGE', 'database'), // Certificate key algorithm. // EC_P256 | EC_P384 | RSA_2048 | RSA_4096 'key_type' => env('COYOTECERT_KEY_TYPE', 'EC_P256'), // How many days before expiry to trigger renewal in cert:renew. 'renewal_days' => (int) env('COYOTECERT_RENEWAL_DAYS', 30), // Identities that cert:renew processes automatically (without --identity). 'identities' => [ // 'example.com', // 'www.example.com', ], // Provider-specific credentials. 'providers' => [ 'zerossl' => [ 'api_key' => env('COYOTECERT_ZEROSSL_API_KEY'), ], 'google' => [ 'eab_kid' => env('COYOTECERT_GOOGLE_EAB_KID'), 'eab_hmac' => env('COYOTECERT_GOOGLE_EAB_HMAC'), ], 'custom' => [ 'directory_url' => env('COYOTECERT_CUSTOM_DIRECTORY_URL'), ], ], // Filesystem storage path (when storage = filesystem). 'filesystem' => [ 'path' => env('COYOTECERT_FILESYSTEM_PATH', storage_path('coyotecert')), ], // Database storage options (when storage = database). 'database' => [ 'connection' => env('COYOTECERT_DB_CONNECTION'), // null = default 'table' => env('COYOTECERT_DB_TABLE', 'coyote_cert_storage'), ], ]; ``` Minimal `.env` to get started with Let's Encrypt: ``` COYOTECERT_PROVIDER=letsencrypt COYOTECERT_EMAIL=ops@example.com COYOTECERT_STORAGE=database ``` --- HTTP-01 challenge, automatically -------------------------------- [](#http-01-challenge-automatically) When you use `http-01`, the CA needs to fetch a token from `http://yourdomain.com/.well-known/acme-challenge/`. This package registers that route automatically. The challenge handler stores the token in your Laravel cache store when the ACME handshake starts, and the route reads it back and serves it as `text/plain`. When the handshake completes, the token is removed. That means: - No webroot directory to manage. - No nginx location block to add. - Works behind a load balancer as long as the cache store is shared (Redis, Memcached, database). - Works on read-only filesystems and in containers. The only thing you need is a working cache driver and DNS pointing at your app. Let's Encrypt does the rest. --- Artisan commands ---------------- [](#artisan-commands) ### cert:issue [](#certissue) Issue a fresh certificate unconditionally. Use this for first-time setup or to force a re-issue. ``` php artisan cert:issue example.com ``` ``` Certificate issued successfully. Expires: 2025-07-18 14:22:05 Days remaining: 89 ``` ### cert:renew [](#certrenew) Renew certificates that are within the renewal window. By default, processes every identity in `coyotecert.identities`. ``` php artisan cert:renew ``` ``` Renewed: example.com Renewed: www.example.com ``` Renew a single identity without touching the config: ``` php artisan cert:renew --identity=example.com ``` Force re-issue regardless of expiry: ``` php artisan cert:renew --identity=example.com --force ``` If an identity fails, the command reports the error, continues to the next one, and exits with a non-zero status code at the end. Your monitoring picks that up. ### cert:list [](#certlist) Show the status of every identity in `coyotecert.identities` at a glance. ``` php artisan cert:list ``` ``` +------------------+---------------------+---------------------+----------------+---------+ | Identity | Issued At | Expires At | Days Remaining | Expired | +------------------+---------------------+---------------------+----------------+---------+ | example.com | 2025-04-19 14:22:05 | 2025-07-18 14:22:05 | 89 | No | | www.example.com | Not issued | Not issued | - | - | +------------------+---------------------+---------------------+----------------+---------+ ``` ### cert:status [](#certstatus) Check the current certificate for an identity without hitting the CA at all. ``` php artisan cert:status example.com ``` ``` +----------------+------------------------------+ | Field | Value | +----------------+------------------------------+ | Identity | example.com | | Identifiers | example.com | | Key Type | EC_P256 | | Issued At | 2025-04-19 14:22:05 | | Expires At | 2025-07-18 14:22:05 | | Days Remaining | 89 | | Expired | No | +----------------+------------------------------+ ``` ### cert:revoke [](#certrevoke) Revoke a certificate and remove it from storage. Useful when rotating for security reasons. ``` php artisan cert:revoke example.com ``` ``` Certificate for [example.com] has been revoked and deleted. ``` Pass an ACME revocation reason code (RFC 8555 section 7.2): ``` php artisan cert:revoke example.com --reason=1 # keyCompromise ``` --- Events ------ [](#events) Three events are dispatched through the Laravel event bus, so you can react to certificate changes with standard Laravel listeners. EventWhen`CertificateIssued`After any successful issuance`CertificateRenewed`After a certificate is replaced (fires alongside `CertificateIssued`)`CertificateExpiring`When `cert:renew` detects a cert is within the renewal window, before it renewsAll three carry a `StoredCertificate $certificate` and a `string $identity`. `CertificateExpiring` also carries `int $daysUntilExpiry`. ### Reloading nginx after issuance [](#reloading-nginx-after-issuance) ``` // app/Listeners/ReloadNginxOnCertChange.php use CoyoteCert\Laravel\Events\CertificateIssued; class ReloadNginxOnCertChange { public function handle(CertificateIssued $event): void { // Write the new cert to disk then reload nginx. $cert = $event->certificate; file_put_contents('/etc/nginx/certs/' . $event->identity . '.pem', $cert->fullchain); shell_exec('nginx -s reload'); } } ``` Register it in `EventServiceProvider` (or with `#[AsEventListener]` in Laravel 11+): ``` protected $listen = [ CertificateIssued::class => [ ReloadNginxOnCertChange::class, ], ]; ``` ### Sending expiry alerts [](#sending-expiry-alerts) ``` use CoyoteCert\Laravel\Events\CertificateExpiring; class SendExpiryAlert { public function handle(CertificateExpiring $event): void { // This fires before the renewal attempt, so you know a renewal // is in progress. If it succeeds, CertificateRenewed fires next. // If it fails, your monitoring has the failure and this alert // gives you a head start. Notification::route('mail', 'ops@example.com') ->notify(new CertExpiringNotification($event->identity, $event->daysUntilExpiry)); } } ``` ### Queued listeners [](#queued-listeners) All three events work with queued listeners out of the box because they carry a `StoredCertificate`, which is a plain readonly class that serialises cleanly. ``` use Illuminate\Contracts\Queue\ShouldQueue; class PushCertToVault implements ShouldQueue { public function handle(CertificateIssued $event): void { // Push the new cert to HashiCorp Vault, AWS Secrets Manager, etc. Vault::write('secret/tls/' . $event->identity, [ 'cert' => $event->certificate->certificate, 'key' => $event->certificate->privateKey, 'chain' => $event->certificate->fullchain, ]); } } ``` --- Queue job --------- [](#queue-job) For DNS-01 challenges, or any case where you want issuance to happen off the main process, dispatch `IssueCertificateJob`: ``` use CoyoteCert\Laravel\Jobs\IssueCertificateJob; // Issue or renew with the default 30-day renewal window. IssueCertificateJob::dispatch('example.com'); // Override the renewal window. IssueCertificateJob::dispatch('example.com', renewalDays: 14); ``` The job calls `issueOrRenew()` on the manager. If the certificate does not need renewal it exits immediately. If it does, it issues and fires the events. --- Scheduled renewal ----------------- [](#scheduled-renewal) The service provider registers a daily `cert:renew` in Laravel's scheduler automatically. You do not need to add anything to `routes/console.php` or `app/Console/Kernel.php`. As long as your app has the standard scheduler cron entry (`* * * * * php artisan schedule:run >> /dev/null 2>&1`), renewals happen on their own. Identities are read from `coyotecert.identities` in your config. Add every identity you want to auto-renew: ``` 'identities' => [ 'example.com', 'www.example.com', 'api.example.com', ], ``` --- Storage backends ---------------- [](#storage-backends) ### Database (default) [](#database-default) Stores the ACME account key and all certificates in a `coyote_cert_storage` table. Works with any database Laravel supports. Run the migration once: ``` php artisan vendor:publish --tag=coyotecert-migrations php artisan migrate ``` Use a non-default connection if your certs should live in a separate database: ``` COYOTECERT_DB_CONNECTION=certs_db ``` ### Filesystem [](#filesystem) Writes each certificate as a set of files under a directory. Good for single-server setups or when you need files on disk directly. ``` COYOTECERT_STORAGE=filesystem COYOTECERT_FILESYSTEM_PATH=/etc/certs ``` --- Certificate authorities ----------------------- [](#certificate-authorities) Set `COYOTECERT_PROVIDER` to one of these: ValueCANotes`letsencrypt`Let's Encrypt (production)Default. No extra config.`letsencrypt-staging`Let's Encrypt (staging)For testing. Issues untrusted certs.`buypass`Buypass Go SSL (production)No extra config.`buypass-staging`Buypass Go SSL (staging)For testing.`zerossl`ZeroSSLRequires `COYOTECERT_ZEROSSL_API_KEY`.`google`Google Trust ServicesRequires `COYOTECERT_GOOGLE_EAB_KID` and `COYOTECERT_GOOGLE_EAB_HMAC`.`custom`Any RFC 8555 CARequires `COYOTECERT_CUSTOM_DIRECTORY_URL`.--- DNS-01 challenge ---------------- [](#dns-01-challenge) DNS-01 is not wired by default because it requires a DNS provider API, which varies per setup. You implement `ChallengeHandlerInterface` and bind it yourself: ``` use CoyoteCert\Enums\AuthorizationChallengeEnum; use CoyoteCert\Interfaces\ChallengeHandlerInterface; class CloudflareDnsHandler implements ChallengeHandlerInterface { public function supports(AuthorizationChallengeEnum $type): bool { return $type === AuthorizationChallengeEnum::DNS; } public function deploy(string $domain, string $token, string $keyAuthorization): void { // Create a _acme-challenge TXT record via the Cloudflare API. Cloudflare::dns()->createTxtRecord('_acme-challenge.' . $domain, $keyAuthorization); } public function cleanup(string $domain, string $token): void { // Delete the TXT record once the challenge is complete. Cloudflare::dns()->deleteTxtRecord('_acme-challenge.' . $domain); } } ``` Bind it in a service provider: ``` use CoyoteCert\Interfaces\ChallengeHandlerInterface; $this->app->bind(ChallengeHandlerInterface::class, CloudflareDnsHandler::class); ``` Then set `COYOTECERT_CHALLENGE=dns-01` in your `.env`. The manager resolves the binding automatically. --- Maintained by Blendbyte ----------------------- [](#maintained-by-blendbyte) [ ![Blendbyte](https://camo.githubusercontent.com/09962a5684a0b50fb9eb44edfd8f2560be418bc8ce3d23a31f96395f3f14d58e/68747470733a2f2f7777772e626c656e64627974652e636f6d2f6c6f676f5f686f72697a6f6e74616c2e706e67) ](https://www.blendbyte.com) **[Blendbyte](https://www.blendbyte.com)** builds cloud infrastructure, web apps, and developer tools. We've been shipping software to production for 20+ years. This package runs in our own stack, which is why we keep it maintained. Issues and PRs get read. Good ones get merged. [blendbyte.com](https://www.blendbyte.com) · ### Health Score 39 — LowBetter than 84% of packages Maintenance82 Actively maintained with recent releases Popularity9 Limited adoption so far Community6 Small or concentrated contributor base Maturity50 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 96d ago Major Versions v0.1.0 → v1.0.02026-04-20 ### Community Maintainers ![](https://avatars.githubusercontent.com/u/69378377?v=4)[Blendbyte](/maintainers/blendbyte)[@blendbyte](https://github.com/blendbyte) --- Top Contributors [![bashgeek](https://avatars.githubusercontent.com/u/4669888?v=4)](https://github.com/bashgeek "bashgeek (39 commits)") --- Tags laravelcertificatetlssslletsencryptACME ### Code Quality TestsPest Static AnalysisPHPStan Code StylePHP CS Fixer ### Embed Badge ![Health badge](/badges/blendbyte-coyotecert-laravel/health.svg) ``` [![Health](https://phpackages.com/badges/blendbyte-coyotecert-laravel/health.svg)](https://phpackages.com/packages/blendbyte-coyotecert-laravel) ``` ### Alternatives [psalm/plugin-laravel Psalm plugin for Laravel 3345.3M347](/packages/psalm-plugin-laravel)[laravel/horizon Dashboard and code-driven configuration for Laravel queues. 4.2k95.4M321](/packages/laravel-horizon)[illuminate/database The Illuminate Database package. 2.8k54.9M12.2k](/packages/illuminate-database)[laravel/ai The official AI SDK for Laravel. 1.0k3.2M246](/packages/laravel-ai)[moonshine/moonshine Laravel administration panel 1.3k253.1k86](/packages/moonshine-moonshine)[mateusjunges/laravel-kafka A kafka driver for laravel 7253.6M21](/packages/mateusjunges-laravel-kafka) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)