Keys & Certificates Inventory¶

Version: 1.0
Date: January 18, 2026
Status: Active

Overview¶

This document provides a comprehensive inventory of all API keys, secrets, and certificates used in Forma3D.Connect. Each entry includes lifespan, renewal location, and renewal procedures.

IMPORTANT: This document contains references to credentials. Never store actual credentials in version control. All secrets should be stored in: - Azure DevOps Library (Variable Groups) - .env files (local development only, never committed) - DigitalOcean environment variables

Infrastructure¶

Database¶

Container Registry¶

External Services¶

Shopify¶

SimplyPrint¶

Sendcloud¶

Push Notifications (Web Push / VAPID)¶

Initial VAPID key generation:

npx web-push generate-vapid-keys --json
# Output: { "publicKey": "...", "privateKey": "..." }

Warning: Do NOT regenerate VAPID keys unless absolutely necessary. Regenerating keys invalidates all existing push subscriptions across all users. Users will need to re-subscribe for push notifications.

Application¶

CI/CD (Azure DevOps)¶

TLS Certificate Auto-Renewal¶

Traefik automatically handles Let's Encrypt certificate renewal:

• Validity: 90 days per certificate
• Auto-renewal: Traefik renews ~30 days before expiry
• Storage: Certificates stored in Docker volume traefik-certs at /letsencrypt/acme.json
• Challenge: HTTP-01 challenge via port 80 (must remain accessible)
• Configuration: See deployment/staging/traefik.yml > certificatesResolvers.letsencrypt

Monitoring TLS auto-renewal:

# Check certificate expiry date
echo | openssl s_client -connect connect-api.forma3d.be:443 2>/dev/null | openssl x509 -noout -dates

# Check Traefik logs for renewal activity
docker logs forma3d-traefik 2>&1 | grep -i "acme\|certificate\|renew"

# Verify ACME storage file exists
docker exec forma3d-traefik ls -la /letsencrypt/acme.json

Troubleshooting failed renewal: 1. Ensure port 80 is open and reachable from internet 2. Check DNS still points to correct IP 3. Verify Traefik container is running: docker ps | grep traefik 4. Check Traefik logs for ACME errors 5. If needed, remove acme.json and restart Traefik to re-issue certificates

Renewal Calendar¶

Renewal Checklist¶

When renewing any credential:

1. Generate new credential in source system
2. Update .env files (staging and production)
3. Update secrets in Azure DevOps (Library > Variable Groups)
4. Deploy with new credentials
5. Verify system still works (health checks)
6. Revoke old credential (if applicable)
7. Update this inventory with new "Last Renewed" date

Secure Storage Locations¶

Revision History: