Release 0.6.4-rc.2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -13,6 +13,31 @@ All notable changes to Jarl are documented here. The format follows
   audited, with the address first (`msg="login failed" ip=… user=…`,
   `msg="token refused" ip=…`), for Guard's `jarl` preset or a fail2ban
   filter to ban such addresses (docs/operations.md).
+- **`jarl cert get --combined PATH`** also writes the key and the full
+  chain in one file (mode 600, written all at once), for HAProxy. It
+  belongs outside `--dir`, so a directory of combined files can be
+  HAProxy's `crt` directory. The hook gets it as `JARL_CERT_COMBINED`.
+  Adding it to a certificate this host already has writes it from the
+  files on disk and runs the hook; `--combined ''` removes it.
+- **`jarl cert get --local`** doesn't ask jarld: it writes the combined
+  file and runs the hook from this host's files, to apply a changed
+  setting or test a hook.
+- **`jarl cert saved NAME`** shows all of one certificate's saved
+  settings (names, key type, dir, combined file, hook, server) and this
+  host's copy. The token is never shown.
+- `jarl cert list` has a PULLED column: when the certificate was last
+  downloaded, with `(old)` while a host hasn't fetched the renewed one.
+  The owner of a certificate obtained with `jarl cert get` now sees their
+  own downloads (`pulled_by`) in `jarl cert list` and `jarl cert show`, not
+  only administrators.
+
+### Changed
+
+- `jarl cert list` shows `get` as USES for a certificate obtained with
+  `jarl cert get`, not `-`.
+- `jarl cert get` without a name refuses `--dir`, `--hook`, `--key-type`,
+  `--combined`, `--replace` and `--no-save`, which change one
+  certificate; they used to be ignored.
 
 ## [0.6.3] - 2026-10-21
 

README.md

@@ -202,9 +202,10 @@ review step.
 
 ## Status
 
-Version 0.6.3 is the current release; 0.6.4 is in testing (0.6.4-rc.1):
+Version 0.6.3 is the current release; 0.6.4 is in testing (0.6.4-rc.2):
 failed logins and refused tokens are logged, address first, for Guard
-and fail2ban. 0.6.3 brings the lego docs up to
+and fail2ban, and `jarl cert get` can write a combined file for HAProxy
+(`--combined`) and apply settings without jarld (`--local`). 0.6.3 brings the lego docs up to
 lego 5 and explains lego with split DNS. 0.6.2 added a `certificates` role
 for tokens that get certificates for other hosts. 0.6.1 gets certificates onto your
 other hosts (`jarl cert get`: Jarl obtains and renews them, a host downloads them and runs a

VERSION

@@ -1 +1 @@
-0.6.4-rc.1
+0.6.4-rc.2

cmd/jarl/certget.go

@@ -2,7 +2,8 @@ package main
 
 // jarl cert get: certificates for other hosts (docs/certificates.md#certificates-for-other-hosts).
 // jarld obtains and renews the certificate; this host asks for it, waits,
-// downloads it when it is newer than its copy, and runs a hook. The
+// downloads it when it is newer than its copy, writes the combined file
+// (--combined) and runs a hook. The
 // settings of each certificate are saved, so a daily timer (jarl cert
 // schedule) can run 'jarl cert get' for all of them.
 
@@ -31,13 +32,16 @@ import (
 
 // savedCert is a certificate's settings, saved by jarl cert get.
 type savedCert struct {
-	Name    string     `json:"name"`
-	Domains []string   `json:"domains"`
-	KeyType string     `json:"key_type,omitempty"`
-	Dir     string     `json:"dir"`
-	Hook    string     `json:"hook,omitempty"`
-	Conn    connection `json:"connection"`
-	SavedAt time.Time  `json:"saved_at"`
+	Name    string   `json:"name"`
+	Domains []string `json:"domains"`
+	KeyType string   `json:"key_type,omitempty"`
+	Dir     string   `json:"dir"`
+	Hook    string   `json:"hook,omitempty"`
+	// Combined is a file with the key and the full chain together, for
+	// HAProxy (--combined); kept outside Dir.
+	Combined string     `json:"combined,omitempty"`
+	Conn     connection `json:"connection"`
+	SavedAt  time.Time  `json:"saved_at"`
 }
 
 // localMeta is what this host has of a certificate, kept next to its
@@ -48,6 +52,9 @@ type localMeta struct {
 	Serial   string    `json:"serial"`
 	NotAfter time.Time `json:"not_after"`
 	Fetched  time.Time `json:"fetched"`
+	// Combined is the combined file written for these files, so a changed
+	// --combined removes the old one.
+	Combined string `json:"combined,omitempty"`
 	// HookFailed is set when the hook failed for these files: the next
 	// run runs it again.
 	HookFailed string `json:"hook_failed,omitempty"`
@@ -128,12 +135,53 @@ func checkCertClash(saved []savedCert, i int, sc savedCert, replace bool) error
 			return fmt.Errorf("%s holds the files of %s, saved for %s: give %s another --dir", sc.Dir, o.Name, o.Conn.Server, sc.Name)
 		}
 	}
+	if err := checkCombined(saved, i, sc); err != nil {
+		return err
+	}
 	if m, err := readMeta(sc.Dir); err == nil && m.Name != "" && m.Name != sc.Name && !replace {
 		return fmt.Errorf("%s holds the files of the certificate %s: give %s another --dir, or overwrite them with --replace", sc.Dir, m.Name, sc.Name)
 	}
 	return nil
 }
 
+// checkCombined refuses a --combined path that is a directory, one of
+// the files jarl cert get writes in a certificate's directory, or another
+// saved certificate's combined file.
+func checkCombined(saved []savedCert, i int, sc savedCert) error {
+	if sc.Combined == "" {
+		return nil
+	}
+	if st, err := os.Stat(sc.Combined); err == nil && st.IsDir() {
+		return fmt.Errorf("--combined %s is a directory: give the file's path, such as %s", sc.Combined, filepath.Join(sc.Combined, sc.Name+".pem"))
+	}
+	dir, base := filepath.Split(sc.Combined)
+	for j, o := range append(slices.Clone(saved), sc) {
+		if j == i {
+			continue // sc itself is last
+		}
+		if filepath.Clean(dir) == filepath.Clean(o.Dir) && (base == metaFile || slices.Contains(certFiles, base)) {
+			return fmt.Errorf("--combined %s would overwrite %s's %s: give another path", sc.Combined, o.Name, base)
+		}
+		if j < len(saved) && o.Name != sc.Name && o.Combined != "" && filepath.Clean(o.Combined) == filepath.Clean(sc.Combined) {
+			return fmt.Errorf("--combined %s is the combined file of %s: give %s another path", sc.Combined, o.Name, sc.Name)
+		}
+	}
+	return nil
+}
+
+// sameNames reports whether two lists hold the same names, in any order.
+func sameNames(a, b []string) bool {
+	norm := func(l []string) []string {
+		out := make([]string, len(l))
+		for i, n := range l {
+			out[i] = strings.TrimSuffix(strings.ToLower(n), ".")
+		}
+		slices.Sort(out)
+		return slices.Compact(out)
+	}
+	return slices.Equal(norm(a), norm(b))
+}
+
 // sameServer reports whether two server addresses name the same jarld.
 func sameServer(a, b string) bool {
 	norm := func(s string) string { return strings.TrimRight(strings.ToLower(s), "/") }
@@ -191,12 +239,16 @@ type getResult struct {
 	Serial   string    `json:"serial"`
 	NotAfter time.Time `json:"not_after"`
 	Updated  bool      `json:"updated"` // new files written
-	Hook     string    `json:"hook,omitempty"`
+	// Combined is the combined file; CombinedWritten is set when it was
+	// written now.
+	Combined        string `json:"combined,omitempty"`
+	CombinedWritten bool   `json:"combined_written,omitempty"`
+	Hook            string `json:"hook,omitempty"`
 }
 
 // fetchCert asks jarld for the certificate, waits while it is obtained,
-// downloads it when it is newer than this host's copy (or force) and runs
-// the hook.
+// downloads it when it is newer than this host's copy (or force), and
+// then applies it (applyCert).
 func fetchCert(c *client.Client, sc savedCert, force bool, wait time.Duration) (*getResult, error) {
 	var ans requestAnswer
 	err := c.Do(ctx(), "POST", certPath(sc.Name)+"/request", nil, map[string]any{"domains": sc.Domains, "key_type": sc.KeyType}, &ans)
@@ -241,23 +293,68 @@ func fetchCert(c *client.Client, sc savedCert, force bool, wait time.Duration) (
 	if ci.LastError != "" && ci.LastAttempt != nil && (ci.LastSuccess == nil || ci.LastAttempt.After(*ci.LastSuccess)) {
 		fmt.Fprintf(os.Stderr, "%s: jarld's last attempt failed (%s); this is the certificate it has\n", sc.Name, ci.LastError)
 	}
-	res := &getResult{Name: sc.Name, Dir: sc.Dir, Serial: ci.Serial, NotAfter: *ci.NotAfter}
 	meta, _ := readMeta(sc.Dir)
 	have := meta != nil && meta.Serial == ci.Serial && filesPresent(sc.Dir)
-	if have && !force && meta.HookFailed == "" {
-		return res, nil
-	}
 	renewed := meta != nil && meta.Serial != "" && meta.Serial != ci.Serial
-	if !have || force {
+	updated := !have || force
+	if updated {
 		if err := downloadCert(c, sc, ci); err != nil {
 			return nil, err
 		}
-		res.Updated = true
-		meta = &localMeta{Name: sc.Name, Domains: ci.Domains, Serial: ci.Serial, NotAfter: *ci.NotAfter, Fetched: time.Now().UTC()}
+		old := ""
+		if meta != nil {
+			old = meta.Combined
+		}
+		meta = &localMeta{Name: sc.Name, Domains: ci.Domains, Serial: ci.Serial, NotAfter: *ci.NotAfter, Fetched: time.Now().UTC(), Combined: old}
+	}
+	return applyCert(sc, meta, updated, renewed, force)
+}
+
+// localCert applies the files this host has, without asking jarld
+// (--local): it writes the combined file and runs the hook.
+func localCert(sc savedCert) (*getResult, error) {
+	meta, err := readMeta(sc.Dir)
+	if err != nil || !filesPresent(sc.Dir) {
+		return nil, fmt.Errorf("%s: this host has no files for it in %s yet: run jarl cert get %s without --local", sc.Name, sc.Dir, sc.Name)
+	}
+	if meta.Name != "" && meta.Name != sc.Name {
+		return nil, fmt.Errorf("%s holds the files of the certificate %s, not %s", sc.Dir, meta.Name, sc.Name)
+	}
+	return applyCert(sc, meta, false, false, true)
+}
+
+// applyCert brings what lies outside the certificate's directory in line
+// with its files: it writes the combined file when the files are new, its
+// path changed or it is missing (and removes one written for an older
+// path), then runs the hook when anything changed, when it failed last
+// time, or always.
+func applyCert(sc savedCert, meta *localMeta, updated, renewed, always bool) (*getResult, error) {
+	res := &getResult{Name: sc.Name, Dir: sc.Dir, Serial: meta.Serial, NotAfter: meta.NotAfter, Updated: updated, Combined: sc.Combined}
+	changed := updated
+	if meta.Combined != "" && filepath.Clean(meta.Combined) != filepath.Clean(sc.Combined) {
+		if err := os.Remove(meta.Combined); err != nil && !errors.Is(err, os.ErrNotExist) {
+			return nil, fmt.Errorf("%s: removing the old combined file: %w", sc.Name, err)
+		}
+		meta.Combined = ""
+		changed = true
+	}
+	if sc.Combined != "" {
+		_, err := os.Stat(sc.Combined)
+		if updated || always || meta.Combined == "" || err != nil {
+			if err := writeCombined(sc); err != nil {
+				return nil, err
+			}
+			meta.Combined = sc.Combined
+			res.CombinedWritten = true
+			changed = true
+		}
+	}
+	if !changed && !always && meta.HookFailed == "" {
+		return res, nil
 	}
 	if sc.Hook != "" {
 		res.Hook = "ok"
-		if err := runHook(sc, ci, renewed); err != nil {
+		if err := runHook(sc, meta, renewed); err != nil {
 			meta.HookFailed = err.Error()
 			res.Hook = "failed: " + err.Error()
 		} else {
@@ -275,6 +372,31 @@ func fetchCert(c *client.Client, sc savedCert, force bool, wait time.Duration) (
 
 var certFiles = []string{"cert.pem", "chain.pem", "fullchain.pem", "privkey.pem"}
 
+// writeCombined writes the combined file from the certificate's files:
+// the key, then the full chain (as jarl cert export --part bundle), mode
+// 600, all at once.
+func writeCombined(sc savedCert) error {
+	full, err := os.ReadFile(filepath.Join(sc.Dir, "fullchain.pem"))
+	if err != nil {
+		return err
+	}
+	key, err := os.ReadFile(filepath.Join(sc.Dir, "privkey.pem"))
+	if err != nil {
+		return err
+	}
+	if _, err := tls.X509KeyPair(full, key); err != nil {
+		return fmt.Errorf("%s: the files in %s don't match (%v): run jarl cert get %s --force", sc.Name, sc.Dir, err, sc.Name)
+	}
+	if err := os.MkdirAll(filepath.Dir(sc.Combined), 0o755); err != nil {
+		return err
+	}
+	data := append(append(append([]byte{}, key...), '\n'), full...)
+	if err := writeAtomic(sc.Combined, data, 0o600); err != nil {
+		return fmt.Errorf("%s: writing the combined file: %w", sc.Name, err)
+	}
+	return nil
+}
+
 func filesPresent(dir string) bool {
 	for _, f := range certFiles {
 		if _, err := os.Stat(filepath.Join(dir, f)); err != nil {
@@ -339,7 +461,7 @@ func downloadCert(c *client.Client, sc savedCert, ci certInfo) error {
 
 // runHook runs the certificate's hook with sh, its files in the
 // environment.
-func runHook(sc savedCert, ci certInfo, renewed bool) error {
+func runHook(sc savedCert, meta *localMeta, renewed bool) error {
 	c, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
 	cmd := exec.CommandContext(c, "sh", "-c", sc.Hook)
@@ -354,9 +476,10 @@ func runHook(sc savedCert, ci certInfo, renewed bool) error {
 		"JARL_CERT_CHAIN="+filepath.Join(sc.Dir, "chain.pem"),
 		"JARL_CERT_FULLCHAIN="+filepath.Join(sc.Dir, "fullchain.pem"),
 		"JARL_CERT_KEY="+filepath.Join(sc.Dir, "privkey.pem"),
-		"JARL_CERT_DOMAINS="+strings.Join(ci.Domains, " "),
-		"JARL_CERT_SERIAL="+ci.Serial,
-		"JARL_CERT_NOT_AFTER="+ci.NotAfter.UTC().Format(time.RFC3339),
+		"JARL_CERT_COMBINED="+sc.Combined,
+		"JARL_CERT_DOMAINS="+strings.Join(meta.Domains, " "),
+		"JARL_CERT_SERIAL="+meta.Serial,
+		"JARL_CERT_NOT_AFTER="+meta.NotAfter.UTC().Format(time.RFC3339),
 		"JARL_CERT_RENEWED="+ren,
 	)
 	cmd.Stdout, cmd.Stderr = os.Stderr, os.Stderr
@@ -365,8 +488,8 @@ func runHook(sc savedCert, ci certInfo, renewed bool) error {
 
 func certGetCmd() *cobra.Command {
 	var domains []string
-	var dir, hook, keyType, configDir string
-	var noSave, force, replace bool
+	var dir, hook, keyType, combined, configDir string
+	var noSave, force, replace, local bool
 	var wait time.Duration
 	cmd := &cobra.Command{
 		Use:   "get [NAME]",
@@ -374,7 +497,7 @@ func certGetCmd() *cobra.Command {
 		Long: `Gets a certificate for this host (a mail server, a reverse proxy). jarld
 obtains it from the CA and renews it, answering the challenges in its own
 zones; this command asks for it, waits until it is there, downloads it
-when it is newer than this host's copy, and runs --hook.
+when it is newer than this host's copy, writes --combined and runs --hook.
 
 The token needs a certificates grant for the names, and the certificate
 belongs to the token's user: another user can't take the name. Asking
@@ -383,11 +506,19 @@ removing a name gets a new one.
 
 Files in --dir (default /etc/jarl/certs/NAME as root, ./NAME otherwise):
 cert.pem, chain.pem (the intermediates), fullchain.pem, privkey.pem (mode
-600), and jarl-cert.json (serial, expiry, when it was fetched).
+600), and jarl-cert.json (serial, expiry, when it was fetched). Don't
+point HAProxy's crt at --dir: it loads every file there.
 
-The settings (names, --dir, --hook, the server and token) are saved in
+--combined PATH also writes the key and the full chain in one file (mode
+600), as HAProxy wants. Keep it outside --dir; a directory of combined
+files can be HAProxy's crt directory. --combined '' stops writing it and
+removes the file.
+
+The settings (names, --dir, --combined, --hook, the server and token) are
+saved in
 /etc/jarl/cert-get/NAME.json (as root; ~/.config/jarl/cert-get otherwise,
-readable only by you). 'jarl cert get' without a name then does every
+readable only by you). To change one later, run 'jarl cert get NAME' with
+just that option; the others stay. 'jarl cert get' without a name does every
 saved certificate: run it daily (jarl cert schedule does that with a
 systemd timer). Nothing is downloaded until jarld has renewed one.
 
@@ -395,14 +526,20 @@ A name saved here for another Jarl server isn't taken over, nor a --dir
 holding another certificate's files, unless --replace is given; a --dir
 another saved certificate uses is always refused.
 
---hook runs with sh after new files are written (and again on the next
-run if it failed), with JARL_CERT_NAME, JARL_CERT_DIR, JARL_CERT_CERT,
-JARL_CERT_CHAIN, JARL_CERT_FULLCHAIN, JARL_CERT_KEY, JARL_CERT_DOMAINS,
-JARL_CERT_SERIAL, JARL_CERT_NOT_AFTER and JARL_CERT_RENEWED (1 when it
-replaced an older certificate).`,
+--hook runs with sh after new files are written or the combined file
+changes (and again on the next run if it failed), with JARL_CERT_NAME,
+JARL_CERT_DIR, JARL_CERT_CERT, JARL_CERT_CHAIN, JARL_CERT_FULLCHAIN,
+JARL_CERT_KEY, JARL_CERT_COMBINED (empty without --combined),
+JARL_CERT_DOMAINS, JARL_CERT_SERIAL, JARL_CERT_NOT_AFTER and
+JARL_CERT_RENEWED (1 when it replaced an older certificate).
+
+--local doesn't ask jarld: it uses the files this host has, writes the
+combined file and runs the hook. Use it after changing --combined or
+--hook, or to test a hook.`,
 		Example: `  jarl cert get mail -d mail.adbraun.lol --hook 'systemctl reload postfix dovecot'
-  jarl cert get proxy -d adbraun.lol -d '*.adbraun.lol' --dir /etc/haproxy/certs/proxy \
-      --hook 'cat "$JARL_CERT_KEY" "$JARL_CERT_FULLCHAIN" > /etc/haproxy/proxy.pem && systemctl reload haproxy'
+  jarl cert get proxy -d adbraun.lol -d '*.adbraun.lol' \
+      --combined /etc/haproxy/certs/adbraun.lol.pem --hook 'systemctl reload haproxy'
+  jarl cert get proxy --hook 'systemctl reload haproxy' --local   # change a setting, apply it now
   jarl cert get                      # every saved certificate (what the timer runs)
   jarl cert saved                    # what this host has, and when it expires`,
 		Args: cobra.MaximumNArgs(1),
@@ -414,6 +551,9 @@ replaced an older certificate).`,
 			}
 			var todo []savedCert
 			f := cmd.Flags()
+			if local && force {
+				return errors.New("--local and --force don't go together: --local always writes the combined file and runs the hook; --force downloads again from jarld")
+			}
 			switch {
 			case len(args) == 0:
 				if len(domains) > 0 {
@@ -422,6 +562,11 @@ replaced an older certificate).`,
 				if len(saved) == 0 {
 					return fmt.Errorf("no saved certificates in %s: get one first (jarl cert get NAME -d DOMAIN)", cdir)
 				}
+				for _, n := range []string{"dir", "hook", "key-type", "combined", "replace", "no-save"} {
+					if f.Changed(n) {
+						return fmt.Errorf("--%s changes one certificate: give its name (jarl cert get NAME --%s ...)", n, n)
+					}
+				}
 				todo = saved
 			default:
 				name := args[0]
@@ -434,6 +579,9 @@ replaced an older certificate).`,
 				}
 				sc.Name = name
 				if len(domains) > 0 {
+					if local && i >= 0 && !sameNames(domains, sc.Domains) {
+						return fmt.Errorf("%s: new names need a new certificate from jarld: run jarl cert get %s without --local", name, name)
+					}
 					sc.Domains = domains
 				}
 				if f.Changed("dir") || sc.Dir == "" {
@@ -445,6 +593,16 @@ replaced an older certificate).`,
 				if f.Changed("key-type") {
 					sc.KeyType = keyType
 				}
+				if f.Changed("combined") {
+					sc.Combined = ""
+					if combined != "" {
+						abs, err := filepath.Abs(combined)
+						if err != nil {
+							return err
+						}
+						sc.Combined = abs
+					}
+				}
 				if abs, err := filepath.Abs(sc.Dir); err == nil {
 					sc.Dir = abs
 				}
@@ -466,14 +624,19 @@ replaced an older certificate).`,
 			var failed []string
 			var lastErr error
 			for _, sc := range todo {
-				c, err := sc.Conn.open()
-				if err == nil {
-					var r *getResult
-					r, err = fetchCert(c, sc, force, wait)
-					if r != nil {
-						results = append(results, r)
+				var r *getResult
+				var err error
+				if local {
+					r, err = localCert(sc)
+				} else {
+					var c *client.Client
+					if c, err = sc.Conn.open(); err == nil {
+						r, err = fetchCert(c, sc, force, wait)
 					}
 				}
+				if r != nil {
+					results = append(results, r)
+				}
 				if err != nil {
 					if len(todo) > 1 {
 						fmt.Fprintln(os.Stderr, "error:", err)
@@ -492,8 +655,16 @@ replaced an older certificate).`,
 			if err := output(results, func(w io.Writer) {
 				for _, r := range results {
 					what := "up to date"
-					if r.Updated {
+					switch {
+					case r.Updated:
 						what = "new files"
+					case local:
+						what = "this host's files"
+					case r.CombinedWritten:
+						what = "combined file written"
+					}
+					if r.Combined != "" {
+						what += ", combined " + r.Combined
 					}
 					fmt.Fprintf(w, "%s\t%s\t%s, expires %s\t%s\n", r.Name, r.Dir, what, r.NotAfter.Local().Format("2006-01-02"), hookText(r.Hook))
 				}
@@ -512,7 +683,9 @@ replaced an older certificate).`,
 	f := cmd.Flags()
 	f.StringArrayVarP(&domains, "domain", "d", nil, "a name for the certificate (repeatable; a wildcard as '*.adbraun.lol')")
 	f.StringVar(&dir, "dir", "", "directory for the files (default /etc/jarl/certs/NAME as root, ./NAME otherwise)")
-	f.StringVar(&hook, "hook", "", "shell command to run after new files are written")
+	f.StringVar(&hook, "hook", "", "shell command to run after new files are written ('' removes it)")
+	f.StringVar(&combined, "combined", "", "also write the key and full chain in one file at this path, for HAProxy ('' stops it)")
+	f.BoolVar(&local, "local", false, "don't ask jarld: write the combined file and run the hook from this host's files")
 	f.StringVar(&keyType, "key-type", "", "key type of a new certificate: ec256 (default), ec384, rsa2048, rsa3072, rsa4096")
 	f.BoolVar(&force, "force", false, "download and run the hook even when this host has the current certificate")
 	f.BoolVar(&noSave, "no-save", false, "don't save the settings for later runs")
@@ -533,9 +706,15 @@ func hookText(h string) string {
 func certSavedCmd() *cobra.Command {
 	var configDir string
 	cmd := &cobra.Command{
-		Use:   "saved",
+		Use:   "saved [NAME]",
 		Short: "The certificates this host gets with jarl cert get, and when they expire",
-		Args:  cobra.NoArgs,
+		Long: `Lists the certificates saved on this host by jarl cert get. With a name,
+shows all of that certificate's settings and what this host has of it.
+The token is never shown.`,
+		Example: `  jarl cert saved
+  jarl cert saved proxy
+  jarl cert saved -o json`,
+		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cdir := certConfigDir(configDir)
 			saved, err := loadSaved(cdir)
@@ -548,17 +727,27 @@ func certSavedCmd() *cobra.Command {
 			}
 			var rows []row
 			for _, sc := range saved {
+				if len(args) == 1 && sc.Name != args[0] {
+					continue
+				}
 				sc.Conn.Token = "" // never print it
 				m, _ := readMeta(sc.Dir)
 				rows = append(rows, row{sc, m})
 			}
+			if len(args) == 1 {
+				if len(rows) == 0 {
+					return fmt.Errorf("%s isn't saved in %s (jarl cert saved lists what is)", args[0], cdir)
+				}
+				r := rows[0]
+				return output(r, func(w io.Writer) { printSaved(w, r.savedCert, r.Local) })
+			}
 			return output(rows, func(w io.Writer) {
 				if len(rows) == 0 {
 					fmt.Fprintf(w, "No saved certificates in %s.\n", cdir)
 					return
 				}
 				tw := tabwriter.NewWriter(w, 0, 0, 2, ' ', 0)
-				fmt.Fprintln(tw, "NAME\tNAMES\tDIR\tEXPIRES\tFETCHED\tSERVER\tHOOK")
+				fmt.Fprintln(tw, "NAME\tNAMES\tDIR\tCOMBINED\tEXPIRES\tFETCHED\tSERVER\tHOOK")
 				for _, r := range rows {
 					exp, fetched := "-", "-"
 					if r.Local != nil {
@@ -568,7 +757,7 @@ func certSavedCmd() *cobra.Command {
 							fetched += " HOOK FAILED"
 						}
 					}
-					fmt.Fprintf(tw, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", r.Name, strings.Join(r.Domains, ","), r.Dir, exp, fetched, r.Conn.Server, firstNonEmpty(r.Hook, "-"))
+					fmt.Fprintf(tw, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n", r.Name, strings.Join(r.Domains, ","), r.Dir, dash(r.Combined), exp, fetched, r.Conn.Server, firstNonEmpty(r.Hook, "-"))
 				}
 				tw.Flush()
 			})
@@ -578,6 +767,37 @@ func certSavedCmd() *cobra.Command {
 	return cmd
 }
 
+// printSaved shows one saved certificate: its settings, then this
+// host's copy.
+func printSaved(w io.Writer, sc savedCert, m *localMeta) {
+	fmt.Fprintf(w, "Name:\t%s\n", sc.Name)
+	fmt.Fprintf(w, "Names:\t%s\n", strings.Join(sc.Domains, " "))
+	fmt.Fprintf(w, "Key type:\t%s\n", firstNonEmpty(sc.KeyType, "ec256 (default)"))
+	fmt.Fprintf(w, "Dir:\t%s\n", sc.Dir)
+	fmt.Fprintf(w, "Combined:\t%s\n", dash(sc.Combined))
+	fmt.Fprintf(w, "Hook:\t%s\n", dash(sc.Hook))
+	fmt.Fprintf(w, "Server:\t%s\n", sc.Conn.Server)
+	if sc.Conn.CACert != "" {
+		fmt.Fprintf(w, "CA cert:\t%s\n", sc.Conn.CACert)
+	}
+	if sc.Conn.Insecure {
+		fmt.Fprintf(w, "TLS:\tnot verified (--insecure)\n")
+	}
+	if !sc.SavedAt.IsZero() {
+		fmt.Fprintf(w, "Saved:\t%s\n", fmtTime(&sc.SavedAt))
+	}
+	if m == nil {
+		fmt.Fprintf(w, "Files:\tnone yet (jarl cert get %s fetches them)\n", sc.Name)
+		return
+	}
+	fmt.Fprintf(w, "Serial:\t%s\n", m.Serial)
+	fmt.Fprintf(w, "Expires:\t%s (%dd)\n", fmtTime(&m.NotAfter), int(time.Until(m.NotAfter).Hours()/24))
+	fmt.Fprintf(w, "Fetched:\t%s\n", fmtTime(&m.Fetched))
+	if m.HookFailed != "" {
+		fmt.Fprintf(w, "Hook failed:\t%s (the next jarl cert get runs it again)\n", m.HookFailed)
+	}
+}
+
 func certForgetCmd() *cobra.Command {
 	var configDir string
 	var del, yes bool

cmd/jarl/certget_test.go

@@ -1,10 +1,19 @@
 package main
 
 import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestCheckCertClash(t *testing.T) {
@@ -57,3 +66,138 @@ func mkdir(t *testing.T, dir string) string {
 	}
 	return dir
 }
+
+func TestCheckCombined(t *testing.T) {
+	tmp := t.TempDir()
+	saved := []savedCert{
+		{Name: "proxy", Dir: filepath.Join(tmp, "proxy"), Combined: filepath.Join(tmp, "haproxy", "proxy.pem")},
+		{Name: "mail", Dir: filepath.Join(tmp, "mail")},
+	}
+	mkdir(t, filepath.Join(tmp, "haproxy"))
+	cases := []struct {
+		what string
+		i    int
+		sc   savedCert
+		want string
+	}{
+		{"none", 1, savedCert{Name: "mail", Dir: saved[1].Dir}, ""},
+		{"own again", 0, saved[0], ""},
+		{"beside the others", 1, savedCert{Name: "mail", Dir: saved[1].Dir, Combined: filepath.Join(tmp, "haproxy", "mail.pem")}, ""},
+		{"inside its own dir", 1, savedCert{Name: "mail", Dir: saved[1].Dir, Combined: filepath.Join(saved[1].Dir, "combined.pem")}, ""},
+		{"another's combined", 1, savedCert{Name: "mail", Dir: saved[1].Dir, Combined: saved[0].Combined}, "combined file of proxy"},
+		{"own fullchain", 1, savedCert{Name: "mail", Dir: saved[1].Dir, Combined: filepath.Join(saved[1].Dir, "fullchain.pem")}, "overwrite mail's fullchain.pem"},
+		{"another's key", 1, savedCert{Name: "mail", Dir: saved[1].Dir, Combined: filepath.Join(saved[0].Dir, "privkey.pem")}, "overwrite proxy's privkey.pem"},
+		{"a directory", 1, savedCert{Name: "mail", Dir: saved[1].Dir, Combined: filepath.Join(tmp, "haproxy")}, "is a directory"},
+	}
+	for _, c := range cases {
+		err := checkCombined(saved, c.i, c.sc)
+		switch {
+		case c.want == "" && err != nil:
+			t.Errorf("%s: %v", c.what, err)
+		case c.want != "" && (err == nil || !strings.Contains(err.Error(), c.want)):
+			t.Errorf("%s: got %v, want %q", c.what, err, c.want)
+		}
+	}
+}
+
+// TestApplyCert: the combined file follows --combined, and the hook runs
+// only when something changed (always with --local).
+func TestApplyCert(t *testing.T) {
+	tmp := t.TempDir()
+	dir := mkdir(t, filepath.Join(tmp, "proxy"))
+	full, key := testKeyPair(t)
+	for name, data := range map[string][]byte{"cert.pem": full, "chain.pem": nil, "fullchain.pem": full, "privkey.pem": key} {
+		if err := os.WriteFile(filepath.Join(dir, name), data, 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := (&localMeta{Name: "proxy", Serial: "1", NotAfter: time.Now().Add(time.Hour)}).write(dir); err != nil {
+		t.Fatal(err)
+	}
+	runs := filepath.Join(tmp, "runs")
+	sc := savedCert{Name: "proxy", Dir: dir, Hook: `echo "$JARL_CERT_COMBINED" >> ` + runs}
+	hookRuns := func() []string {
+		b, _ := os.ReadFile(runs)
+		return strings.Fields(string(b))
+	}
+	apply := func(local bool) *getResult {
+		t.Helper()
+		var r *getResult
+		var err error
+		if local {
+			r, err = localCert(sc)
+		} else {
+			meta, _ := readMeta(dir)
+			r, err = applyCert(sc, meta, false, false, false)
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+		return r
+	}
+
+	if r := apply(false); r.CombinedWritten || len(hookRuns()) != 0 {
+		t.Fatalf("nothing changed, but: %+v, hook ran %d times", r, len(hookRuns()))
+	}
+	first := filepath.Join(tmp, "haproxy", "proxy.pem")
+	sc.Combined = first
+	if r := apply(false); !r.CombinedWritten || len(hookRuns()) != 1 {
+		t.Fatalf("new --combined: %+v, hook ran %d times", r, len(hookRuns()))
+	}
+	b, err := os.ReadFile(first)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tls.X509KeyPair(b, b); err != nil || !strings.HasPrefix(string(b), string(key)) {
+		t.Errorf("combined file isn't the key, then the chain: %v", err)
+	}
+	if st, _ := os.Stat(first); st.Mode().Perm() != 0o600 {
+		t.Errorf("combined file mode %v, want 600", st.Mode().Perm())
+	}
+	if r := apply(false); r.CombinedWritten || len(hookRuns()) != 1 {
+		t.Fatalf("second run changed something: %+v, hook ran %d times", r, len(hookRuns()))
+	}
+	os.Remove(first)
+	if r := apply(false); !r.CombinedWritten || len(hookRuns()) != 2 {
+		t.Fatalf("missing combined file not rewritten: %+v", r)
+	}
+	if r := apply(true); !r.CombinedWritten || len(hookRuns()) != 3 {
+		t.Fatalf("--local: %+v, hook ran %d times", r, len(hookRuns()))
+	}
+	second := filepath.Join(tmp, "haproxy", "adbraun.lol.pem")
+	sc.Combined = second
+	apply(false)
+	if _, err := os.Stat(first); !os.IsNotExist(err) {
+		t.Errorf("old combined file %s not removed: %v", first, err)
+	}
+	if _, err := os.Stat(second); err != nil {
+		t.Errorf("new combined file: %v", err)
+	}
+	sc.Combined = ""
+	apply(false)
+	if _, err := os.Stat(second); !os.IsNotExist(err) {
+		t.Errorf("--combined '' left %s: %v", second, err)
+	}
+	// Five runs; the last had JARL_CERT_COMBINED empty, so echo wrote no field.
+	if got := hookRuns(); len(got) != 4 || got[3] != second {
+		t.Errorf("hook runs: %q", got)
+	}
+}
+
+func testKeyPair(t *testing.T) (certPEM, keyPEM []byte) {
+	t.Helper()
+	k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tpl := &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "proxy.example"}, NotBefore: time.Now(), NotAfter: time.Now().Add(time.Hour)}
+	der, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &k.PublicKey, k)
+	if err != nil {
+		t.Fatal(err)
+	}
+	kd, err := x509.MarshalECPrivateKey(k)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: kd})
+}

cmd/jarl/certs.go

@@ -50,6 +50,7 @@ type certInfo struct {
 		Chain string `json:"chain"`
 		Key   string `json:"key"`
 	} `json:"files,omitempty"`
+	OwnerID  int64  `json:"owner_id,omitempty"`
 	Owner    string `json:"owner,omitempty"`
 	PulledBy []struct {
 		Who    string    `json:"who"`
@@ -131,7 +132,7 @@ func certListCmd() *cobra.Command {
 				return err
 			}
 			return output(r.Certificates, func(w io.Writer) {
-				fmt.Fprintln(w, "NAME\tSOURCE\tUSES\tNAMES\tEXPIRES\tSTATUS")
+				fmt.Fprintln(w, "NAME\tSOURCE\tUSES\tNAMES\tEXPIRES\tPULLED\tSTATUS")
 				for _, ci := range r.Certificates {
 					names := ci.Names
 					if len(names) == 0 {
@@ -141,13 +142,32 @@ func certListCmd() *cobra.Command {
 					if ci.IssuingSince != nil {
 						state = "obtaining"
 					}
-					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\n", ci.Name, ci.Source, dash(strings.Join(ci.Uses, ",")), strings.Join(names, " "), fmtDate(ci.NotAfter), state)
+					uses := strings.Join(ci.Uses, ",")
+					if uses == "" && ci.OwnerID != 0 {
+						uses = "get" // for another host (jarl cert get)
+					}
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", ci.Name, ci.Source, dash(uses), strings.Join(names, " "), fmtDate(ci.NotAfter), lastPull(ci), state)
 				}
 			})
 		},
 	}
 }
 
+// lastPull is when the certificate was last downloaded, marked "(old)"
+// while someone who downloaded it still has the one before its renewal.
+func lastPull(ci certInfo) string {
+	if len(ci.PulledBy) == 0 {
+		return "-"
+	}
+	s := fmtDate(&ci.PulledBy[0].At) // newest first
+	for _, p := range ci.PulledBy {
+		if p.Serial != ci.Serial {
+			return s + " (old)"
+		}
+	}
+	return s
+}
+
 func fmtDate(t *time.Time) string {
 	if t == nil {
 		return "-"

docs/api.md

@@ -603,7 +603,7 @@ Administrators only. See [certificates.md](certificates.md#api).
 
 | Method | Path | Body |
 |--------|------|------|
-| GET | `/certificates` | `certificates` (with `status`, `next_attempt`, `issuing_since`, `serving`, `files`) and `account` |
+| GET | `/certificates` | `certificates` (with `status`, `next_attempt`, `issuing_since`, `serving`, `files`, and for one obtained with `jarl cert get` `owner_id`, `owner` and `pulled_by`: every download for an administrator, the caller's own for the owner) and `account` |
 | POST | `/certificates` | `{"name", "domains", "uses", "challenge", "key_type", "comment"}`, or `{"name", "source": "file", "cert_file", "key_file", "uses"}`; `"issue": false` doesn't start obtaining it |
 | POST | `/certificates/check` | `{"domains", "challenge"}`: the route of each challenge |
 | GET, PATCH, DELETE | `/certificates/{name}` | |

docs/certificates.md

@@ -274,6 +274,7 @@ export JARL_SERVER=https://jarl.adbraun.lol:8053 JARL_TOKEN=@/root/jarl.token
 jarl cert get mail -d mail.adbraun.lol -d smtp.adbraun.lol --hook 'systemctl reload postfix dovecot'
 sudo jarl cert schedule                    # a daily systemd timer runs 'jarl cert get'
 jarl cert saved                            # what this host has, and when it expires
+jarl cert saved mail                       # all of mail's settings
 ```
 
 * **Asking again** with the same names returns the certificate jarld has:
@@ -286,12 +287,26 @@ jarl cert saved                            # what this host has, and when it exp
   expiry, when it was fetched). Each file is replaced at once, never
   half written. The key is checked against the certificate before
   anything is written.
-* **Saved settings**: the names, `--dir`, `--hook`, the server and the
-  token are saved in `/etc/jarl/cert-get/NAME.json` (as root;
-  `~/.config/jarl/cert-get` otherwise), readable only by their owner.
-  `jarl cert get` without a name does every saved certificate. A token
-  given as `@FILE` is saved as that reference, not copied. `jarl cert
-  forget NAME` stops getting one (`--delete` deletes it on jarld too).
+* **A combined file** (`--combined PATH`): the key, then the full chain,
+  in one file (mode 600), as HAProxy wants. See [HAProxy](#haproxy).
+* **Saved settings**: the names, `--dir`, `--combined`, `--hook`, the
+  server and the token are saved in `/etc/jarl/cert-get/NAME.json` (as
+  root; `~/.config/jarl/cert-get` otherwise), readable only by their
+  owner. `jarl cert get` without a name does every saved certificate. A
+  token given as `@FILE` is saved as that reference, not copied. `jarl
+  cert saved NAME` shows them all (the token never). `jarl cert forget
+  NAME` stops getting one (`--delete` deletes it on jarld too).
+* **Changing a setting**: run `jarl cert get NAME` with just that option
+  (`--hook '...'`, `--combined PATH`, `--dir DIR`); the others stay.
+  `--hook ''` removes the hook, `--combined ''` stops writing the
+  combined file and deletes it. The run still asks jarld for the
+  certificate, but downloads nothing while this host has the current one.
+  A new or moved combined file is written from the files this host
+  already has, and the hook runs.
+* **`--local`** doesn't ask jarld at all: it writes the combined file and
+  runs the hook from the files this host has. Use it to apply a changed
+  setting while jarld is unreachable, or to test a hook. New names still
+  need jarld.
 * **Several Jarl servers on one host**: each server has its own
   certificate names, so two servers may both have a `proxy`. The host
   keeps one `proxy` per settings directory, though: asking another server
@@ -299,12 +314,14 @@ jarl cert saved                            # what this host has, and when it exp
   holding another certificate's files. Choose another name or `--dir`, or
   pass `--replace` to take the name (or directory) over. A `--dir` that
   another saved certificate uses is always refused.
-* **The hook** runs with `sh` after new files are written, with
-  `JARL_CERT_NAME`, `JARL_CERT_DIR`, `JARL_CERT_CERT`, `JARL_CERT_CHAIN`,
-  `JARL_CERT_FULLCHAIN`, `JARL_CERT_KEY`, `JARL_CERT_DOMAINS`,
-  `JARL_CERT_SERIAL`, `JARL_CERT_NOT_AFTER` and `JARL_CERT_RENEWED` (1 when
-  it replaced an older certificate). If it fails, `jarl cert get` exits
-  non-zero and runs it again next time. It has 5 minutes.
+* **The hook** runs with `sh` after new files are written or the
+  combined file changes (and with `--local`), with `JARL_CERT_NAME`,
+  `JARL_CERT_DIR`, `JARL_CERT_CERT`, `JARL_CERT_CHAIN`,
+  `JARL_CERT_FULLCHAIN`, `JARL_CERT_KEY`, `JARL_CERT_COMBINED` (empty
+  without `--combined`), `JARL_CERT_DOMAINS`, `JARL_CERT_SERIAL`,
+  `JARL_CERT_NOT_AFTER` and `JARL_CERT_RENEWED` (1 when it replaced an
+  older certificate). If it fails, `jarl cert get` exits non-zero and runs
+  it again next time. It has 5 minutes.
 * **`jarl cert schedule`** (Linux with systemd, as root) writes
   `/etc/systemd/system/jarl-cert-get.service` and `.timer`, which run
   `jarl cert get` daily at a random time within the hour after midnight,
@@ -314,7 +331,44 @@ jarl cert saved                            # what this host has, and when it exp
 **On the Certificates page**, the administrators see each certificate's
 owner and who downloaded it: the token, from where, when, and whether
 that host has the current certificate or hasn't fetched the renewed one
-yet. `jarl cert show NAME` says the same.
+yet. `jarl cert show NAME` says the same. The owner's own tokens see
+their own downloads there too. In `jarl cert list`, such a certificate's
+USES is `get`, and PULLED is the last download, with `(old)` while a host
+hasn't fetched the renewed one.
+
+### HAProxy
+
+HAProxy wants the key and the chain in one file. Give `jarl cert get` a
+`--combined` path outside `--dir`:
+
+```sh
+jarl cert get proxy -d adbraun.lol -d '*.adbraun.lol' \
+    --combined /etc/haproxy/certs/adbraun.lol.pem --hook 'systemctl reload haproxy'
+jarl cert get webmail -d webmail.adbraun.lol \
+    --combined /etc/haproxy/certs/webmail.pem --hook 'systemctl reload haproxy'
+```
+
+```
+frontend https
+    bind :443 ssl crt /etc/haproxy/certs/
+```
+
+HAProxy loads every file in a `crt` directory and picks one by SNI, so
+`/etc/haproxy/certs` should hold only combined files. Don't point `crt`
+at `--dir` (`/etc/jarl/certs/NAME`): HAProxy would try to load
+`cert.pem`, `privkey.pem` and `jarl-cert.json` there too, and refuse
+to start. A `--combined` path that would overwrite a file in a saved
+certificate's directory, or another certificate's combined file, is
+refused.
+
+The combined file is mode 600, owned by the user running `jarl cert get`
+(root under the timer). HAProxy reads its certificates as root before it
+drops privileges, so that's fine.
+
+To add a combined file to a certificate this host already has, run
+`jarl cert get proxy --combined /etc/haproxy/certs/adbraun.lol.pem`: it's
+written from the files on disk and the hook runs, with nothing
+downloaded.
 
 ## Security notes
 

docs/cli.md

@@ -452,7 +452,10 @@ jarl cert export mail --part bundle                  # one part to stdout: fullc
 jarl cert get mail -d mail.adbraun.lol --hook 'systemctl reload postfix'   # on another host: get, download, hook
 jarl cert get                                        # every saved certificate (what the timer runs)
 jarl cert get proxy -s other --replace               # take over a name saved here for another server
+jarl cert get proxy --combined /etc/haproxy/certs/proxy.pem   # also key + chain in one file (HAProxy); '' stops it
+jarl cert get proxy --hook 'systemctl reload haproxy' --local  # change a setting; apply it from this host's files, without jarld
 jarl cert saved                                      # this host's certificates and their expiry
+jarl cert saved proxy                                # all of one certificate's settings (never the token)
 jarl cert forget mail [--delete]                     # stop getting it here
 sudo jarl cert schedule [--remove]                   # daily systemd timer for jarl cert get
 jarl cert delete ns1

internal/server/h_certs.go

@@ -33,7 +33,8 @@ type certView struct {
 	// IssuingSince is set while Jarl is obtaining it.
 	IssuingSince *time.Time `json:"issuing_since,omitempty"`
 	// Owner is the user a certificate for another host belongs to; PulledBy
-	// who downloaded it (list and get, administrators only).
+	// who downloaded it (list and get; an owner who isn't an administrator
+	// sees only their own downloads).
 	Owner    string                  `json:"owner,omitempty"`
 	PulledBy []model.CertificatePull `json:"pulled_by,omitempty"`
 }
@@ -116,12 +117,27 @@ func (s *Server) certFor(r *http.Request, p *auth.Principal, write bool) (*model
 	return c, nil
 }
 
-// withOwners adds owners and downloads to views (for administrators).
-func (s *Server) withOwners(ctx context.Context, views []certView) error {
+// withOwners adds owners and downloads to views: all of them for an
+// administrator, the principal's own downloads for anyone else (who sees
+// only their own certificates).
+func (s *Server) withOwners(ctx context.Context, p *auth.Principal, views []certView) error {
 	pulls, err := s.store.CertificatePulls(ctx)
 	if err != nil {
 		return err
 	}
+	if !p.IsAdmin() {
+		for i := range views {
+			for _, pl := range pulls[views[i].ID] {
+				if p.User != nil && pl.UserID == p.User.ID {
+					views[i].PulledBy = append(views[i].PulledBy, pl)
+				}
+			}
+			if p.User != nil && views[i].OwnerID != 0 {
+				views[i].Owner = p.User.Username
+			}
+		}
+		return nil
+	}
 	users, err := s.store.ListUsers(ctx)
 	if err != nil {
 		return err
@@ -179,13 +195,13 @@ func (s *Server) certList(w http.ResponseWriter, r *http.Request, p *auth.Princi
 		v.NamedUse = encdns.CertUses(st, s.cfg.Certs.FilesDir(c.Name))
 		out = append(out, v)
 	}
+	if err := s.withOwners(r.Context(), p, out); err != nil {
+		return err
+	}
 	if !p.IsAdmin() {
 		writeJSON(w, http.StatusOK, map[string]any{"certificates": out})
 		return nil
 	}
-	if err := s.withOwners(r.Context(), out); err != nil {
-		return err
-	}
 	writeJSON(w, http.StatusOK, map[string]any{"certificates": out, "account": s.cfg.Certs.AccountInfo(r.Context())})
 	return nil
 }
@@ -205,13 +221,11 @@ func (s *Server) certGet(w http.ResponseWriter, r *http.Request, p *auth.Princip
 	}
 	v := s.presentCert(c)
 	v.NamedUse = encdns.CertUses(st, s.cfg.Certs.FilesDir(c.Name))
-	if p.IsAdmin() {
-		vs := []certView{v}
-		if err := s.withOwners(r.Context(), vs); err != nil {
-			return err
-		}
-		v = vs[0]
+	vs := []certView{v}
+	if err := s.withOwners(r.Context(), p, vs); err != nil {
+		return err
 	}
+	v = vs[0]
 	writeJSON(w, http.StatusOK, v)
 	return nil
 }

scripts/e2e.sh

@@ -939,6 +939,23 @@ if [ -n "$PEBBLE" ]; then
 	if [ "$(wc -l < $CGD/hook.log)" = 1 ]; then ok "the hook didn't run again"; else bad "hook ran again: $(cat $CGD/hook.log)"; fi
 	run "cert saved" 0 $J cert saved --config-dir $CGD/conf
 	contains "mail  *mail.adbraun.test .*$CGD/mail"
+	run "the owner's cert list: for jarl cert get, downloaded today" 0 $J $CG cert list
+	contains "^mail  *acme  *get  *mail.adbraun.test  *[0-9-]*  *$(date +%Y-%m-%d)  *ok"
+	run "cert get --combined: written from this host's files" 0 $J cert get mail --combined $CGD/haproxy/mail.pem --config-dir $CGD/conf
+	contains "mail .*combined file written, combined $CGD/haproxy/mail.pem"
+	run "the combined file is mode 600" 0 stat -c %a $CGD/haproxy/mail.pem
+	contains "^600$"
+	run "it holds the key" 0 sh -c "openssl pkey -in $CGD/haproxy/mail.pem -pubout | cmp - $CGD/pub.pem"
+	run "and the certificate" 0 sh -c "openssl x509 -in $CGD/haproxy/mail.pem -noout -serial | cmp - \$(openssl x509 -in $CGD/mail/cert.pem -noout -serial > $CGD/serial; echo $CGD/serial)"
+	if [ "$(wc -l < $CGD/hook.log)" = 2 ]; then ok "the hook ran for the combined file"; else bad "hook runs: $(cat $CGD/hook.log)"; fi
+	run "cert saved NAME shows every setting" 0 $J cert saved mail --config-dir $CGD/conf
+	contains "^Combined: *$CGD/haproxy/mail.pem$"
+	contains "^Hook: *echo"
+	run "a combined path inside the files' directory is refused" 1 $J cert get mail --combined $CGD/mail/fullchain.pem --config-dir $CGD/conf
+	contains "would overwrite mail's fullchain.pem"
+	run "cert get --local: the hook runs from this host's files" 0 $J cert get mail --local --config-dir $CGD/conf
+	contains "mail .*this host's files"
+	if [ "$(wc -l < $CGD/hook.log)" = 3 ]; then ok "the hook ran with --local"; else bad "hook runs: $(cat $CGD/hook.log)"; fi
 	run "another user can't take the name (exit 5)" 5 $J --token @$E/hosts2.token cert get mail -d mail.adbraun.test --dir $CGD/x --no-save --config-dir $CGD/conf2
 	contains "taken"
 	run "an ACME token can't get certificates (exit 3)" 3 $J --token @$E/nocert.token cert get x -d x.adbraun.test --dir $CGD/x --no-save --config-dir $CGD/conf2
@@ -951,6 +968,11 @@ if [ -n "$PEBBLE" ]; then
 	contains "mail .*new files"
 	run "the hook ran for the renewal" 0 tail -1 $CGD/hook.log
 	contains "^mail 1 privkey.pem$"
+	run "the combined file has the renewed certificate" 0 sh -c "openssl x509 -in $CGD/haproxy/mail.pem -noout -serial | cmp - \$(openssl x509 -in $CGD/mail/cert.pem -noout -serial > $CGD/serial; echo $CGD/serial)"
+	run "the owner sees the download is current" 0 $J $CG cert list
+	if echo "$OUT" | grep -q "(old)"; then bad "owner's list says (old)"; else ok "no (old) after the download"; fi
+	run "cert get --combined '': the combined file is removed" 0 $J cert get mail --combined '' --config-dir $CGD/conf
+	if [ ! -e $CGD/haproxy/mail.pem ]; then ok "combined file removed"; else bad "combined file still there"; fi
 	run "a name added: obtained again" 0 $J cert get mail -d mail.adbraun.test -d smtp.adbraun.test --config-dir $CGD/conf
 	run "the new certificate has both names" 0 openssl x509 -in $CGD/mail/cert.pem -noout -ext subjectAltName
 	contains "smtp.adbraun.test"