Action Chains:
0. Setup of certificate manager, one per site 
           (root/sudo access, mailserver, certbot, webserver)
a. central certificate manager:
Cert_manager: asceds-certmanager-setup [-s <cert_manager>]
     Cert_manager: asceds-update-siteconfig -s
Cert_manager: edit CERTBOTOPTS in /etc/asceds/asceds-certbot.conf

b. standalone mode:
Client: asceds-standalone-setup
Client: edit CERTBOTOPTS in /etc/asceds/asceds-certbot.conf

c. disable standalone mode:
Client: asceds-standalone-setup -d

------------------------------------------------------
1. Initial setup or OS upgrades of clients

a. managed clients, root/sudo@cert_manager ssh access:
Client: asceds-init [-s <cert_manager_URL>]
     [Client: asceds-standalone-setup -d]
     Client: asceds-update-siteconfig -c
     Client: asceds-clean
     Client: asceds-sans-update -l [-r]
     Cert_manager: asceds-client-setup -s -c <client>
         Cert_manager: asceds-certbot-gencert -e -c <client> -s <sans>
         Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>
     Client: asceds-service-reconfig -q -t
     Client: asceds-services
         Client: asceds-service-reconfig -s <service>
             Client: asceds-update-siteconfig -q -c

b. managed clients, no root/sudo@cert_manager ssh access, web interface:
Client: asceds-init [-s <cert_manager_URL>]
     [Client: asceds-standalone-setup -d]
     Client: asceds-update-siteconfig -c
     Client: asceds-clean
     Client: asceds-sans-update -l [-r]
Cert_manager web interface: asceds_cert.php
     Cert_manager: asceds-test-return -c <client>
     Cert_manager: asceds-web-propagate -c <client> 
         Cert_manager: asceds-client-setup -c <client>
             Cert_manager: asceds-certbot-gencert -e -c <client> -s <sans>
             Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>
Client: asceds-services
    Client: asceds-service-reconfig -s <service>
               Client: asceds-update-siteconfig -q -c

c. unmanaged clients, web interface:
Cert_manager web interface: request_cert.php
     Cert_manager: asceds-web-unmanaged -n -c <client>
          Cert_manager: asceds-certbot-gencert -e -c <client> -s <sans>
Cert_manager web interface: host_check.php
     Cert_manager: download certificate files
Client: reconfigure services

d. standalone mode, local certbot, ACME account or proxy:
Client: asceds-init -d
     Client: asceds-update-siteconfig -c
     Client: asceds-clean
     Client: asceds-sans-update -l [-r]
     Client: asceds-client-setup -s -c <client>
         Client: asceds-certbot-gencert -e -c <client> -s <sans>
         Client: sudo -u asceds -i asceds-send-cert -c <client>
     Client: asceds-service-reconfig -q -t
     Client: asceds-services
         Client: asceds-service-reconfig -s <service>
             Client: asceds-update-siteconfig -q -c

------------------------------------------------------
2. Push automatically renewed certificates to clients

a. fully managed clients or standalone mode:
Automatic renewal by certbot (systemd)
Cert_manager crontab: asceds-cert-propagate 
     Cert_manager: asceds-propagate-certbot 
          Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>
          Cert_manager: asceds-client-remove -c <offline_client>
Client crontab: asceds-cert-refresh 
     Client: asceds-service-reconfig -t
          Client: asceds-update-siteconfig -q -c

b. privately managed clients, root/sudo@cert_manager ssh access:
Automatic renewal by certbot (systemd)
Cert_manager crontab: asceds-cert-propagate
     Cert_manager: asceds-propagate-certbot 
          Cert_manager: asceds-mailto-alarm
Client: allow r/w ssh access for asceds account from Cert_manager
Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>
Client: asceds-service-reconfig -t
     Client: asceds-update-siteconfig -q -c

c. privately managed clients, no root/sudo@cert_manager ssh access, web interface:
Automatic renewal by certbot (systemd)
Cert_manager crontab: asceds-cert-propagate
     Cert_manager: asceds-propagate-certbot 
          Cert_manager: asceds-mailto-alarm
Client: allow r/w ssh access for asceds account from Cert_manager
Cert_manager web interface: asceds_cert.php
     Cert_manager: asceds-test-return -c <client>
     Cert_manager: asceds-web-propagate -c <client> 
          Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>
Client: asceds-service-reconfig -t
     Client: asceds-update-siteconfig -q -c

d. unmanaged clients, web interface:
Cert_manager crontab: asceds-cert-propagate
     Cert_manager: asceds-propagate-certbot 
          Cert_manager: new certificate email notification
Cert_manager web interface: host_check.php
     Cert_manager: download certificate files
Client: reconfigure services

------------------------------------------------------
3. SANs refresh (manual sequence)

a. managed clients, root/sudo@cert_manager ssh access, or standalone mode:
Client: asceds-sans-update [-r] [-a <hostname>,...]  [-d <hostname>,...]
Cert_manager: asceds-client-setup -c <client>
     Cert_manager: asceds-certbot-gencert -e -c <client> -s <sans>
     Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>
Client: asceds-service-reconfig -t
     Client: asceds-update-siteconfig -q -c

b. managed clients, no root/sudo@cert_manager ssh access, web interface:
Client: asceds-sans-update [-r] [-a <hostname>,...]  [-d <hostname>,...]
Cert_manager web interface: asceds_cert.php
     Cert_manager: asceds-test-return -c <client>
     Cert_manager: asceds-web-propagate -c <client>
          Cert_manager: asceds-client-setup -c <client>
               Cert_manager: asceds-certbot-gencert -e -c <client> -s <sans>
               Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>
Client: asceds-service-reconfig -t
     Client: asceds-update-siteconfig -q -c

c. unmanaged clients, web interface:
Cert_manager web interface: request_cert.php
     Cert_manager: asceds-web-unmanaged -n -c <client>
          Cert_manager: asceds-certbot-gencert -e -c <client> -s <sans>
Cert_manager web interface: host_check.php
     Cert_manager: download certificate files
Client: reconfigure services

------------------------------------------------------
4. Certificate revoke

a. managed clients, root/sudo@cert_manager ssh access, or standalone mode:
Cert_manager: asceds-certbot-revoke -e -c <client>

b. any client, web interface:
Cert_manager web interface: revoke_cert.php
     Cert_manager: asceds-web-unmanaged -r -c <client>
          Cert_manager: asceds-certbot-revoke -e -c <client>
               Cert_manager: asceds-client-remove -q -c <client>

------------------------------------------------------
5. Site config file management

a. create: 
Cert_manager: asceds-certmanager-setup [-s <certmanager_cname>]
    Cert_manager: asceds-update-siteconfig -s -> 
                  asceds-utils/asceds-build-siteconf

b. update:
Cert_manager: asceds-update-siteconfig -s -> 
                  asceds-utils/asceds-build-siteconf

c. initialize on managed clients, or standalone mode:
Client: asceds-init [-s <certmanager>]
    [Client: asceds-standalone-setup -d]
    Client: asceds-update-siteconfig -c ->
                  asceds-utils/asceds-parse-siteconf

d. automatic propagate trough http on fully managed clients:
Cert_manager crontab: asceds-cert-propagate
    Certmanager: asceds-propagate-certbot
        Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>
        Cert_manager: asceds-client-remove -c <offline_client>
Client crontab: asceds-cert-refresh 
    Client: asceds-service-reconfig -t
        Client: asceds-update-siteconfig -q -c

e. manual propagate on privately managed clients:
Client: allow r/w ssh access for asceds account from Cert_manager
Client: asceds-update-siteconfig -c

------------------------------------------------------
6. Web interface

Apache authenticated web interface on Cert_manager for:
a. Unmanaged client, generate new certificate:
Cert_manager web interface: request_cert.php
    Cert_manager: asceds-web-unmanaged -n -c <client>
        Cert_manager: asceds-certbot-gencert -e -c <client> -s <sans>
Cert_manager web interface: host_check.php
    Cert_manager: download certificate files
Client: reconfigure services

b. Managed client, propagate ASCEDS data (including generate certificate):
Cert_manager web interface: asceds_cert.php
    Cert_manager: asceds-test-return -c <client>
    Cert_manager: asceds-web-propagate -c <client>
        Cert_manager: asceds-client-setup -c <client>
            Cert_manager: asceds-certbot-gencert -e -c <client> -s <sans>
            Cert_manager: sudo -u asceds -i asceds-send-cert -c <client>

c. Revoke certificate (any client):
Cert_manager web interface: revoke_cert.php
    Cert_manager: asceds-web-unmanaged -r -c <client>
        Cert_manager: asceds-certbot-revoke -e -c <client>
            Cert_manager: asceds-client-remove -q -c <client>
------------------------------------------------------
