From a8c50b86185f10e98322ad4bd2e9e7e7a34bc754 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Wed, 6 May 2026 14:08:28 -0700
Subject: [PATCH] Add clear certificates pangctl command

---
 cli/commands/clearCertificates.ts | 28 ++++++++++++++++++++++++++++
 cli/index.ts                      |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 cli/commands/clearCertificates.ts

diff --git a/cli/commands/clearCertificates.ts b/cli/commands/clearCertificates.ts
new file mode 100644
index 000000000..ff6ef8239
--- /dev/null
+++ b/cli/commands/clearCertificates.ts
@@ -0,0 +1,28 @@
+import { CommandModule } from "yargs";
+import { db, certificates } from "@server/db";
+
+type ClearCertificatesArgs = {};
+
+export const clearCertificates: CommandModule<{}, ClearCertificatesArgs> = {
+    command: "clear-certificates",
+    describe: "Delete all entries from the certificates table",
+    builder: (yargs) => {
+        return yargs;
+    },
+    handler: async (argv: {}) => {
+        try {
+            console.log("Clearing all certificates from the database...");
+
+            const deleted = await db.delete(certificates).returning();
+
+            console.log(
+                `Deleted ${deleted.length} certificate(s) from the database`
+            );
+
+            process.exit(0);
+        } catch (error) {
+            console.error("Error:", error);
+            process.exit(1);
+        }
+    }
+};
diff --git a/cli/index.ts b/cli/index.ts
index 7605904ee..3664bb8f8 100644
--- a/cli/index.ts
+++ b/cli/index.ts
@@ -9,6 +9,7 @@ import { rotateServerSecret } from "./commands/rotateServerSecret";
 import { clearLicenseKeys } from "./commands/clearLicenseKeys";
 import { deleteClient } from "./commands/deleteClient";
 import { generateOrgCaKeys } from "./commands/generateOrgCaKeys";
+import { clearCertificates } from "./commands/clearCertificates";
 
 yargs(hideBin(process.argv))
     .scriptName("pangctl")
@@ -19,5 +20,6 @@ yargs(hideBin(process.argv))
     .command(clearLicenseKeys)
     .command(deleteClient)
     .command(generateOrgCaKeys)
+    .command(clearCertificates)
     .demandCommand()
     .help().argv;