Certimate: A Self-Hosted ACME Tool That Automates the Full Certificate Lifecycle
An open-source and free self-hosted SSL certificates ACME tool, automates the full-cycle of issuance, deployment, renewal, and monitoring visually. 完全开源免费的自托管 SSL 证书 ACME 工具，申请、部署、续期、监控全流程自动化可视化，支持各大主流云厂商。.
At a glance
- What is it?
- Certimate is an open-source, self-hosted ACME client that handles issuance, deployment, renewal, and monitoring of SSL certificates through a visual workflow. It supports over 70 DNS providers and 150 deployment targets, but its real value depends on how well it fits your existing infrastructure.
- Who is it for?
- Adopt Certimate if you manage multiple domains across cloud providers and need a visual, low-resource automation layer for certificate issuance and deployment. Skip it if you prefer a CLI-only tool or if your infrastructure lacks one of the supported providers.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 1 day ago.
- What is it written in?
- Mainly Go, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The Problem: Certificate Management Is a Chore
Renewing SSL certificates manually is error-prone. Miss a renewal and your site breaks. Certimate targets that pain point by automating the full cycle: issuance, deployment, renewal, and monitoring. It is aimed at system administrators and DevOps engineers who run their own infrastructure and want a self-hosted solution rather than relying on a third-party SaaS. The README emphasizes that all data is stored locally, which addresses privacy concerns for teams that cannot send certificate private keys to an external service. If you manage certificates across multiple domains or cloud providers, this tool promises to reduce the manual steps to a few clicks.
How Certimate Works: Workflow Orchestration and Provider Integration
Certimate's core mechanism is a visual workflow that connects certificate issuance to deployment. You configure a workflow that specifies the domain, the ACME CA, the challenge type, and the deployment destination. The tool then handles the ACME protocol interactions automatically. It supports both DNS-01 and HTTP-01 challenges, which gives flexibility depending on your network setup. The DNS-01 challenge requires API access to your DNS provider, and Certimate lists over 70 registrars including AWS, Cloudflare, GoDaddy, Alibaba Cloud, and Tencent Cloud. For deployment, it supports over 150 destinations such as Kubernetes, CDN, WAF, and load balancers. The workflow engine is the key differentiator: instead of a one-shot script, you define a repeatable process that runs on a schedule.
Getting Started: Binary or Docker, Both Are Quick
The README offers two installation paths. For binary installation, you download the precompiled archive from GitHub Releases, extract it, and run `./certimate serve`. For Docker, the command is: `docker run -d --name certimate --restart unless-stopped -p 8090:8090 -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro -v $(pwd)/data:/app/pb_data certimate/certimate:latest`. After starting, you visit `http://127.0.0.1:8090`. The default admin account is `admin@certimate.fun` with password `1234567890`. The README warns that this is the default, so you should change it immediately. The tool claims zero dependencies: no database, no runtime, no framework. That is a strong claim, but the Docker volume mount for `/app/pb_data` suggests it uses a local file-based storage, likely PocketBase, given the path name. That is not a problem, but it means data lives in a directory that you must back up.
Resource Footprint and Cross-Platform Support
Certimate is written in Go, which explains its low resource usage. The README states it requires only about 16 MB of memory. That is a meaningful advantage for small VPS instances or edge devices. It also claims compatibility with Windows, Linux, and macOS, which broadens its appeal. However, the README does not provide detailed system requirements beyond memory. If you run it on a Raspberry Pi or a 512 MB VPS, 16 MB is negligible. The trade-off is that a visual web UI consumes some resources, but the number is still low. For teams that already run a full monitoring stack, this footprint is unlikely to be a concern.
Limitations and Failure Modes
Certimate is not a silver bullet. The most obvious limitation is that it depends on provider APIs. If your DNS provider is not in the supported list, you cannot use DNS-01 challenges, and you must fall back to HTTP-01, which requires inbound traffic on port 80. That is a real constraint for internal services or servers behind strict firewalls. Another failure mode is the default credentials. The README publishes the default admin username and password. If you forget to change them, anyone who can reach the web UI can take over your certificate management. The README also includes a disclaimer that the software is provided 'as-is' without warranties, which is standard but worth noting. The documentation mentions a migration guide to v0.4, implying that upgrades may break existing configurations. You should read that guide before upgrading.
Alternatives: Certbot and acme.sh Compared
The most common alternative is Certbot, the EFF's official ACME client. Certbot is a command-line tool that focuses on issuance and renewal, but it does not have a built-in deployment workflow. You typically write your own scripts to copy certificates to your web server or CDN. Certbot also has a smaller set of DNS provider plugins, though it covers many. Another alternative is acme.sh, a shell script that is lightweight and supports many DNS providers via API, but it also lacks a visual workflow and a web UI. The key difference is that Certimate provides a web-based visual orchestration layer, which is more approachable for non-experts but adds a service you must run and secure. If you are comfortable with scripting and want minimal moving parts, acme.sh might be a better fit. If you want a GUI and a unified deployment process, Certimate is worth evaluating.
Maintenance, Upgrades, and License
Certimate is released under the MIT License, which means you can use, modify, and distribute it freely, with attribution. That is a permissive license, but the README includes a disclaimer that the software comes without warranties. For upkeep, the project has regular releases: v0.4.31, v0.4.30, and v0.4.29, each about a week apart. That indicates active development, but it also means you need to track releases and read migration notes. The documentation includes a 'Migrate to v0.4' guide, which suggests that major version changes may require manual steps. The data directory `/app/pb_data` is the storage location, so you must back it up regularly. The tool is self-hosted, so you are responsible for patching and updating it. There is no mention of an auto-update mechanism, so plan for manual upgrades.
Editorial conclusion
Adopt Certimate if you manage multiple domains across cloud providers and need a visual, low-resource automation layer for certificate issuance and deployment. Skip it if you prefer a CLI-only tool or if your infrastructure lacks one of the supported providers. Before production use, verify that your DNS provider and deployment targets are in the supported lists, and test the renewal flow in a staging environment. Also confirm that the default admin credentials are changed immediately after first login.
Community notes