Repolode
Submit
fabriziosalmi

fabriziosalmi/certmate

Self-hosted control plane for TLS certificates that issues, renews, discovers, inventories and deploys them across your infrastructure.

Open-source alternative to:VenafiSectigo Certificate Manager

View on GitHubWebsite
Stars
1,470
Forks
119
Open issues
25
Last commit
24 hours ago

What is it?

CertMate is a self-hosted tool for managing TLS certificates across an infrastructure. It issues and renews certificates from public CAs such as Let's Encrypt, ZeroSSL and DigiCert, or from a private CA it runs itself. It also finds certificates that were not issued through it, by probing endpoints and reading Certificate Transparency logs, and records everything in one inventory showing where each certificate is served, who issued it and when it expires.

After a renewal, CertMate can run deploy hooks or webhooks to place the new certificate where it is used, then check with deployment probes that the new certificate is actually being served. DNS-01 validation works through 29 DNS providers, and HTTP-01 is also supported. Certificates can be stored on local disk or copied to Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, Infisical or S3-compatible storage.

The project offers a web interface, a REST API, a Python-based CLI called certmate-cli, and an MCP server for AI agents. It runs as a single instance, with Docker, a Linux systemd installer and a Helm chart available for deployment.

Key features

  • 01Issues and renews certificates from Let's Encrypt, ZeroSSL, DigiCert, Sectigo and other CAs, or from a private CA.
  • 02Uses DNS-01 validation through 29 DNS providers, plus HTTP-01.
  • 03Discovers existing certificates through endpoint probes and Certificate Transparency logs.
  • 04Runs deploy hooks and webhooks after issuance and renewal, with deployment probes to verify the result.
  • 05Stores certificates locally or in Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, Infisical or S3-compatible storage.
  • 06Provides a web UI, REST API, CLI and MCP server with role-based access and an audit chain.

Use cases

  • Tracking every TLS certificate across servers, load balancers and services in one inventory.
  • Automating renewal of short-lived certificates and pushing them to the services that use them.
  • Issuing internal mTLS or VPN client certificates from a private CA.
  • Letting internal hosts request certificates through an ACME server with certbot or cert-manager.

Topics

#tls#certificates#acme#lets-encrypt#self-hosted#dns-01#private-ca#mtls#automation#certificate-discovery

FAQ

What is certmate?
Self-hosted control plane for TLS certificates that issues, renews, discovers, inventories and deploys them across your infrastructure. CertMate is a self-hosted tool for managing TLS certificates across an infrastructure. It issues and renews certificates from public CAs such as Let's Encrypt, ZeroSSL and DigiCert, or from a private CA it runs itself. It also finds certificates that were not issued through it, by probing endpoints and reading Certificate Transparency logs, and records everything in one inventory showing where each certificate is served, who issued it and when it expires.
Is certmate free to use? What license does it have?
certmate is open source under the MIT license. Check the license terms before using it in commercial products.
Is certmate still maintained?
Actively maintained. The last commit to certmate was on Oct 19, 2026.
What can I use certmate for?
Tracking every TLS certificate across servers, load balancers and services in one inventory. Automating renewal of short-lived certificates and pushing them to the services that use them. Issuing internal mTLS or VPN client certificates from a private CA. Letting internal hosts request certificates through an ACME server with certbot or cert-manager.
Where can I get certmate?
The source code and installation instructions are on GitHub: https://github.com/fabriziosalmi/certmate

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects