certmate
Self-hosted certificate lifecycle management: issue, renew, discover, inventory and deploy TLS certificates across your infrastructure
File Explorer
Download Latest Version (.zip)- bug_report.md
- config.yml
- feature_request.md
- announce-release.yml
- ci.yml
- codeql.yml
- docker-multiplatform.yml
- e2e-staging.yml
- lint-emoji.yml
- publish-chart.yml
- publish-clients.yml
- scorecard.yml
- ui-tests.yml
- dependabot.yml
- FUNDING.yml
- PULL_REQUEST_TEMPLATE.md
- _helpers.tpl
- deployment.yaml
- ingress.yaml
- NOTES.txt
- pvc.yaml
- secret.yaml
- service.yaml
- serviceaccount.yaml
- Chart.yaml
- README.md
- values.yaml
- __init__.py
- main.py
- pyproject.toml
- README.md
- __init__.py
- client.py
- errors.py
- models.py
- pyproject.toml
- README.md
- README.md
- certmate-cli.gif
- certmate-cli.mp4
- certmate-cli.tape
- README.md
- api.md
- architecture.md
- ca-providers.md
- compliance.md
- deploy-hooks.md
- dns-providers.md
- docker.md
- guide.md
- index.md
- installation.md
- kubernetes.md
- mcp.md
- probes.md
- README.md
- testing.md
- THEME_MIGRATION.md
- api.md
- architecture.md
- ca-providers.md
- compliance.md
- deploy-hooks.md
- dns-providers.md
- docker.md
- guide.md
- index.md
- installation.md
- kubernetes.md
- mcp.md
- probes.md
- README.md
- testing.md
- THEME_MIGRATION.md
- api.md
- architecture.md
- ca-providers.md
- compliance.md
- deploy-hooks.md
- dns-providers.md
- docker.md
- guide.md
- index.md
- installation.md
- kubernetes.md
- mcp.md
- probes.md
- README.md
- testing.md
- THEME_MIGRATION.md
- api.md
- architecture.md
- ca-providers.md
- compliance.md
- deploy-hooks.md
- dns-providers.md
- docker.md
- guide.md
- index.md
- installation.md
- kubernetes.md
- mcp.md
- probes.md
- README.md
- testing.md
- THEME_MIGRATION.md
- api.md
- architecture.md
- ca-providers.md
- compliance.md
- deploy-hooks.md
- discovery-inventory.md
- dns-providers.md
- docker.md
- guide.md
- index.md
- installation.md
- kubernetes.md
- mcp.md
- probes.en.md
- README.md
- testing.md
- THEME_MIGRATION.md
- walkthrough-01-dashboard.png
- walkthrough-02-create-form.png
- walkthrough-03-create-form-filled.png
- walkthrough-04-settings-dns.png
- walkthrough-05-settings-backup.png
- walkthrough-06-help.png
- walkthrough-07-help-report-issue.png
- walkthrough.webm
- webhooks.md
- index.js
- package-lock.json
- package.json
- test-smoke.js
- test-tools.js
- __init__.py
- client_certificates.py
- models.py
- resources.py
- __init__.py
- audit.py
- audit_chain.py
- audit_context.py
- audit_prune.py
- audit_signing.py
- audit_sink.py
- audit_verify.py
- auth.py
- ca_manager.py
- cache.py
- cert_adopt.py
- cert_discovery.py
- cert_inventory.py
- cert_jobs.py
- cert_probe.py
- cert_service.py
- certificates.py
- client_certificates.py
- constants.py
- crypto_report.py
- csr_handler.py
- ct_monitor.py
- deploy_targets.py
- deployer.py
- digest.py
- dns_alias_hook.py
- dns_providers.py
- dns_strategies.py
- dns_zone_discovery.py
- events.py
- factory.py
- file_operations.py
- inventory_view.py
- metrics.py
- notifier.py
- ocsp_crl.py
- oidc.py
- private_ca.py
- rate_limit.py
- settings.py
- shell.py
- storage_backends.py
- structured_logging.py
- utils.py
- zombie.py
- __init__.py
- auth_routes.py
- backup_cache_routes.py
- cert_routes.py
- misc_routes.py
- oidc_routes.py
- routes.py
- settings_routes.py
- ui_routes.py
- __init__.py
- grafana-dashboard.json
- prometheus-alerts.yml
- prometheus-scrape.example.yml
- README.md
- check_providers.py
- check_wiki.py
- record_walkthrough.py
- release.sh
- reset_admin_password.py
- solidserver_hook.py
- theme_baseline.py
- theme_codemod.py
- fontawesome.min.css
- input.css
- tailwind.min.css
- akamai.svg
- amazonwebservices.svg
- cloudflare.svg
- digitalocean.svg
- gandi.svg
- godaddy.svg
- googlecloud.svg
- hetzner.svg
- infomaniak.svg
- linode.svg
- microsoftazure.svg
- namecheap.svg
- ovh.svg
- porkbun.svg
- scaleway.svg
- vultr.svg
- apple-touch-icon.png
- certmate_logo.png
- certmate_logo_256.png
- favicon.ico
- alpine.min.js
- certmate.js
- client-certs.js
- cmd-palette.js
- dashboard.js
- inventory.js
- provider-icons.js
- redoc.standalone.js
- report-issue.js
- settings-apikeys.js
- settings-deploy.js
- settings-notifications.js
- settings-oidc.js
- settings-probe.js
- settings.js
- setup-wizard.js
- shortcuts.js
- fa-brands-400.ttf
- fa-brands-400.woff2
- fa-regular-400.ttf
- fa-regular-400.woff2
- fa-solid-900.ttf
- fa-solid-900.woff2
- InterVariable.woff2
- JetBrainsMono-Regular.woff2
- manifest.json
- _client_certs.html
- _client_create.html
- _modal.html
- settings_apikeys.html
- settings_ca.html
- settings_deploy.html
- settings_dns.html
- settings_general.html
- settings_notifications.html
- settings_oidc.html
- settings_probe.html
- settings_storage.html
- settings_users.html
- 403.html
- activity.html
- base.html
- crypto_report.html
- help.html
- index.html
- inventory.html
- login.html
- notifications.html
- redoc.html
- settings.html
- setup.html
- __init__.py
- conftest.py
- e2e_support.py
- run_tests.sh
- test_587_deliberate_no_auth.py
- test_acme_challenge_serving.py
- test_acme_dns_checker_is_wired.py
- test_acme_dns_live.py
- test_acme_dns_native_hook.py
- test_advertised_endpoints_exist.py
- test_agentic_audit_trail.py
- test_api_docs_paths_resolve.py
- test_api_key_expiry_and_masking.py
- test_apikey_scope_escalation.py
- test_apikeys.py
- test_async_issuance.py
- test_async_issuance_e2e.py
- test_audit.py
- test_audit_backup_hardening.py
- test_audit_certbot_stderr_sanitizer.py
- test_audit_chain.py
- test_audit_chain_concurrent_writers.py
- test_audit_chain_streaming.py
- test_audit_checkpoint_crosscheck.py
- test_audit_client_cert_rbac.py
- test_audit_domain_validation_gaps.py
- test_audit_export_slice_anchor.py
- test_audit_hardening.py
- test_audit_log_rotation.py
- test_audit_notifications_and_acmedns_masking.py
- test_audit_phase3.py
- test_audit_prune.py
- test_audit_scope_filters.py
- test_audit_settings_mutating_routes.py
- test_audit_sink.py
- test_auth.py
- test_auth_manager_coverage.py
- test_auth_me_bypass.py
- test_auth_setup_mode.py
- test_azure_dns_credentials_format.py
- test_azure_keyvault_certificate_storage.py
- test_backup.py
- test_backup_encryption.py
- test_backup_excludes_certbot_scratch.py
- test_backup_includes_pki_and_audit.py
- test_backup_offsite_s3.py
- test_backup_restore_key_permissions.py
- test_backup_share_safe_excludes_key_material.py
- test_bcrypt_long_password_compat.py
- test_ca_endpoints_are_live.py
- test_ca_manager_eab.py
- test_ca_provider_test_endpoint.py
- test_ca_provider_wiring_consistency.py
- test_cert_adopt.py
- test_cert_creation_finally_block.py
- test_cert_discovery.py
- test_cert_discovery_manager.py
- test_cert_domain_dir_filter.py
- test_cert_info_cache_and_storage_summary.py
- test_cert_info_inproc_parse.py
- test_cert_inventory.py
- test_cert_lifecycle.py
- test_cert_probe.py
- test_cert_service.py
- test_certificates_concurrency_and_alias.py
- test_certificates_route_dedup.py
- test_check_renewals_summary.py
- test_ci_marker_coverage.py
- test_cli_audit_verify_output.py
- test_client_cert_path_traversal.py
- test_client_cert_renewal_preserves_identity.py
- test_client_cert_renewal_runaway.py
- test_client_certificate_lifecycle.py
- test_client_pfx_export.py
- test_clients_cli_unit.py
- test_clients_e2e.py
- test_clients_sdk_unit.py
- test_create_cert_io.py
- test_crypto_report.py
- test_crypto_report_api.py
- test_csp_img_src_airgap.py
- test_csr_handler_coverage.py
- test_ct_monitor.py
- test_custom_script_dns.py
- test_delete_certificate_clears_storage_backend.py
- test_dependabot_holds_the_stack.py
- test_dependency_collisions.py
- test_deploy_hook_param_expansion_bypass.py
- test_deploy_hook_timeout_coercion.py
- test_deploy_status_cache_invalidation.py
- test_deploy_targets.py
- test_deployer.py
- test_deployment_status_route.py
- test_desec_scaleway_provider.py
- test_diagnostics_snapshot.py
- test_digest.py
- test_disaster_recovery_round_trip.py
- test_dns_config_for_strategy_azure.py
- test_dns_manager_coverage.py
- test_dns_zone_discovery.py
- test_docs_navigation.py
- test_documented_numbers_are_real.py
- test_documented_pins_match_requirements.py
- test_documented_python_version.py
- test_domain_alias.py
- test_domain_lock_wait.py
- test_download_file_param.py
- test_duckdns_provider.py
- test_edgedns_credentials_format.py
- test_env_example_is_honest.py
- test_factory_directories.py
- test_factory_logging.py
- test_factory_scheduler.py
- test_flat_copy_is_published_as_one_unit.py
- test_frontend_provider_coverage.py
- test_frontend_state_regressions.py
- test_health_ready_e2e.py
- test_helm_chart.py
- test_help_browser_redirect.py
- test_insufficient_role_page.py
- test_inventory_adopt_api.py
- test_inventory_api.py
- test_inventory_view.py
- test_issue101_test_hook_error.py
- test_issue108_bearer_token_env.py
- test_issue113_azure_dns_ambiguous.py
- test_issue130_setup_wizard_loop.py
- test_issue152_deploy_history.py
- test_issue158_downgrade_protection.py
- test_issue162_bearer_token_preservation.py
- test_issue164_api_json_error_handlers.py
- test_issue165_deploy_history_silent_fail.py
- test_issue171_no_random_sleep_renew.py
- test_issue212_download_path_style.py
- test_issue398_json_key_format.py
- test_issue564_oidc_logout_follows_idp.py
- test_issue76_masked_token.py
- test_issue82_rfc2136_config.py
- test_key_options.py
- test_listing_settings_reuse.py
- test_log_file_rotation.py
- test_log_sanitizer.py
- test_log_stream_does_not_spin.py
- test_login_rate_limit_dict_bounded.py
- test_metadata_concurrent_writes.py
- test_metadata_corruption_handling.py
- test_metrics_endpoint_auth.py
- test_metrics_endpoint_context.py
- test_minor_queue_lot1_telemetry_and_status_codes.py
- test_nginx_conf_is_an_example.py
- test_notification_channels.py
- test_notifications_config_route.py
- test_notifications_routes.py
- test_notifier_coverage.py
- test_ocsp_crl_coverage.py
- test_oidc_disabled_and_role_sync.py
- test_oidc_manager.py
- test_oidc_routes.py
- test_oidc_settings_masking.py
- test_p2_quick_wins.py
- test_pages.py
- test_password_rehash_on_login.py
- test_patch_probe_config.py
- test_per_cert_renewal.py
- test_perf_quickwins.py
- test_pfx_download_api.py
- test_pfx_export.py
- test_pip_is_pinned_where_it_is_used.py
- test_private_ca_coverage.py
- test_privkey_pkcs1_export.py
- test_provider_availability_is_truthful.py
- test_provider_checker_is_wired.py
- test_provider_credential_key_contract.py
- test_provider_wiring_consistency.py
- test_rate_limit_bucket_bypass.py
- test_rate_limit_per_token.py
- test_rate_limits_config.py
- test_reissue_endpoint_e2e.py
- test_reissue_preserves_metadata.py
- test_reissue_san_edit.py
- test_release_gate.py
- test_renewal_job_settings_reuse.py
- test_renewal_private_ca_and_metadata.py
- test_renewal_process_lock.py
- test_renewal_reliability_hardening.py
- test_renewal_threshold_validation.py
- test_requirements_are_consistent.py
- test_requirements_sets.py
- test_reset_admin_password_script.py
- test_restore_repairs_certbot_lineage.py
- test_rfc2136_alias_hook.py
- test_s3_compatible_backend.py
- test_safe_file_write_unbound_temp_file.py
- test_san_domains.py
- test_scheduled_renewal_failure_notifies.py
- test_scheduler_status_health.py
- test_secret_key_env.py
- test_security_policy_matches_the_code.py
- test_session_revocation_on_user_change.py
- test_settings.py
- test_settings_atomic_update.py
- test_settings_list_secret_generic_restore.py
- test_settings_lost_update.py
- test_settings_masking_allowlist.py
- test_settings_request_scoped_cache.py
- test_settings_secret_preservation.py
- test_setup_mode_is_a_one_way_door.py
- test_sprint1_5_audit_followup.py
- test_sprint1_6_audit_polish.py
- test_sprint1_security.py
- test_staging_as_ca.py
- test_staging_settings_migration.py
- test_static_csp.py
- test_storage_backends_cloud_crud.py
- test_storage_backends_coverage.py
- test_storage_backends_live.py
- test_storage_fallback_health.py
- test_storage_migrate_endpoint.py
- test_storage_retry_contract.py
- test_storage_warning_lifecycle.py
- test_storage_warning_surfaced.py
- test_storage_wiring_consistency.py
- test_structured_logger_call_shape.py
- test_tls_probe_proxy.py
- test_tls_probe_timeout.py
- test_ui.py
- test_ui_hash_navigation.py
- test_ui_inventory.py
- test_ui_sso_failure_state.py
- test_unified_backup_one_pass_iteration.py
- test_version_consistency.py
- test_webhook_payload_template.py
- test_webhook_secret_preservation.py
- test_wiki_checker_is_wired.py
- test_wizard_dismissed.py
- test_zombie_scanner.py
- .airgap.yml
- .dockerignore
- .env.example
- .flake8
- .gitignore
- app.py
- build-docker.sh
- build-multiplatform.sh
- certmate.service
- certmate_logo.png
- CODE_OF_CONDUCT.md
- codecov.yml
- conftest.py
- CONTRIBUTING.md
- debug-docker.sh
- docker-compose.yml
- Dockerfile
- LICENSE
- licensing.pdf
- Makefile
- nginx.conf.example
- package-lock.json
- package.json
- pytest.ini
- quick_test.sh
- README.dockerhub.md
- README.md
- RELEASE_NOTES.md
- requirements-aws-storage.txt
- requirements-aws.txt
- requirements-azure-storage.txt
- requirements-azure.txt
- requirements-extended.txt
- requirements-gcp.txt
- requirements-infisical-storage.txt
- requirements-minimal.txt
- requirements-storage-all.txt
- requirements-test.txt
- requirements-vault-storage.txt
- requirements.txt
- run-docker.sh
- run-tests.sh
- screenshot_1.png
- SECURITY.md
- setup.sh
- start-certmate.sh
- start.sh
- tailwind.config.js
- test-multiplatform.sh
🚀 Installation Guide
1. Get the code
git clone https://github.com/fabriziosalmi/certmate
Downloads the entire project code from GitHub to your computer.
cd certmate
Moves into the project folder you just downloaded.
2. Official Install Script
Easy RecommendedPrerequisites
- Python 3 Python is required to use pip.
- APT (Debian/Ubuntu 계열) Built into Debian/Ubuntu-based Linux distributions.
pip install certmate-cli
Installs the package published on PyPI directly — no need to clone the source.
sudo apt install python3 python3-pip python3-venv certbot openssl
Installs directly from the APT package repository (Debian/Ubuntu-based).
After installing, open a new terminal and run the program's version command (e.g. --version) to confirm it worked.
Pulled directly from this repo's README.
3. Docker
EasyPrerequisites
- Git Needed to download the project code from GitHub.
- Docker Desktop Needed to build and run containers. Install it and keep it running in the background.
docker-compose up -d
Runs the command against the services defined in the compose file.
docker-compose ps
Runs the command against the services defined in the compose file.
docker-compose logs -f certmate
Runs the command against the services defined in the compose file.
docker run --platform linux/arm64 -d --name certmate --env-file .env -p 127.0.0.1:8000:8000 fabriziosalmi/certmate:latest
Runs the built image as an actual container.
docker-compose.yml # Docker Compose configuration
Runs the command against the services defined in the compose file.
Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.
Pulled directly from this repo's README.
4. Node.js
EasyPrerequisites
cd mcp && npm install
Moves into the project folder you just downloaded.
After running the command, open the address shown in the terminal (usually something like http://localhost:3000) in your browser.
Pulled directly from this repo's README.
5. Python
EasyPrerequisites
pip install certmate-cli
Installs the package published on PyPI directly — no need to clone the source.
python3 -m venv certmate-env
Runs the Python script (or module).
pip install -r requirements.txt
Installs the Python libraries listed in requirements.txt (or similar).
sudo apt install python3 python3-pip python3-venv certbot openssl
Installs directly from the APT package repository (Debian/Ubuntu-based).
sudo pip3 install -r requirements.txt
Installs the Python libraries listed in requirements.txt (or similar).
If it runs without errors and prints output in the terminal, it worked.
Pulled directly from this repo's README.
6. Make
MediumPrerequisites
- Git Needed to download the project code from GitHub.
- Make Usually pre-installed on Linux/macOS. On Windows, install separately (e.g. via MSYS2 or WSL).
make lint
Compiles the code based on the generated build configuration to produce an executable.
make format
Compiles the code based on the generated build configuration to produce an executable.
make security
Compiles the code based on the generated build configuration to produce an executable.
If it finishes without errors, it worked. Try running the generated executable directly.
Pulled directly from this repo's README.
// repository documentation
Was this content helpful?
(0 ratings)