certmate
Self-hosted control plane for TLS certificates, ready for 47-day certificates: issue, renew, discover, inventory and deploy them, and serve ACME for internal names and IPv4 addresses
The Lens
By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.
Updated Oct 2026
CertMate is a self-hosted control panel for TLS certificates, the files behind your site's padlock. It issues and renews them from Let's Encrypt, ZeroSSL, DigiCert and others, finds certificates you didn't issue, and pushes renewals to the servers using them. It's built for 2029, when public certificates max out at 47 days. MIT licensed and free, with a web UI, API, CLI and MCP server.
Setup is one Docker Compose file plus three generated secrets. It runs as a single instance by design (the renewal scheduler lives in the web process), so high availability means active and standby on shared storage.
SSO, roles and a tamper-evident audit trail are free. The author sells support and CertMate-ng, a BSL 1.1 build for multi-tenant and white-label use, priced by email. Solo and small teams: free. Larger teams: free, plus support if outages cost real money.
The catch: it's one maintainer shipping several releases a week. In September 2026 it published eight security advisories, including a critical where the shipped default left admin access unauthenticated (fixed in 2.41.0). Then the October 25 clock change stopped instances in some European time zones from restarting until 2.55.0. Pin versions; keep it off the open internet.
Free vs Self-Hosted vs Paid
open coreFree: The full CertMate is MIT licensed: issuance and renewal from Let's Encrypt, ZeroSSL, Google Trust Services, Actalis, DigiCert, Sectigo and SSL.com or a private CA, DNS-01 through 29 DNS providers, discovery via probes and Certificate Transparency logs, deploy hooks and webhooks, client certificates with OCSP and CRL, a built-in ACME server for internal names, OIDC SSO, three roles, a tamper-evident audit chain, Prometheus metrics, a CLI (pip install certmate-cli) and an MCP server with 16 tools.
Self-hosted: Docker Compose with the published fabriziosalmi/certmate image, a systemd install script with its own Python 3.12, or a Helm chart that renders one replica only. Certificates live on local disk with optional copies in Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, Infisical or S3-compatible storage. It listens on localhost by default; put a reverse proxy in front for remote access. Certificates from commercial CAs like DigiCert or Sectigo are billed by those CAs.
Paid: Paid support, custom development and security consulting from the author, plus CertMate-ng, a separate source-available (BSL 1.1) edition for multi-tenant and white-label deployments. No public prices; contact by email.
Free under MIT for any single organization, SSO and audit trail included. Money only enters for paid support or the BSL-licensed CertMate-ng for multi-tenant and white-label setups, priced by email.
What to do by team size
- Solo
- free; one docker compose up
- Small team
- free, SSO and roles included
- Medium team
- free; plan an active/standby pair since it cannot scale out
- Large team
- free core plus a paid support contract, or CertMate-ng if you serve multiple tenants
Get tools like this every Wednesday
One featured tool, three on the radar. No fluff.
A low score is not a verdict on quality. Young and niche tools start low by design. How we calculate scores
Trust Signals
About
- Owner
- fab (User)
- Stars
- 1,485
- Forks
- 121
Explore Further
More tools in the directory
dify
Production-ready platform for agentic workflow development.
160.5k ★Stirling-PDF
#1 PDF Application on GitHub that lets you edit PDFs on any device anywhere
95.8k ★career-ops
Open-source AI job search: scan job portals, evaluate listings into a structured A-H report with a global 1-5 score, tailor your CV, track applications. Runs locally in your AI coding CLI (Claude Code, Codex, OpenCode, Antigravity).
80.6k ★