Certimate is an open-source, MIT-licensed, self-hosted ACME client that automates the full lifecycle of SSL/TLS certificates — issuance, deployment, renewal, and monitoring — through a visual workflow, and it is built for DevOps engineers and infrastructure teams who manage certificates across many domains, registrars, and hosting providers.

What it is

Certimate is a certificate management server written in Go and distributed under the MIT licence. It sits in the ACME ecosystem as a client that talks to certificate authorities such as Let's Encrypt, Actalis, Google Trust Services, SSL.com, and ZeroSSL, and it presents the whole certificate lifecycle as a configurable visual workflow rather than a set of command-line invocations or hand-written renewal scripts. It is self-hosted, meaning the operator deploys it privately, and the project states that all data is stored locally to keep it within the operator's own control. It runs on Windows, Linux, and macOS.

The concrete problem it replaces is the fragmented toolchain that most teams accumulate around certificate renewal. The project's own topic list names certbot, the long-standing command-line ACME client, as the adjacent tool in this space. With a CLI client, a team must issue certificates in one place, copy them to each load balancer, CDN, WAF, or Kubernetes cluster by hand or by custom glue, and rebuild that glue whenever a domain, registrar, or key type changes. Certimate collapses that chain into one workflow: the certificate is requested, then deployed to the chosen destinations, then renewed and monitored on the same schedule, with notifications when something goes wrong.

Key capabilities

• Supports both the DNS-01 and HTTP-01 ACME challenge types, so certificates can be issued for domains that are not publicly reachable over HTTP.
• Issues single-domain, multi-domain, and wildcard certificates, and also supports IP address certificates, with a choice of RSA or ECC keys.
• Produces certificates in multiple output formats, including PEM, PFX, and JKS.
• Integrates with more than 70 domain registrars and DNS providers, among them AWS, Cloudflare, GoDaddy, Alibaba Cloud, and Tencent Cloud.
• Deploys to more than 160 destinations, including Kubernetes, CDNs, WAFs, and load balancers.
• Sends notifications through email, Discord, Slack, Telegram, DingTalk, Feishu, and WeCom.
• Orchestrates the whole flow as a flexible workflow, so application, deployment, and renewal run automatically after a few configurations.

Who uses it and how

• Teams that need private deployment and want certificate data and provider credentials to stay on their own infrastructure rather than in a hosted service.
• Operators managing certificate sprawl across several clouds and registrars, where issuance happens at one provider and termination happens at Kubernetes, a CDN, or a WAF.
• Administrators on mixed Windows, Linux, and macOS environments, since the same server runs across all three.
• Small deployments that need a lightweight footprint: the project reports roughly 20 MB of memory usage and no requirement to install a database, runtime, or framework.

Getting started

The README offers a binary installation path, downloading the archived package of the precompiled build, and the project also publishes a Docker image at certimate/certimate. The README advertises running Certimate in about one minute, and documentation lives at docs.certimate.me.

How it compares

No list of paid products being replaced is provided, and the only comparable tool named in the facts is certbot, which appears in the topic list. Certbot is a command-line ACME client, whereas Certimate is a self-hosted service with a visual workflow and built-in deployment integrations, so the two overlap on issuance but diverge on what happens after the certificate is signed.

When to use it — and when not to

Because the project advertises zero dependencies and local data storage, a self-hoster mainly operates the binary or the Docker container and owns the host's security and backups rather than a database and queue stack. Teams that want a fully managed certificate service with a vendor SLA, or that are happy with scripted command-line renewal and no web interface, should look elsewhere. The registry entry shows 51 open issues and a README excerpt that is cut off mid-sentence on the installation step, so prospective users should read the full documentation before assuming a specific integration is covered.

./certimate serve

docker run -d \
  --name certimate \
  --restart unless-stopped \
  -p 8090:8090 \
  -v /etc/localtime:/etc/localtime:ro \
  -v /etc/timezone:/etc/timezone:ro \
  -v $(pwd)/data:/app/pb_data \
  certimate/certimate:latest