What is CertMate?

CertMate is a self-hosted control plane for managing TLS certificate lifecycles. It handles issuance and renewal from Let's Encrypt, ZeroSSL, Google Trust Services, DigiCert, Sectigo, SSL.com, Actalis, and private CAs using DNS-01 challenges across 29 DNS providers. The system discovers certificates you didn't create via Certificate Transparency logs and network probes, maintains a unified inventory with deployment status, and pushes renewed certificates via hooks and webhooks. The platform includes a web UI, REST API, CLI (certmate-cli), and an MCP server for AI agents. Access control features three roles, scoped API keys, and OIDC/SSO (tested with Keycloak, Authentik, Okta, Google, Microsoft Entra). Every action is recorded in a tamper-evident audit chain with Ed25519-signed exports for independent verification. Certificates are stored locally with optional replication to Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, Infisical, or S3-compatible storage. Automated encrypted backups, Prometheus metrics with Grafana dashboard, and eight notification channels (Email, Slack, Discord, Telegram, ntfy, Gotify, webhooks) provide operational visibility. It runs as a single instance (scheduler inside the web process) and scales up via active/standby on shared storage. Installation options include Docker Compose, Kubernetes Helm chart, Linux systemd installer, and Python pip.

Should you self-host CertMate?

CertMate scores 62/100 on selfhost.directory (how scoring works) and ranks #2 of 8 in Certificate Management. It has 1 481 GitHub stars.

It shipped 9 stable releases in the past year. The latest, v2.55.0, came out on 26 October 2026. New versions land roughly every 1 days.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Python.

Its closest alternative on selfhost.directory is Certimate (67/100, 9 410 stars). It scores higher overall, so compare the two before you pick. See CertMate vs Certimate side by side.

Features

29 DNS providers
Automated encrypted backups
Certificate issuance and renewal
CLI and Python SDK
Flexible Storage Backends
MCP Server
Multiple CA support
OIDC/SSO
Prometheus metrics and Grafana dashboard
REST API
Role-based Access Control
Tamper-evident audit trail
Web UI

How to install CertMate

Install CertMate with Docker

Docker

Environment variables

API_BEARER_TOKEN, SECRET_KEY, CERTMATE_BACKUP_PASSPHRASE, CLOUDFLARE_TOKEN, CERTMATE_LOG_LEVEL

docker run -d --name certmate
--env-file .env
-p 8000:8000
-v certmate_data:/app/data
-v certmate_certificates:/app/certificates
fabriziosalmi/certmate:latest

Single container with named volumes

Install CertMate with Docker Compose

Environment variables

API_BEARER_TOKEN, SECRET_KEY, CERTMATE_BACKUP_PASSPHRASE, CLOUDFLARE_TOKEN, LETSENCRYPT_EMAIL, BEHIND_PROXY, CERTMATE_BIND, CERTMATE_PORT

mkdir certmate && cd certmate curl -fsSLO https://raw.githubusercontent.com/fabriziosalmi/certmate/main/deploy/docker-compose.yml printf 'API_BEARER_TOKEN=%s\nSECRET_KEY=%s\nCERTMATE_BACKUP_PASSPHRASE=%s\n'
"$(openssl rand -hex 32)" "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env chmod 600 .env docker compose up -d

Production deployment with published image, named volumes, loopback-only by default

Install CertMate with Kubernetes

Kubernetes cluster with persistent volumes

Environment variables

API_BEARER_TOKEN via Kubernetes secret

kubectl create namespace certmate kubectl create secret generic certmate-secrets
--from-literal=api-token=your_secure_token -n certmate kubectl apply -n certmate -f - <<'YAML'

Storage PVCs, Deployment, Service

YAML

Helm chart at oci://ghcr.io/fabriziosalmi/charts/certmate, single replica by design

Install CertMate with Python

Environment variables

API_BEARER_TOKEN, CLOUDFLARE_TOKEN, etc.

python3 -m venv certmate-env source certmate-env/bin/activate git clone https://github.com/fabriziosalmi/certmate.git cd certmate pip install -r requirements.txt export API_BEARER_TOKEN="your_token_here" export CLOUDFLARE_TOKEN="your_cloudflare_token" python app.py

Development installation from source

Install CertMate with Linux

Environment variables

API_BEARER_TOKEN, CLOUDFLARE_TOKEN, etc. via systemd environment

curl -fsSL https://raw.githubusercontent.com/fabriziosalmi/certmate/main/deploy/install.sh | sudo sh

Installs with its own Python 3.12 and starts the service

How to configure CertMate

ACME_CHALLENGES_DIR<cwd>/data/acme-challengesWhere http-01 tokens are written and served from
Where http-01 tokens are written and served from
API_BEARER_TOKENauto-generatedBearer token for API authentication
Bearer token for API authentication
API_BEARER_TOKEN_FILEPath to a file containing the API bearer token
Path to a file containing the API bearer token
AUDIT_SIGNING_KEY_FILEPath to Ed25519 private key for signing audit checkpoints
Path to Ed25519 private key for signing audit checkpoints
BEHIND_PROXYfalseTrust X-Forwarded-* from one reverse proxy hop
Trust X-Forwarded-* from one reverse proxy hop
values: true, false
CERTMATE_ALLOW_INTERNAL_WEBHOOKSfalseAllow notification webhooks to private addresses
Allow notification webhooks to private addresses
values: true, false
CERTMATE_ALLOW_SCHEMA_DOWNGRADE0Allow reading settings from newer version
Allow reading settings from newer version
values: 0, 1
CERTMATE_AUDIT_CHAIN1Write tamper-evident audit hash chain
Write tamper-evident audit hash chain
values: 0, 1
CERTMATE_AUDIT_LOG_BACKUP_COUNT5How many rotated audit logs to keep
How many rotated audit logs to keep
CERTMATE_AUDIT_LOG_MAX_BYTES10485760Rotate the human-readable audit log at this size
Rotate the human-readable audit log at this size
CERTMATE_BACKUP_DIR<install>/backupsWhere backups are written and restored from
Where backups are written and restored from
CERTMATE_BACKUP_PASSPHRASEEncrypts unified backups at rest
Encrypts unified backups at rest
CERTMATE_BIND127.0.0.1Bind address for the server
Bind address for the server
values: 0.0.0.0, 127.0.0.1
CERTMATE_CERTBOT_PROBE_TTL300Seconds before certbot readiness answer is re-checked
Seconds before certbot readiness answer is re-checked
values: 30-3600
CERTMATE_CERT_DIR<install>/certificatesWhere issued certificates live
Where issued certificates live
CERTMATE_CERT_INFO_CACHE_TTL60Seconds a parsed certificate's details stay cached
Seconds a parsed certificate's details stay cached
values: 0-3600
CERTMATE_CLIENT_CA_COMMON_NAMECertMate CACommon name of the client CA
Common name of the client CA
CERTMATE_CLIENT_CA_COUNTRYCHCountry of the client CA
Country of the client CA
values: ISO 3166-1 two-letter code
CERTMATE_CLIENT_CA_ORGANIZATIONCertMateOrganisation of the client CA
Organisation of the client CA
CERTMATE_CLIENT_CA_ORGANIZATIONAL_UNITCertificate AuthorityOrganisational unit of the client CA
Organisational unit of the client CA
CERTMATE_CLIENT_CA_STATESwitzerlandState of the client CA
State of the client CA
CERTMATE_CLIENT_CERT_DEFAULT_COUNTRYCHCountry of client certificate issued without one
Country of client certificate issued without one
values: ISO 3166-1 two-letter code
CERTMATE_CLIENT_CERT_DEFAULT_ORGANIZATIONCertMateOrganisation of client certificate issued without one
Organisation of client certificate issued without one
CERTMATE_CLIENT_CERT_DEFAULT_ORGANIZATIONAL_UNITUsersOrganisational unit of client certificate issued without one
Organisational unit of client certificate issued without one
CERTMATE_CLIENT_CERT_DEFAULT_STATESwitzerlandState of client certificate issued without one
State of client certificate issued without one
CERTMATE_DATA_DIR<install>/dataSettings, certificate inventory and audit chain
Settings, certificate inventory and audit chain
CERTMATE_DOMAIN_LOCK_TIMEOUT5Seconds to wait for a domain's lock
Seconds to wait for a domain's lock
values: 0-60
CERTMATE_ENABLE_HSTSfalseSend Strict-Transport-Security header
Send Strict-Transport-Security header
values: true, false
CERTMATE_EVENT_DRAIN_SECONDS5How long shutdown waits for queued event dispatches
How long shutdown waits for queued event dispatches
values: 0-60
CERTMATE_EVENT_MAX_STREAMS4Live event stream connections held at once
Live event stream connections held at once
values: 1-64
CERTMATE_EVENT_STREAM_SECONDS900How long one event stream is held
How long one event stream is held
values: 30-86400
CERTMATE_EVENT_WORKERS4Threads dispatching event listeners
Threads dispatching event listeners
values: 1-32
CERTMATE_ISSUANCE_JOB_HISTORY200How many finished issuance jobs stay queryable
How many finished issuance jobs stay queryable
values: 20-2000
CERTMATE_ISSUANCE_QUEUE_LIMIT20How much unfinished issuance may exist at once
How much unfinished issuance may exist at once
values: 1-500
CERTMATE_ISSUANCE_WORKERS2Threads serving asynchronous issuance jobs
Threads serving asynchronous issuance jobs
values: 1-16
CERTMATE_LAST_USED_PERSIST_SECONDS60How often a session's last used timestamp is written
How often a session's last used timestamp is written
CERTMATE_LOG_BACKUP_COUNT5How many rotated files to keep
How many rotated files to keep
CERTMATE_LOG_FILEAlso write logs to this path
Also write logs to this path
CERTMATE_LOG_JSONtrueJSON log lines
JSON log lines
values: true, false
CERTMATE_LOG_LEVELINFOLog level
Log level
values: DEBUG, INFO, WARNING, ERROR
CERTMATE_LOG_MAX_BYTES10485760Rotate the log file at this size
Rotate the log file at this size
CERTMATE_LOGS_DIR<install>/logsApplication and audit logs
Application and audit logs
CERTMATE_PORT8000Host port mapping
Host port mapping
CERTMATE_PROBE_ALLOW_PRIVATEfalseAllow certificate probe to connect to private addresses
Allow certificate probe to connect to private addresses
values: true, false
CERTMATE_PROBE_TIMEOUT_SECONDS5Connection timeout of the certificate probe
Connection timeout of the certificate probe
values: 1-30
CERTMATE_SLOW_REQUEST_LOGGINGtrueLog warning for requests that outlive threshold
Log warning for requests that outlive threshold
values: true, false
CERTMATE_SLOW_REQUEST_REPEAT_SECONDSthresholdHow often a still-running request is reported again
How often a still-running request is reported again
CERTMATE_SLOW_REQUEST_SCAN_SECONDS10How often the watchdog looks for running requests
How often the watchdog looks for running requests
CERTMATE_SLOW_REQUEST_THRESHOLD_SECONDS30How long a request must run before reported
How long a request must run before reported
CERTMATE_VERSIONlatestPins the CertMate image version
Pins the CertMate image version
CLOUDFLARE_TOKENSeeds the default Cloudflare DNS account on first start
Seeds the default Cloudflare DNS account on first start
CORS_ORIGINSComma-separated origins allowed to call the API from a browser
Comma-separated origins allowed to call the API from a browser
FLASK_ENVproductionFlask environment
Flask environment
values: production, development
LETSENCRYPT_EMAILACME account email
ACME account email
PORT8000Server port (honoured by the container entrypoint)
Server port (honoured by the container entrypoint)
PREFERRED_URL_SCHEMESet to https when TLS terminates in front
Set to https when TLS terminates in front
values: https
SECRET_KEYauto-generatedFlask secret key for sessions
Flask secret key for sessions
SECRET_KEY_FILEPath to a file containing the Flask secret key
Path to a file containing the Flask secret key
SESSION_TIMEOUT_HOURS8How long a login session stays valid
How long a login session stays valid