# CertMate

> CertMate is a self-hosted, open-source TLS certificate manager that issues, renews, discovers, and deploys certs across 29 DNS providers with audit trail, OIDC/SSO.

- **Category:** Certificate Management
- **Licence:** MIT
- **Latest version:** v2.55.0
- **Open source:** oss
- **Languages:** Python
- **Platforms:** Docker, Docker Compose, Kubernetes, Python, Linux
- **Tags:** Monitoring, Backup, Mcp, Automation, SSO, DNS, Acme, Ssl, Certificate, Audit, Tls, OIDC, Let's Encrypt, Kubernetes, Docker, Mtls, Ssl certificates, Ssl management, Nis2, Certificate Management, Private Ca, Acme Server, Certificate Discovery, Certificate Renewal, Certificate Revocation Lists, Certification Authority, Tls Certificates, Certificate Lifecycle Management, Certificate Inventory, Ip Certificates, Short Lived Certificates

## Description

CertMate is a self-hosted control plane for managing TLS certificate lifecycles. It handles issuance and renewal from Let's Encrypt, ZeroSSL, Google Trust Services, DigiCert, Sectigo, SSL.com, Actalis, and private CAs using DNS-01 challenges across 29 DNS providers. The system discovers certificates you didn't create via Certificate Transparency logs and network probes, maintains a unified inventory with deployment status, and pushes renewed certificates via hooks and webhooks. The platform includes a web UI, REST API, CLI (certmate-cli), and an MCP server for AI agents. Access control features three roles, scoped API keys, and OIDC/SSO (tested with Keycloak, Authentik, Okta, Google, Microsoft Entra). Every action is recorded in a tamper-evident audit chain with Ed25519-signed exports for independent verification. Certificates are stored locally with optional replication to Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, Infisical, or S3-compatible storage. Automated encrypted backups, Prometheus metrics with Grafana dashboard, and eight notification channels (Email, Slack, Discord, Telegram, ntfy, Gotify, webhooks) provide operational visibility. It runs as a single instance (scheduler inside the web process) and scales up via active/standby on shared storage. Installation options include Docker Compose, Kubernetes Helm chart, Linux systemd installer, and Python pip.

## Links

- [Homepage](https://github.com/fabriziosalmi/certmate)
- [Website](https://www.certmate.org/)
- [Docker](fabriziosalmi/certmate)
- [Demo](https://demo.certmate.org)
- [Documentation](https://www.certmate.org/docs/)
- [GitHub Repository](https://github.com/fabriziosalmi/certmate)
- [Video Guide](https://www.youtube.com/playlist?list=PLM-wnWN4g5XA)
- [Changelog](https://www.certmate.org/changelog/)
- [Security](https://www.certmate.org/security/)
- [PyPI (certmate-cli)](https://pypi.org/project/certmate-cli/)

---
Source: https://selfhost.directory/project/certmate