Self-host labca
v26.04Private ACME Certificate Authority for internal use
- Stars
- 798
- Ports
- 80 (HTTP (nginx reverse proxy)), 443 (HTTPS (nginx reverse proxy)), 4001 (ACMEv2 API (Boulder)), 4003 (SFE (Boulder))
- Requires
- Consul, Docker, Docker Compose, MariaDB, Nginx, Pkimetal, Redis
ghcr.io/hakwerk/labca-gui
What is labca?
LabCA is a self-contained private Certificate Authority for internal and lab use, built on top of Let's Encrypt's open-source Boulder ACME server. It provides a web GUI for managing certificates, supports standard ACME clients like certbot, dehydrated, and acme-tiny, and runs via Docker Compose with multiple services including Boulder, MariaDB, Redis, Consul, pkimetal, nginx, control, and gui components. It requires a fully qualified domain name with DNS and cannot run on Raspberry Pi due to Boulder engine limitations.
Should you self-host labca?
labca scores 49/100 on selfhost.directory (how scoring works) and ranks #5 of 8 in Certificate Management. It has 798 GitHub stars.
It shipped 4 stable releases in the past year. The latest, v26.04, came out on 9 April 2026. New versions land roughly every 3 weeks.
Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is Other-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is Certimate (67/100, 9 410 stars). It scores higher overall, so compare the two before you pick. See labca vs Certimate side by side.
Features
- ACME protocol support
- Automated certificate renewal
- Backup and Restore
- CAA record validation
- DNS-01 and HTTP-01 challenges
- Import existing CA
- Multi-domain support
- Private ACME Certificate Authority
- Rate Limiting
- Root certificate distribution
- Standalone mode for step-caExperimental status
- Web GUI for management
labca README
More in Certificate Management
mkcertWebSelf-hosted web interface for creating, downloading, and monitoring locally-trusted SSL certificates using mkcert, with SCEP enrollment, OIDC SSO, and Docker deployment.
Nginx Proxy ManagerOpen-source, self-hosted Docker reverse proxy manager with a web admin UI, Let's Encrypt SSL, and SQLite, MySQL or Postgres backends.
nginx-uiSelf-hosted, open-source web UI for managing Nginx: edit configs, deploy Let's Encrypt certs, tail logs, watch stats and manage clusters, with AI and MCP.
traefik-certs-dumperOpen-source CLI that extracts Traefik's ACME certificates into .crt/.key files from acme.json or Consul, etcd, Zookeeper and BoltDB, with watch mode and Docker images.
Ultimate Certificate ManagerManage your own PKI with this web-based CA: issue certificates, run ACME/SCEP/EST servers, integrate with Active Directory, and automate renewals.
VaulTLSVaulTLS is a self-hosted, open-source web app for managing mTLS and SSH certificates with a Vue.js frontend, OIDC auth, ACME CA support, and a REST API.
CaddyFast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Caddy UISelf-hosted Caddy control panel managing proxy hosts, redirects, certificates, and routes via web UI. Supports multi-server fleets, OIDC/SSO, dark mode, and PWA.
certificatesOpen-source, self-hosted private CA that automates X.509/TLS and SSH certificate issuance and doubles as your own ACMEv2 server.
CertimateSelf-hosted open-source ACME tool for SSL cert workflows: DNS-01/HTTP-01 requests, deployment to 160+ cloud and Kubernetes targets, automated renewal and monitoring.
CertMateCertMate is a self-hosted, open-source TLS certificate manager that issues, renews, discovers, and deploys certs across 29 DNS providers with audit trail, OIDC/SSO.
Cert WardenSelf-hosted ACME certificate manager with a web UI and API: automated Let's Encrypt renewals, DNS-01 and HTTP-01 challenges, cert delivery via scoped API keys.
0 comments