Self-host Ultimate Certificate Manager
v2.246Self-hosted certificate authority with web UI for PKI
- Stars
- 171
- Ports
- 8443 (HTTPS web UI and API), 8080 (HTTP for ACME HTTP-01 challenges)
neyslim/ultimate-ca-manager
What is Ultimate Certificate Manager?
A web-based certificate authority platform for running your own PKI. It provides a complete CA hierarchy with root and intermediate CAs, full certificate lifecycle management (issue, sign, renew, revoke, export), and support for major PKI protocols including ACME (RFC 8555 with ARI, EAB, profiles), SCEP (RFC 8894), EST (RFC 7030), OCSP (RFC 6960), CRL/CDP with Delta CRLs, and RFC 3161 Timestamp Authority. It integrates with Microsoft AD CS for full lifecycle management, Windows autoenrollment via XCEP/WSTEP, and Microsoft Intune SCEP. Hardware security module support covers SoftHSM, PKCS#11, Azure Key Vault, Google Cloud KMS, and HashiCorp Vault. Additional features: SSH certificate authority, network certificate discovery, deploy hooks for pushing renewed certificates, RBAC with custom roles, LDAP/OAuth2/SAML SSO, WebAuthn/FIDO2 and TOTP 2FA, audit logs, private key encryption at rest, FIPS mode preview, Prometheus metrics, encrypted backups, and a responsive UI with 6 themes (light/dark). It runs via Docker, native Linux packages (.deb/.rpm), or Helm on Kubernetes, using SQLite by default with optional PostgreSQL.
Should you self-host Ultimate Certificate Manager?
Ultimate Certificate Manager scores 50/100 on selfhost.directory (how scoring works) and ranks #4 of 8 in Certificate Management. It has 171 GitHub stars.
It shipped 4 stable releases in the past year. The latest, v2.246, came out on 27 October 2026. New versions land roughly every 2 days.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is AGPL-3.0-licensed and written mostly in Python.
Its closest alternative on selfhost.directory is Certimate (67/100, 9 410 stars). It scores higher overall, so compare the two before you pick. See Ultimate Certificate Manager vs Certimate side by side.
Features
- ACME Server (RFC 8555)
- CA Hierarchy Management
- Certificate Lifecycle Management
- CRL/CDP with Delta CRLs
- Deploy Hooks
- EST Server (RFC 7030)
- HSM Support
- Microsoft AD CS Integration
- OCSP Responder (RFC 6960)
- Private Key Encryption at Rest
- RBAC with Custom Roles
- SCEP Server (RFC 8894)
- SSH Certificate Authority
- Timestamp Authority (RFC 3161)
- Windows Autoenrollment (XCEP/WSTEP)
Ultimate Certificate Manager README
More in PKI
vaultSelf-hosted, source-available secrets server that issues dynamic cloud and database credentials, offers encryption as a service, and logs every access for audit.
certificatesOpen-source, self-hosted private CA that automates X.509/TLS and SSH certificate issuance and doubles as your own ACMEv2 server.
CertimateSelf-hosted open-source ACME tool for SSL cert workflows: DNS-01/HTTP-01 requests, deployment to 160+ cloud and Kubernetes targets, automated renewal and monitoring.
Cert WardenSelf-hosted ACME certificate manager with a web UI and API: automated Let's Encrypt renewals, DNS-01 and HTTP-01 challenges, cert delivery via scoped API keys.
signserver-ceSelf-hosted, LGPL-licensed open-source signing server that centrally signs code, documents and timestamps, deployed via Docker, Helm or a WildFly plus database install.
0 comments