**CertMate** is a self-hosted certificate lifecycle management platform: it issues and renews TLS certificates, **discovers the ones you did not issue**, keeps a single inventory of what exists across your estate — what is served where, who issued it, when it expires, which cryptography it uses — and deploys renewed certificates to where they are needed. It supports 29 DNS providers, runs its own private CA for internal names, keeps a tamper-evident audit trail of every operation, and exposes all of it through a REST API.
[](https://demo.certmate.org)
[](https://opensource.org/licenses/MIT)
[](https://www.python.org/downloads/)
[](https://hub.docker.com/)
[](#api-usage)
[](https://pypi.org/project/certmate-cli/)
[](https://github.com/fabriziosalmi/certmate/actions/workflows/ci.yml)
[](https://github.com/fabriziosalmi/certmate/actions/workflows/docker-multiplatform.yml)
[](https://github.com/fabriziosalmi/certmate/actions/workflows/codeql.yml)
[](https://securityscorecards.dev/viewer/?uri=github.com/fabriziosalmi/certmate)
[](https://codecov.io/gh/fabriziosalmi/certmate)
[](https://europeanopensource.eu/)
[](https://news.ycombinator.com/item?id=44427452)
[](https://www.reddit.com/r/selfhosted/comments/1lkvbcj/ssl_certificates_automation/)
[](https://mastodon.social/@nixCraft/114799880340326467)
[](https://www.linkedin.com/posts/labyrinthlabs_github-fabriziosalmicertmate-ssl-certificate-activity-7434531689097248768-Ac63)
[Quick Start](#quick-start-with-docker) • [CLI](#command-line-interface) • [Documentation](#documentation) • [Installation](#installation-methods) • [DNS Providers](#supported-dns-providers) • [CA Providers](docs/ca-providers.md) • [Storage Backends](#certificate-storage-configuration) • [Backup and Recovery](#backup-and-recovery) • [API Reference](#api-usage)
---
## Ecosystem
CertMate is the open-source core of a small, focused toolset:
- **[certmate-tools](https://github.com/fabriziosalmi/certmate-tools)** — free, privacy-first, client-side TLS / certificate / ACME diagnostics (runs entirely in your browser).
- **[certmate-agent](https://github.com/fabriziosalmi/certmate-agent)** — conversational assistant: a local LLM mapped 1:1 to CertMate's REST API, with RAG over the docs.
- **[nis2-public](https://github.com/fabriziosalmi/nis2-public)** — NIS2 continuous posture management & remediation.
**Enterprise / high-scale** — multi-tenant, mTLS, white-label and NIS2-aligned deployments are available through *CertMate-ng* (source-available, BSL 1.1, EU-built). For access or a deployment discussion, email **fabrizio.salmi@gmail.com**.
---
## Command-line interface
The whole certificate lifecycle from your terminal — `pip install certmate-cli`:
```bash
pip install certmate-cli
export CERTMATE_URL=https://certmate.example.com
export CERTMATE_TOKEN=... # omit on a fresh (setup-mode) instance
certmate health
certmate cert create app.example.com --dns cloudflare --wait # issue, block until live
certmate cert ls
certmate cert info app.example.com
certmate audit verify
```
`certmate-cli` is a thin layer over **`certmate-sdk`** (`pip install certmate-sdk`) — a small,
`httpx`-based Python client for the same REST API the web UI and MCP server drive. Both are
first-party, live in [`clients/`](clients/), and are published to PyPI. The clip above is a real
issuance over DNS-01 (Let's Encrypt staging); see [`demo/`](demo/).
---
## AI agents (MCP server)
CertMate ships a first-party **Model Context Protocol** server, so an assistant like Claude can
drive the same REST API the web UI and the CLI use — with the same auth and the same audit trail.
It lives in [`mcp/`](mcp/), is Node.js (>= 20), and exposes **16 tools**: inventory and status
(`certmate_list_certificates`, `certmate_get_certificate`, `certmate_diagnostics`,
`certmate_get_activity`, …), lifecycle operations (`certmate_create_certificate`,
`certmate_renew_certificate`, `certmate_get_job`, `certmate_set_auto_renew`, …), and delivery
(`certmate_download_certificate`, `certmate_deploy_certificate`).
```bash
cd mcp && npm install
```
```jsonc
// claude_desktop_config.json — or any MCP-capable client
{
"mcpServers": {
"certmate": {
"command": "node",
"args": ["/path/to/certmate/mcp/index.js"],
"env": {
"CERTMATE_URL": "https://certmate.example.com",
"CERTMATE_TOKEN": "