CertMate
CertMate is a self-hosted SSL/TLS certificate manager. It issues and renews certificates over ACME (Let's Encrypt, ZeroSSL or a private ACME CA) with DNS-01 across many DNS providers or HTTP-01, renews them on a schedule, and exposes a web UI and a REST API for issuing, downloading and deploying certificates, with encrypted backups and webhook notifications.
CertMate
In Development
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
Installation
Default install:
1
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/certmate.sh)"
Notes
There is no default login. The first page creates the administrator account and asks for the API token, which the install generated: grep API_BEARER_TOKEN /opt/certmate_data/.env
Keep a copy of /opt/certmate_data/.env off the container. CERTMATE_BACKUP_PASSPHRASE encrypts the backups, and SECRET_KEY must match for a backup to restore the API token.
CertMate listens on plain HTTP on port 8000 on every interface. To expose it beyond your LAN, put an HTTPS reverse proxy in front and set BEHIND_PROXY=true in /opt/certmate_data/.env, then run systemctl restart certmate.
Certificates, settings, backups and logs live in /opt/certmate_data and survive updates.