All 16 Dependencies
Every package CertMate depends on, ranked by repo health score.
CertMate is an open-source SSL certificate management system built for modern distributed infrastructure. It automates the full certificate lifecycle — issuance, renewal, deployment, and revocation — across more than two dozen DNS providers and seven CA backends, from Let's Encrypt and ZeroSSL to private ACME endpoints using step-ca. All operations are exposed through a REST API with interactive Swagger docs, complemented by a real-time web dashboard built with Tailwind CSS and Alpine.js.
The system is containerized for Docker and Kubernetes and ships with a dependency-injection application container that wires together background scheduling, pluggable certificate storage (local filesystem, HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Infisical, and S3-compatible object storage), HMAC-signed webhooks, and multi-channel notifications. Role-based access control with three permission tiers, scoped API keys, OIDC/SSO integration, and tamper-evident audit log chaining make it credible for compliance-sensitive environments.
What has historically set CertMate apart from simpler certbot wrappers is its breadth of integrations alongside genuine depth: multi-account support per DNS provider for prod/staging separation, DNS alias delegation via CNAME for air-gapped DNS zones, a zombie certificate scanner to clean orphaned certs from the filesystem, a built-in OCSP responder and CRL distribution point for private PKI, and a Model Context Protocol (MCP) server that lets AI assistants manage certificates directly through the REST API.
Active development is reflected in a release cadence exceeding 100 releases and averaging over 100 commits per month. The v2.x series introduced async certificate issuance, S3-sovereign storage, OIDC federation, NIS2 compliance tooling via a companion project, and a weekly digest email for certificate health monitoring. The open-source MIT core coexists with a commercial CertMate-ng tier (BSL 1.1) for multi-tenant and white-label deployments.
