Certbot is a production-grade Python CLI tool and library for automating TLS certificate lifecycle management via the ACME protocol (RFC 8555). It obtains, renews, revokes, and deploys certificates from Let's Encrypt and other ACME-compliant CAs. The project uses a plugin-based architecture with authenticators (HTTP-01, DNS-01, standalone) and installers (Apache, Nginx, webroot) that are discovered via Python entry points. Key internal modules handle certificate lineage storage, renewal scheduling with ARI (draft-ietf-acme-ari), configuration rollback, and cross-platform OS compatibility. The repository also includes a reusable ACME protocol library (`acme`), extensive unit and integration tests (Pebble-based), and packaging for snaps, Docker, and pip. While highly polished and actively maintained, the codebase contains some deprecated shims and complex parser implementations for Apache and Nginx.
acme.sh is a pure shell (POSIX sh) ACME protocol client for automated TLS/SSL certificate lifecycle management. It supports multiple Certificate Authorities (Let's Encrypt, ZeroSSL, Google, SSL.com, Actalis) and provides a wide range of validation methods including HTTP-01 (webroot, standalone, Apache, Nginx), DNS-01 (via 150+ DNS provider APIs), and TLS-ALPN-01. The tool is designed for unattended cron-based renewal and includes deploy hooks for installing certificates into various services (web servers, routers, firewalls, etc.) and notification hooks for alerting on renewal outcomes. The architecture is a monolithic shell script (acme.sh) that sources plugin modules from dnsapi/, deploy/, and notify/ directories. Each plugin follows a consistent function naming convention (e.g., dns_<provider>_add/rm, <target>_deploy, <service>_send) and uses shared internal helpers for HTTP requests, credential persistence, and JSON/XML parsing. The project emphasizes cross-platform compatibility (Linux, macOS, BSDs, Solaris, Windows/Cygwin) and avoids external dependencies beyond curl/wget and openssl. Key features include ECDSA and RSA key support, wildcard certificates, OCSP Must-Staple, External Account Binding (EAB), ACME Renewal Information (ARI, RFC 9773), and automatic upgrade. The codebase is well-tested across 20+ operating systems via GitHub Actions CI, using both Pebble test servers and real CAs. While the monolithic core script is large (~4000 lines), the plugin architecture enables easy extension for new DNS providers, deployment targets, and notification channels.
Certd is a full-stack web application for automated SSL/TLS certificate lifecycle management. It provides a pipeline-based engine for applying, renewing, converting, and deploying certificates to over 100 cloud providers, CDNs, and servers. The backend is built with MidwayJS (Koa) and TypeORM, supporting SQLite, MySQL, and PostgreSQL. The frontend uses Vue 3 with the Vben admin framework and Ant Design Vue. The system features a plugin architecture with decorator-based registration for task plugins, DNS providers, access credentials, notifications, and addons. It also includes commercial features such as subscription tiers, invite codes, and enterprise project management. The repository is a monorepo managed with pnpm workspaces and Lerna, containing core libraries, server, client, and numerous plugin packages.
Certimate is a self-hosted SSL certificate automation tool that manages the full lifecycle of TLS certificates: issuance via ACME protocol, deployment to a vast array of cloud providers (CDN, WAF, load balancers, object storage, hosting panels), and notification via chat bots and email. The system is a single-binary application with an embedded PocketBase backend (SQLite) and a React frontend. The backend is written in a Go-like language and exposes REST APIs for managing certificates, workflows, and settings. The frontend provides a visual workflow designer for creating automation pipelines with nodes for ACME issuance, deployment, upload, monitoring, and notification. Architecture: The application is built around a plugin-style provider architecture. Core interfaces (Deployer, Certmgr, Notifier, ACMEChallenger) are implemented by dozens of providers for different cloud services. A workflow engine executes directed acyclic graphs of nodes, with support for conditions, try/catch, delays, and parallel branches. The system uses PocketBase for persistence, cron-based scheduling, and admin authentication. The UI is built with React, Ant Design, and a flow editor library. Key entry points: main.go (CLI entry), cmd/serve_*.go (server startup), internal/rest/handlers/ (REST endpoints), internal/workflow/engine/ (workflow execution), internal/certacme/ (ACME client), internal/certmgmt/deployers/ (deployment registry), internal/notify/ (notification service). Data flows: User configures access credentials and workflows via UI. Workflows are scheduled via cron and executed by the engine, which calls ACME challengers to issue certificates, then deployers to install them, and notifiers to send alerts. Certificate and workflow state is persisted in PocketBase. External dependencies: PocketBase for storage and admin auth, lego (go-acme) for ACME protocol, dozens of cloud provider SDKs (Alibaba, AWS, Tencent, Huawei, etc.), and various third-party APIs for DNS challenges and deployment. The project also includes trimmed/patched copies of several SDKs to reduce dependency footprint.