This repository implements 'lego', a production-grade ACME client written in Go for automating SSL/TLS certificate issuance and renewal with Let's Encrypt and other ACME-compliant Certificate Authorities. The system operates as both a CLI tool and a reusable library, supporting the full ACME protocol (RFC 8555) including account registration, order creation, challenge solving (HTTP-01, DNS-01, TLS-ALPN-01, and experimental DNS-PERSIST-01), certificate download, and lifecycle management (renewal, revocation, archival). Architecturally, the codebase is modular: a core ACME API client (`acme/api/`) handles protocol interactions; challenge solvers (`challenge/`) implement domain validation strategies; a plugin-style DNS provider system (`providers/dns/`) integrates with over 200 DNS service APIs for automated DNS-01 challenge resolution; a CLI layer (`cmd/`) provides subcommands for run, certificates, accounts, archives, and migration; and storage (`cmd/internal/storage/`) persists certificates, keys, and account data to disk. Configuration is via YAML files, environment variables, and dotenv files. Key entry points include `main.go` (application start), `cmd/cmd_root.go` (CLI root command), and `lego/client.go` (library entry point). The primary data flow involves the user specifying domains and challenge type, the client interacting with the ACME CA to create orders and solve challenges (e.g., creating a DNS TXT record via a provider API), and finally downloading and storing the issued certificate. External dependencies include the ACME CA servers, the DNS provider APIs, and optionally an HTTP server for HTTP-01 challenges. The codebase demonstrates strong engineering practices with extensive unit and end-to-end testing, a consistent provider interface, and several well-designed internal utilities (HTTP mock server, retry/polling, error wrappers). However, the large number of DNS providers introduces boilerplate duplication and potential API drift, and the project uses a custom Go-like language dialect that may pose tooling and onboarding risks.
https-localhost is a developer tool that runs an HTTPS server on localhost using locally-trusted SSL certificates. It downloads the mkcert binary appropriate for the host OS/architecture, executes it to install a local CA into system/browser trust stores, and generates per-host certificates. The resulting HTTPS server can either serve static files from a directory or act as a reverse proxy to an existing HTTP/HTTPS server, with optional HTTP-to-HTTPS redirection. It ships as both a global CLI (the `serve` binary) and a programmatic API (`createServer()`, `getCerts()`). Architecturally it is a small, well-separated set of ES modules built directly on Node's built-in http/https servers with no framework dependency. The router dispatches between a static file handler and a proxy handler; CORS headers are applied globally; environment/CLI configuration is validated through a zod schema where CLI flags take precedence over environment variables. External runtime dependencies are deliberately minimal: only `mrmime` for MIME lookup and `zod` for config validation, plus the downloaded mkcert binary. The static handler is the strongest piece: it implements path-traversal sanitization, ETag/Last-Modified conditional requests, byte-range responses (206/416), HEAD/OPTIONS support, directory index serving with query-preserving trailing-slash redirects, and custom 404.html lookup. The proxy handler strips hop-by-hop headers, injects X-Forwarded-* headers, tunnels WebSocket upgrades, and cleanly returns 502 when upstreams fail or die mid-response. Test coverage is comprehensive and genuinely exercises real sockets: unit tests for env parsing and certificate lifecycle, integration tests for static serving and proxying, CLI spawn tests, and edge-case tests for malformed percent-encoding, CORS preflight without upstream contact, and client hang prevention. CI runs a matrix across Ubuntu/macOS and Node 24/26 with strict type-aware linting, dead-code detection (knip), and formatting checks. Minor weaknesses: synchronous fs calls in the static handler (fine for a dev tool), a `process.exit()` call inside library code for unsupported platforms, minimal error handling in the mkcert download routine (only follows 302s, ignores non-2xx statuses), and no Windows CI coverage despite Windows-specific code paths.
acme.sh is a pure shell (POSIX sh) ACME protocol client for automated TLS/SSL certificate lifecycle management. It supports multiple Certificate Authorities (Let's Encrypt, ZeroSSL, Google, SSL.com, Actalis) and provides a wide range of validation methods including HTTP-01 (webroot, standalone, Apache, Nginx), DNS-01 (via 150+ DNS provider APIs), and TLS-ALPN-01. The tool is designed for unattended cron-based renewal and includes deploy hooks for installing certificates into various services (web servers, routers, firewalls, etc.) and notification hooks for alerting on renewal outcomes. The architecture is a monolithic shell script (acme.sh) that sources plugin modules from dnsapi/, deploy/, and notify/ directories. Each plugin follows a consistent function naming convention (e.g., dns_<provider>_add/rm, <target>_deploy, <service>_send) and uses shared internal helpers for HTTP requests, credential persistence, and JSON/XML parsing. The project emphasizes cross-platform compatibility (Linux, macOS, BSDs, Solaris, Windows/Cygwin) and avoids external dependencies beyond curl/wget and openssl. Key features include ECDSA and RSA key support, wildcard certificates, OCSP Must-Staple, External Account Binding (EAB), ACME Renewal Information (ARI, RFC 9773), and automatic upgrade. The codebase is well-tested across 20+ operating systems via GitHub Actions CI, using both Pebble test servers and real CAs. While the monolithic core script is large (~4000 lines), the plugin architecture enables easy extension for new DNS providers, deployment targets, and notification channels.
ServerStatus is a lightweight server monitoring and cloud dashboard system. It consists of a Go-based server that accepts TCP connections from Python clients, collects system metrics (CPU, memory, disk, network, processes, ping latency), and exposes a real-time JSON stats endpoint and a full REST management API. The server also supports service monitoring (HTTP/TCP probes), SSL certificate expiry checks, and a configurable watchdog rule engine that evaluates expressions against live metrics and triggers HTTP callbacks. The web UI is a single-page application with filtering, sorting, detail drawers, and an admin panel for CRUD operations on configuration. The architecture is a classic client-server model: multiple Python agents (client-linux.py or client-psutil.py) connect to a single Go server over a custom TCP protocol. The server authenticates agents, receives periodic metric updates, and serves a web dashboard and API. The Go server is a monolith with separate modules for HTTP handling, TCP agent handling, configuration management, SSL checking, and watchdog evaluation. It uses the Gin web framework for HTTP and the expr-lang library for rule evaluation. Key entry points are the TCP agent listener (port 35601), the HTTP server (port 80/8080), and the CLI flags for configuration. External dependencies include Go modules (gin, expr-lang), Python libraries (psutil for the psutil client), and Docker for containerized deployment. The system is designed for easy deployment via Docker Compose or shell scripts, with environment variable overrides for all client and server settings.
Certd is a full-stack web application that automates the entire lifecycle of SSL/TLS certificates, from application via the ACME protocol to deployment across 110+ cloud providers, CDNs, and hosting platforms. It utilizes a pipeline engine for orchestrating multi-stage tasks (cert apply, conversion, deploy, notification) with retry, skip-on-success, and cron/webhook triggers. The system features a plugin architecture with decorator-based registration for tasks, access credentials, DNS providers, notifications, and OAuth, making it highly extensible. The monorepo includes a Vue 3 + Vben admin frontend and a Midway.js (Koa) backend with TypeORM and multi-database support (SQLite, MySQL, PostgreSQL). It also supports commercial features like subscription plans, wallet, payments, and enterprise project isolation. While the codebase is well-structured and actively maintained, the large number of cloud provider plugins and legacy auto-generated SDKs (e.g., JDCloud) introduce maintenance overhead and potential API drift.
Certimate is a self-hosted SSL certificate automation tool that manages the full lifecycle of TLS certificates: issuance via ACME protocol, deployment to a vast array of cloud providers (CDN, WAF, load balancers, object storage, hosting panels), and notification via chat bots and email. The system is a single-binary application with an embedded PocketBase backend (SQLite) and a React frontend. The backend is written in a Go-like language and exposes REST APIs for managing certificates, workflows, and settings. The frontend provides a visual workflow designer for creating automation pipelines with nodes for ACME issuance, deployment, upload, monitoring, and notification. Architecture: The application is built around a plugin-style provider architecture. Core interfaces (Deployer, Certmgr, Notifier, ACMEChallenger) are implemented by dozens of providers for different cloud services. A workflow engine executes directed acyclic graphs of nodes, with support for conditions, try/catch, delays, and parallel branches. The system uses PocketBase for persistence, cron-based scheduling, and admin authentication. The UI is built with React, Ant Design, and a flow editor library. Key entry points: main.go (CLI entry), cmd/serve_*.go (server startup), internal/rest/handlers/ (REST endpoints), internal/workflow/engine/ (workflow execution), internal/certacme/ (ACME client), internal/certmgmt/deployers/ (deployment registry), internal/notify/ (notification service). Data flows: User configures access credentials and workflows via UI. Workflows are scheduled via cron and executed by the engine, which calls ACME challengers to issue certificates, then deployers to install them, and notifiers to send alerts. Certificate and workflow state is persisted in PocketBase. External dependencies: PocketBase for storage and admin auth, lego (go-acme) for ACME protocol, dozens of cloud provider SDKs (Alibaba, AWS, Tencent, Huawei, etc.), and various third-party APIs for DNS challenges and deployment. The project also includes trimmed/patched copies of several SDKs to reduce dependency footprint.
This repository is the aaPanel (BaoTa) Linux server management panel, a comprehensive web-based administration tool for hosting environments. It manages websites (Nginx/Apache), databases (MySQL, PostgreSQL, MongoDB), Docker containers, SSL certificates, firewalls, FTP, scheduled tasks, backups, and system security auditing. The backend is built with Python (Flask) and follows a modular architecture with a legacy `class/` directory and a newer `mod/` structure, using a dynamic plugin loader for extensibility. The frontend is a Vue 3 single-page application with module federation, incorporating rich text editing (CKEditor), code editing (Monaco/Ace), and real-time task monitoring. The system also includes a comprehensive security compliance framework with over 50 audit check modules, WebAuthn support, and a multi-channel notification system (email, WeChat, DingTalk, Feishu, SMS). Despite its broad functionality and active use, the codebase exhibits significant technical debt including hardcoded paths, dual codebases, vendored third-party assets, and inconsistent error handling, which limits portability and maintainability.
lua-resty-auto-ssl is an OpenResty (nginx + Lua) plugin that automatically issues and renews SSL/TLS certificates from Let's Encrypt (ACME) on the fly. It intercepts the SSL handshake via ssl_certificate_by_lua, checks for existing certificates in shared memory or persistent storage (file or Redis), and if missing, triggers certificate issuance using the dehydrated shell client. Domain validation is handled automatically via HTTP-01 challenges. The plugin supports multiple nginx workers, distributed storage, OCSP stapling, and configurable domain allow/deny policies. It is designed for high-traffic production environments but has been explicitly abandoned by its maintainers, with no active development since 2019. The codebase is well-structured with modular storage adapters, JSON adapters, and locking mechanisms, but relies on external shell processes (sockproc) and the dehydrated script, making it difficult to maintain and prone to issues with modern Let's Encrypt API changes. Given its abandoned status, it is not recommended for new projects; users should consider alternatives like acme.sh, acme-companion, or win-acme.