Caddy is a production-grade, extensible web server platform written in Go. It automatically manages HTTPS certificates (via ACME/ZeroSSL) and provides a rich set of HTTP middleware including reverse proxy, file serving, authentication, compression, and headers manipulation. The architecture is modular: all features are registered as Caddy modules following a consistent lifecycle (Provision/Validate/Cleanup) and configured via a JSON config or the Caddyfile adapter. Key entry points are the CLI (caddy run, caddy start, etc.) and the admin API for runtime config changes. Primary data flows involve incoming HTTP requests being processed by a middleware chain of matchers and handlers, with TLS termination handled by the TLS app. External dependencies include certmagic for certificate management, zap for structured logging, Prometheus for metrics, and OpenTelemetry for tracing. The codebase is actively maintained with extensive test coverage and fuzz testing.
Certbot is a production-grade Python CLI tool and library for automating TLS certificate lifecycle management via the ACME protocol (RFC 8555). It obtains, renews, revokes, and deploys certificates from Let's Encrypt and other ACME-compliant CAs. The project uses a plugin-based architecture with authenticators (HTTP-01, DNS-01, standalone) and installers (Apache, Nginx, webroot) that are discovered via Python entry points. Key internal modules handle certificate lineage storage, renewal scheduling with ARI (draft-ietf-acme-ari), configuration rollback, and cross-platform OS compatibility. The repository also includes a reusable ACME protocol library (`acme`), extensive unit and integration tests (Pebble-based), and packaging for snaps, Docker, and pip. While highly polished and actively maintained, the codebase contains some deprecated shims and complex parser implementations for Apache and Nginx.
This repository implements `step-ca`, a production-grade online Certificate Authority (CA) server written in Go. It issues X.509 and SSH certificates via multiple protocols including ACME (RFC 8555), SCEP, and JWT-based provisioners. The architecture separates authorization (via pluggable provisioners: JWK, OIDC, AWS, Azure, GCP, Kubernetes, Nebula, X5C, and more) from certificate signing (via CAS backends: softcas, stepcas, cloudcas, vaultcas). The server exposes REST APIs for certificate lifecycle (sign, renew, revoke), SSH certificate management, CRLs, and an admin API for managing provisioners, policies, and webhooks. It supports external key management (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault) and can run in RA (Registration Authority) mode proxying to an upstream step-ca. The codebase is extensively tested with unit and integration tests, uses a functional options pattern for configuration, and includes a client library for bootstrapping TLS connections. Notable reusable components include a custom error type with HTTP status codes, a policy engine for name constraints, webhook integration framework, request ID middleware, and template rendering engine.
Acme-tiny is a compact Python script that automates the issuance and renewal of TLS certificates from Let's Encrypt using the ACME protocol. Designed to be auditable and under 200 lines, it requires only Python and OpenSSL as dependencies. The script functions as a CLI tool that takes an account key, certificate signing request (CSR), and ACME challenge directory as inputs, then performs the full ACME flow: account registration, order creation, HTTP-01 challenge completion, certificate finalization, and download. The architecture is a monolithic script with well-structured helper functions for subprocess execution, HTTP requests with JWS signing, and polling logic. Key operations include parsing account keys to extract public keys and compute JWK thumbprints, extracting domains from CSRs, interacting with ACME server endpoints, and handling challenge file validation. The project emphasizes security by limiting functionality to core ACME operations and encouraging users to review the source code given its access to sensitive account keys. The repository shows active maintenance with recent commits, comprehensive test suites (including integration tests with Pebble and Let's Encrypt staging), and CI workflows covering multiple Python versions. It has no external Python dependencies beyond the standard library, relying solely on the OpenSSL command-line tool for cryptographic operations. This minimal dependency footprint contributes to low technical drift and high environmental compatibility.
Traefik is a cloud-native reverse proxy and API gateway that dynamically configures itself from various service discovery backends (Docker, Kubernetes, Consul, etc.). It provides HTTP, TCP, and UDP routing, load balancing, TLS termination, ACME certificate management, a rich middleware chain (auth, rate limiting, compression, headers, etc.), observability (metrics, tracing, access logs), and a plugin system (Yaegi and Wasm). The project is written in Go with a React-based web UI. It supports Kubernetes CRDs (IngressRoute, Middleware, etc.) and the Gateway API. It has extensive integration tests and is actively maintained. The architecture is modular with clear provider interfaces, a configuration watcher that merges dynamic configs from multiple sources, and a hot-swappable handler for live updates.
This repository implements 'lego', a production-grade ACME client written in Go for automating SSL/TLS certificate issuance and renewal with Let's Encrypt and other ACME-compliant Certificate Authorities. The system operates as both a CLI tool and a reusable library, supporting the full ACME protocol (RFC 8555) including account registration, order creation, challenge solving (HTTP-01, DNS-01, TLS-ALPN-01, and experimental DNS-PERSIST-01), certificate download, and lifecycle management (renewal, revocation, archival). Architecturally, the codebase is modular: a core ACME API client (`acme/api/`) handles protocol interactions; challenge solvers (`challenge/`) implement domain validation strategies; a plugin-style DNS provider system (`providers/dns/`) integrates with over 200 DNS service APIs for automated DNS-01 challenge resolution; a CLI layer (`cmd/`) provides subcommands for run, certificates, accounts, archives, and migration; and storage (`cmd/internal/storage/`) persists certificates, keys, and account data to disk. Configuration is via YAML files, environment variables, and dotenv files. Key entry points include `main.go` (application start), `cmd/cmd_root.go` (CLI root command), and `lego/client.go` (library entry point). The primary data flow involves the user specifying domains and challenge type, the client interacting with the ACME CA to create orders and solve challenges (e.g., creating a DNS TXT record via a provider API), and finally downloading and storing the issued certificate. External dependencies include the ACME CA servers, the DNS provider APIs, and optionally an HTTP server for HTTP-01 challenges. The codebase demonstrates strong engineering practices with extensive unit and end-to-end testing, a consistent provider interface, and several well-designed internal utilities (HTTP mock server, retry/polling, error wrappers). However, the large number of DNS providers introduces boilerplate duplication and potential API drift, and the project uses a custom Go-like language dialect that may pose tooling and onboarding risks.
Infisical is an open-source end-to-end encrypted secrets management platform used to centralize, secure, and sync secrets across teams and infrastructure. The codebase is structured as a multi-service application with a primary Node.js/TypeScript backend (REST API using Fastify) and a newer Go backend implementing core platform services (authentication, permission evaluation, KMS, audit logging, secret manager). The frontend is a React SPA built with Vite and TanStack Router. The system supports self-hosted (Docker, Helm) and cloud-deployed modes. It provides a rich set of capabilities including dynamic secrets, secret rotation, approval workflows, machine identity federation (AWS, Azure, GCP, Kubernetes, OIDC), PKI management (internal and external CAs), privileged access management (PAM), secret scanning, audit logging, and extensive integration syncs. The architecture follows a modular service-oriented pattern with clear separation of concerns, extensive use of dependency injection and factory patterns for extensibility.
acme.sh is a pure shell (POSIX sh) ACME protocol client for automated TLS/SSL certificate lifecycle management. It supports multiple Certificate Authorities (Let's Encrypt, ZeroSSL, Google, SSL.com, Actalis) and provides a wide range of validation methods including HTTP-01 (webroot, standalone, Apache, Nginx), DNS-01 (via 150+ DNS provider APIs), and TLS-ALPN-01. The tool is designed for unattended cron-based renewal and includes deploy hooks for installing certificates into various services (web servers, routers, firewalls, etc.) and notification hooks for alerting on renewal outcomes. The architecture is a monolithic shell script (acme.sh) that sources plugin modules from dnsapi/, deploy/, and notify/ directories. Each plugin follows a consistent function naming convention (e.g., dns_<provider>_add/rm, <target>_deploy, <service>_send) and uses shared internal helpers for HTTP requests, credential persistence, and JSON/XML parsing. The project emphasizes cross-platform compatibility (Linux, macOS, BSDs, Solaris, Windows/Cygwin) and avoids external dependencies beyond curl/wget and openssl. Key features include ECDSA and RSA key support, wildcard certificates, OCSP Must-Staple, External Account Binding (EAB), ACME Renewal Information (ARI, RFC 9773), and automatic upgrade. The codebase is well-tested across 20+ operating systems via GitHub Actions CI, using both Pebble test servers and real CAs. While the monolithic core script is large (~4000 lines), the plugin architecture enables easy extension for new DNS providers, deployment targets, and notification channels.
Certd is a full-stack web application that automates the entire lifecycle of SSL/TLS certificates, from application via the ACME protocol to deployment across 110+ cloud providers, CDNs, and hosting platforms. It utilizes a pipeline engine for orchestrating multi-stage tasks (cert apply, conversion, deploy, notification) with retry, skip-on-success, and cron/webhook triggers. The system features a plugin architecture with decorator-based registration for tasks, access credentials, DNS providers, notifications, and OAuth, making it highly extensible. The monorepo includes a Vue 3 + Vben admin frontend and a Midway.js (Koa) backend with TypeORM and multi-database support (SQLite, MySQL, PostgreSQL). It also supports commercial features like subscription plans, wallet, payments, and enterprise project isolation. While the codebase is well-structured and actively maintained, the large number of cloud provider plugins and legacy auto-generated SDKs (e.g., JDCloud) introduce maintenance overhead and potential API drift.
This is the Dogtag PKI (Red Hat Certificate System) codebase, a comprehensive enterprise-grade Public Key Infrastructure server suite. It provides multiple subsystems: Certificate Authority (CA) for certificate lifecycle management, Key Recovery Authority (KRA) for key archival and recovery, Online Certificate Status Protocol (OCSP) responder, Token Key Service (TKS) for smart card key handling, Token Processing System (TPS) for token management, and ACME/EST responders for automated certificate enrollment. The system exposes REST APIs (both JAX-RS v1 and servlet-based v2), a rich CLI toolset (Java and Python), and a legacy Swing admin console (deprecated). Backend storage primarily uses LDAP (389 Directory Server) for certificates, requests, and configuration, with PostgreSQL optionally used for ACME realms. The architecture follows a modular monolith pattern: each PKI subsystem runs as a separate Java web application deployed on Apache Tomcat, sharing common libraries from base/common and base/server. Cryptographic operations are handled via NSS (Network Security Services) and JSS (Java Security Services). Key patterns include a ConfigStore hierarchy for type-safe configuration access, a JSONSerializer interface for consistent data serialization, a CommandCLI base class for building CLI commands, and a policy/profile framework for certificate issuance rules. The codebase demonstrates strong engineering with extensive test coverage (unit, integration, CI workflows), Docker support, and versioned upgrade scripts. While the codebase is actively maintained with frequent commits and a comprehensive CI pipeline, it shows signs of technical drift: a large volume of deprecated Swing console code marked for removal, persistent use of legacy com.netscape package names alongside newer org.dogtagpki packages, and a polyglot codebase (Java, Python, native C++ for TPS client) that increases maintenance complexity. The quality is solid overall with well-separated concerns and reusable patterns, though the sheer scale and historical accumulation of components prevent it from being considered exceptional.
Certimate is a self-hosted SSL certificate automation tool that manages the full lifecycle of TLS certificates: issuance via ACME protocol, deployment to a vast array of cloud providers (CDN, WAF, load balancers, object storage, hosting panels), and notification via chat bots and email. The system is a single-binary application with an embedded PocketBase backend (SQLite) and a React frontend. The backend is written in a Go-like language and exposes REST APIs for managing certificates, workflows, and settings. The frontend provides a visual workflow designer for creating automation pipelines with nodes for ACME issuance, deployment, upload, monitoring, and notification. Architecture: The application is built around a plugin-style provider architecture. Core interfaces (Deployer, Certmgr, Notifier, ACMEChallenger) are implemented by dozens of providers for different cloud services. A workflow engine executes directed acyclic graphs of nodes, with support for conditions, try/catch, delays, and parallel branches. The system uses PocketBase for persistence, cron-based scheduling, and admin authentication. The UI is built with React, Ant Design, and a flow editor library. Key entry points: main.go (CLI entry), cmd/serve_*.go (server startup), internal/rest/handlers/ (REST endpoints), internal/workflow/engine/ (workflow execution), internal/certacme/ (ACME client), internal/certmgmt/deployers/ (deployment registry), internal/notify/ (notification service). Data flows: User configures access credentials and workflows via UI. Workflows are scheduled via cron and executed by the engine, which calls ACME challengers to issue certificates, then deployers to install them, and notifiers to send alerts. Certificate and workflow state is persisted in PocketBase. External dependencies: PocketBase for storage and admin auth, lego (go-acme) for ACME protocol, dozens of cloud provider SDKs (Alibaba, AWS, Tencent, Huawei, etc.), and various third-party APIs for DNS challenges and deployment. The project also includes trimmed/patched copies of several SDKs to reduce dependency footprint.
This repository contains a collection of deployment and management scripts for setting up and maintaining a multi-protocol proxy server (sing-box) on VPS and free hosting platforms (Serv00/Hostuno). The system automates the installation of five proxy protocols (Vless-reality, Vmess-ws, Hysteria-2, Tuic-v5, Anytls), generates TLS certificates, configures Cloudflare Argo tunnels for CDN proxying, and provides keep-alive mechanisms via cron, GitHub Actions, Cloudflare Workers, and a Node.js web server to prevent service downtime on free hosts. The primary entry points are interactive bash scripts (`sb.sh` for VPS, `serv00.sh` for Serv00) and a non-interactive keep-alive script (`serv00keep.sh`). The architecture is a set of loosely coupled shell scripts and a small Express.js application, not a monolithic service. External dependencies include sing-box, cloudflared, and standard Linux utilities. The code is functional and widely used (10k+ stars) but exhibits typical script-level craftsmanship: long monolithic functions, global variable usage, and tight coupling to specific hosting environments. The last commit date (2026-10-13) appears anomalous and likely a data error, but the repository shows active maintenance with recent stars and forks.
lua-resty-auto-ssl is an OpenResty (nginx + Lua) plugin that automatically issues and renews SSL/TLS certificates from Let's Encrypt (ACME) on the fly. It intercepts the SSL handshake via ssl_certificate_by_lua, checks for existing certificates in shared memory or persistent storage (file or Redis), and if missing, triggers certificate issuance using the dehydrated shell client. Domain validation is handled automatically via HTTP-01 challenges. The plugin supports multiple nginx workers, distributed storage, OCSP stapling, and configurable domain allow/deny policies. It is designed for high-traffic production environments but has been explicitly abandoned by its maintainers, with no active development since 2019. The codebase is well-structured with modular storage adapters, JSON adapters, and locking mechanisms, but relies on external shell processes (sockproc) and the dehydrated script, making it difficult to maintain and prone to issues with modern Let's Encrypt API changes. Given its abandoned status, it is not recommended for new projects; users should consider alternatives like acme.sh, acme-companion, or win-acme.