[{"data":1,"prerenderedAt":186},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-certimate-vps-ssl-certificates-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-self-host-certimate-vps-ssl-certificates-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":124,"ctaBody":125,"ctaButton":126,"ctaUrl":127,"relatedPosts":128},563,"self-host-certimate-vps-ssl-certificates",{"fr":12,"en":10,"ar":13,"es":14},"self-host-certimate-vps","استضافة-certimate-على-vps-شهادات-ssl","autoalojar-certimate-vps-certificados-ssl","Certimate on a VPS: automate SSL certificates with ACME","Install Certimate on a VPS: SSL certificates issued through ACME, deployed over SSH to your servers, renewed on their own, with alerts before expiry.",6,0,false,"2026-11-03T00:00:00+00:00","2026-11-04T02:04:22+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-certimate-vps-poster.svg",{"categorySlug":34,"appSlug":35},"cybersecurity-bastion","certimate","An expired certificate means a site that shows a red warning to every visitor, an API no client calls any more, and a Monday morning lost working out why certbot did not run on that particular server. Certimate, an open-source certificate manager under the MIT licence, centralises the whole cycle: it obtains certificates through ACME, deploys them to your servers, renews them before they expire and warns you when something fails. This guide installs it with Docker Compose on a VPS, replaces its factory password, publishes it over HTTPS behind nginx, then builds a first DNS-01 workflow and an SSH deployment.",[38,42,52,86,89,102,106,109,112,115,118,121],{"type":39,"title":40,"body":41},"h2","Why centralise your certificates","certbot does one thing very well: renewing the certificate of the server it runs on. As soon as you manage several servers, a shared wildcard certificate or client sites, each machine becomes a deadline to watch separately, and a silent failure is only discovered when the browser shows its warning.\n\nOn top of that, the lifetime of public certificates is getting shorter year after year, which multiplies renewals. Centralising issuance, deployment and monitoring in one place, with a history and alerts, is the safest way to never let a certificate expire again.",{"type":43,"title":44,"items":45},"ul","What Certimate brings",[46,47,48,49,50,51],"**Visual workflows** — request, deployment and notification chained in one workflow, scheduled for renewal.","**DNS-01 and HTTP-01** — wildcard and multi-domain certificates through DNS-01 at more than 70 providers, including Cloudflare, OVHcloud and Hetzner.","**Several authorities** — Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com; RSA or ECC keys.","**More than 160 deployment targets** — SSH, cPanel, Nginx Proxy Manager, Proxmox VE, Kubernetes, CDNs and cloud services.","**PEM, PFX and JKS formats** — for nginx, Apache, IIS or a Java application.","**Alerts** — email, Telegram, Slack, Discord, Matrix or webhook on every failure and before expiry.",{"type":53,"title":54,"headers":55,"rows":59},"comparison","Certimate, certbot and Nginx Proxy Manager",[5,56,57,58],"Certimate","certbot","Nginx Proxy Manager",[60,65,70,74,79,82],[61,62,63,64],"Web interface","Yes, visual workflows","No, command line","Yes",[66,67,68,69],"Several servers","Yes, SSH and API deployment","No, one per server","No, its own hosts",[71,72,73,64],"Wildcard through DNS-01","Yes, more than 70 providers","Yes, through plugins",[75,76,77,78],"Failure alerts","Yes, multi-channel","No, to be scripted","No",[80,78,78,81],"Reverse proxy","Yes, that is its job",[83,64,84,85],"Run history","Local log","Partial",{"type":39,"title":87,"body":88},"Prerequisites","An Ubuntu 24.04 VPS with 512 MB of RAM and Docker installed is enough: Certimate uses about twenty megabytes. Plan a subdomain for the console (for example `certs.example.com`) pointing to the VPS, and nginx as a reverse proxy. For the workflows, keep at hand an API token from your DNS provider and SSH access to the servers that will receive certificates.",{"type":90,"title":91,"steps":92},"steps","Install Certimate with Docker Compose",[93,96,99],{"title":94,"body":95},"Prepare the directory and the password","Create the application directory and a `.env` file holding a randomly drawn administrator password.\n```bash\nmkdir -p \u002Fopt\u002Fcertimate && cd \u002Fopt\u002Fcertimate\nprintf 'ADMIN_PASSWORD=%s\\n' \"$(openssl rand -hex 16)\" > .env\nchmod 600 .env\n```",{"title":97,"body":98},"Write the compose file","Create `compose.yaml`. On the first start only, the command applies `ADMIN_PASSWORD` to the factory account before starting the server; the marker prevents it from later overwriting a password changed in the interface. The port is published on the loopback only: only nginx reaches it.\n```yaml\nservices:\n  certimate:\n    image: certimate\u002Fcertimate:v0.4.36\n    restart: unless-stopped\n    ports:\n      - \"127.0.0.1:8109:8090\"\n    environment:\n      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?ADMIN_PASSWORD requis}\n    entrypoint: [\"sh\", \"-c\"]\n    command:\n      - >-\n        if [ ! -f \u002Fapp\u002Fpb_data\u002F.admin-seeded ]; then\n        .\u002Fcertimate superuser upsert admin@certimate.fun \"$$ADMIN_PASSWORD\" && touch \u002Fapp\u002Fpb_data\u002F.admin-seeded || exit 1;\n        fi;\n        exec .\u002Fcertimate serve --http 0.0.0.0:8090\n    volumes:\n      - certimate-data:\u002Fapp\u002Fpb_data\nvolumes:\n  certimate-data: {}\n```",{"title":100,"body":101},"Start and check","Start the stack. Certimate applies its migrations at startup, then the health probe must answer.\n```bash\ndocker compose up -d\ndocker compose ps\ncurl -fsS http:\u002F\u002F127.0.0.1:8109\u002Fapi\u002Fhealth\n```",{"type":103,"title":104,"body":105},"tip","Never leave the factory password active","The image ships an **admin@certimate.fun** account with the password **1234567890**, documented in the project README. A console exposed with these credentials hands anyone your DNS tokens and SSH keys. The command above replaces it before the server even listens; if you run the image another way, change it before publishing the domain.",{"type":39,"title":107,"body":108},"Publish the console over HTTPS behind nginx","Add a server block that proxies to the loopback. To bootstrap, use a certificate obtained once with certbot; Certimate can then renew its own like the others.\n```nginx\nserver {\n    listen 443 ssl;\n    server_name certs.example.com;\n    # ssl_certificate \u002F ssl_certificate_key: your current certificate\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:8109;\n        proxy_set_header Host $host;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto https;\n    }\n}\n```\n\nOpen `https:\u002F\u002Fcerts.example.com`, log in with `admin@certimate.fun` and the password from the `.env` file, then change the email and password in the account settings.",{"type":39,"title":110,"body":111},"First workflow: a wildcard certificate through DNS-01","Under **Access**, create a Cloudflare access (or OVHcloud, Hetzner…) with an API token limited to DNS edit permission on the zone concerned. Under **Workflows**, create a workflow: a request node with `example.com` and `*.example.com`, DNS-01 challenge, Let's Encrypt authority and ECC key.\n\nRun the workflow by hand: Certimate creates the TXT record, waits for it to propagate, obtains the certificate and stores it under **Certificates** with its expiry date. The DNS-01 challenge needs no open port on target servers, and it is the only one that allows a wildcard.",{"type":39,"title":113,"body":114},"Deploy over SSH to your nginx servers","On each target server, create a dedicated account that can only write to the certificate directory and reload nginx:\n```bash\nuseradd -m -s \u002Fbin\u002Fbash certdeploy\ninstall -d -o certdeploy -m 750 \u002Fetc\u002Fssl\u002Fcertimate\necho 'certdeploy ALL=(root) NOPASSWD: \u002Fusr\u002Fsbin\u002Fnginx -t, \u002Fusr\u002Fbin\u002Fsystemctl reload nginx' > \u002Fetc\u002Fsudoers.d\u002Fcertdeploy\n```\n\nIn Certimate, add key-based SSH access to this account, then an SSH deployment node after the request: paths `\u002Fetc\u002Fssl\u002Fcertimate\u002Fexample.com.pem` and `.key`, command `sudo nginx -t && sudo systemctl reload nginx`. Point the `ssl_certificate` and `ssl_certificate_key` of your vhosts to these files.",{"type":39,"title":116,"body":117},"Scheduled renewal and alerts","Enable the workflow's scheduled trigger (one run a day is enough: Certimate only renews when expiry gets close) and add a notification node to Telegram, Slack or email. Every run keeps its log: when something fails, you know whether the DNS challenge, the authority or the deployment broke, and you know it before expiry.",{"type":39,"title":119,"body":120},"Security and backup","Certimate's database holds your DNS tokens, SSH keys and private keys: treat the console like a vault. Strong password, HTTPS only, tokens and SSH accounts with the strict minimum of rights. Back up the volume regularly, and encrypt the archive before copying it off the VPS:\n```bash\ncd \u002Fopt\u002Fcertimate\ndocker compose stop\ndocker run --rm -v certimate_certimate-data:\u002Fdata -v \"$PWD\":\u002Fbackup alpine \\\n  tar czf \u002Fbackup\u002Fcertimate-$(date +%F).tar.gz -C \u002Fdata .\ndocker compose start\n```",{"type":39,"title":122,"body":123},"One-click Certimate on ServOrbit","From the Marketplace in your client area, Certimate installs on an Ubuntu 24.04 VPS in one click: official container, administrator password generated and applied before the first start, data volume and nginx reverse proxy over HTTPS on your domain or on the VPS's free subdomain. The password is shown in your client area, on the application's page.","Your certificates, renewed without a thought","A ServOrbit Ubuntu 24.04 VPS with 512 MB of RAM is enough for Certimate. One-click install from the Marketplace, administrator password generated for you, HTTPS on your domain or on the VPS's free subdomain.","Discover Certimate","\u002Fmarketplace\u002Fcybersecurity-bastion\u002Fcertimate",[129,149,166],{"id":130,"slug":131,"slugs":132,"title":136,"excerpt":137,"readTime":138,"views":18,"isPinned":19,"publishedAt":139,"updatedAt":140,"category":141,"categories":146,"featuredImage":30,"bgImage":31,"posterImage":148,"relatedSolution":30},116,"free-ssl-certificates-with-lets-encrypt-on-a-vps",{"fr":133,"en":131,"ar":134,"es":135},"certificats-ssl-lets-encrypt-vps","شهادات-ssl-مجانية-باستخدام-lets-encrypt-على-خادم-vps","certificados-ssl-gratis-con-lets-encrypt-en-un-vps","Free SSL Certificates with Let's Encrypt on a VPS","Complete Let's Encrypt guide for VPS: certbot nginx, DNS-01 wildcard, systemd renewal, TLS hardening, rate-limit troubleshooting and certbot vs acme.sh vs Caddy.",8,"2026-02-24T00:00:00+00:00","2026-09-30T11:20:34+00:00",{"id":138,"name":142,"slug":143,"color":144,"icon":145},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[147],{"id":138,"name":142,"slug":143,"color":144,"icon":145},"\u002Fblog\u002Fcovers\u002Fcertificats-ssl-lets-encrypt-vps-poster.svg",{"id":150,"slug":151,"slugs":152,"title":156,"excerpt":157,"readTime":158,"views":159,"isPinned":19,"publishedAt":160,"updatedAt":161,"category":162,"categories":163,"featuredImage":30,"bgImage":31,"posterImage":165,"relatedSolution":30},204,"short-tls-certificates-automate-with-acme",{"fr":153,"en":151,"ar":154,"es":155},"certificats-tls-courts-automatiser-acme","شهادات-tls-القصيرة-أتمتة-التجديد-بـ-acme","certificados-tls-cortos-automatizar-con-acme","Short TLS certificates: automate with ACME","Let's Encrypt moves to 64-day certificates on February 10, 2027, then 45 days. Timeline, ARI and a checklist for certbot, acme.sh, Caddy, Traefik, nginx.",12,1,"2026-08-01T00:00:00+00:00","2026-10-23T13:27:09+00:00",{"id":138,"name":142,"slug":143,"color":144,"icon":145},[164],{"id":138,"name":142,"slug":143,"color":144,"icon":145},"\u002Fblog\u002Fcovers\u002Fcertificats-tls-courts-automatiser-acme-poster.svg",{"id":167,"slug":168,"slugs":169,"title":173,"excerpt":174,"readTime":175,"views":23,"isPinned":19,"publishedAt":176,"updatedAt":177,"category":178,"categories":183,"featuredImage":30,"bgImage":31,"posterImage":185,"relatedSolution":30},37,"deploy-your-applications-with-nginx-proxy-manager-on-a-vps",{"fr":170,"en":168,"ar":171,"es":172},"deployer-avec-nginx-proxy-manager","انشر-تطبيقاتك-باستخدام-nginx-proxy-manager-على-خادم-vps","desplegar-con-nginx-proxy-manager","Deploy your applications with Nginx Proxy Manager on a VPS","Manage domains, SSL and reverse proxy for several services on a VPS with Nginx Proxy Manager: installation, Docker networks, 502 troubleshooting and configuration.",9,"2026-05-14T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":179,"name":180,"slug":181,"color":182,"icon":181},3,"Deployment","deploiement","bg-success\u002F10 text-success",[184],{"id":179,"name":180,"slug":181,"color":182,"icon":181},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-nginx-proxy-manager-poster.svg",1793758471603]