Which credentials do I use to log in the first time?

The username is admin@certimate.fun and the password is the one generated during installation, shown in your client area on the application's page. The factory password published by the project (1234567890) is never active on a ServOrbit installation. Change the email and password at your first login, from the account settings.

How is it different from certbot?

certbot renews a certificate on the server where it runs. Certimate centralises: it obtains certificates in one place, deploys them to several servers and services (SSH, cPanel, Kubernetes, CDN), keeps the history of every run and alerts you when something fails. For a single server, certbot is enough; from a few servers or shared wildcard certificates onwards, Certimate saves you from watching each machine.

Can Certimate install certificates on my other servers?

Yes. SSH deployment copies the certificate and key to the location you choose on a remote server, then runs the reload command you specify (for example nginx -t && systemctl reload nginx). Use a dedicated SSH key and an account limited to the certificate directories. Other targets exist: cPanel, Nginx Proxy Manager, Proxmox VE, Kubernetes secrets, cloud services or webhook.

Are my DNS tokens and SSH keys protected?

They are stored in Certimate's database, on your VPS, in the certimate-data volume. Treat the console like a vault: strong password, HTTPS only, encrypted backup of the volume. Limit each DNS token to editing only the zones concerned and each SSH key to the certificate directories only: a leak would then not hand over everything else.

Harden infrastructure security.

Certimate

Certimate — SSL certificates issued, deployed and renewed on their own: ACME DNS-01, SSH or cPanel deployment and alerts, on your VPS.

512 MB minimum RAM 1 vCPU Port 8109 In validation

In validation

Automatic installation for this solution is ready and currently going through our tests on a real server. Ordering will open as soon as validation is complete.

Source code

Tech stack

DockerGoCertimateSQLite

Minimum RAM512 MB minimum

Minimum CPU1 vCPU

Default port8109

Compatible OSChoice of Linux distributions

Certimate (MIT licence, more than 9,000 GitHub stars) automates the whole life cycle of an SSL/TLS certificate: the request to an ACME authority, deployment wherever the certificate is used, renewal before it expires, and an alert when something fails. Everything is set up in a web interface, as visual workflows, instead of a collection of cron jobs and certbot scripts scattered across every server.

A typical workflow requests a certificate (single domain, several domains or wildcard) through a DNS-01 challenge at your DNS provider — Cloudflare, OVHcloud, Hetzner, GoDaddy and more than 70 others —, pushes it over SSH to your nginx servers, to a cPanel hosting account, a Kubernetes secret or a cloud service, then notifies you by email, Telegram, Slack or webhook. Let's Encrypt, ZeroSSL, Google Trust Services and SSL.com are supported.

On ServOrbit, Certimate runs in a single container using about 20 MB of RAM, with its data in a volume, behind nginx over HTTPS. The image's factory password is never active: the installation sets a generated administrator password, shown in your client area.

Key features

Full life cycle — request, deployment, renewal and expiry tracking in one workflow, with no cron job to write and no script to maintain on each server.

DNS-01 or HTTP-01 challenge — wildcard and multi-domain certificates through DNS-01 at more than 70 providers (Cloudflare, OVHcloud, Hetzner, GoDaddy, Gandi…), without opening port 80 on target servers.

Several ACME authorities — Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com or Actalis, with RSA or ECC keys.

Deployment to more than 160 targets — SSH to your nginx or Apache servers, cPanel hosting, Nginx Proxy Manager, Proxmox VE, Kubernetes secrets, cloud CDNs and load balancers.

PEM, PFX and JKS formats — the same certificate delivered in the form each target expects, Java and Windows applications included.

Multi-channel alerts — email, Telegram, Slack, Discord, Mattermost, Matrix or webhook on every failure, and before a certificate expires.

Light and self-contained — a Go binary using about 20 MB of RAM, built-in SQLite database, no external database.

When to use this solution?

1

An agency managing its clients' certificates

Twenty client sites spread over three servers and a cPanel hosting account: each certificate has its workflow, its expiry date visible on the dashboard and a Telegram alert when it fails. No more forgotten renewal discovered by the client on a Monday morning, and no more certbot to watch server by server.

2

One wildcard certificate for a whole platform

Your SaaS serves app.your-domain.com, api.your-domain.com and one subdomain per customer. A single *.your-domain.com certificate, obtained through DNS-01 at Cloudflare, is pushed over SSH to each nginx server and reloaded: no port 80 to open, no server renewing on its own.

3

Getting ready for short-lived certificates

Certificate authorities are reducing the lifetime of public certificates step by step, which multiplies renewals. Automated, centralised and monitored renewal becomes the only sustainable option: Certimate triggers each workflow on your schedule and warns you before expiry if a deployment failed.

Deploy Certimate on your VPS

Guide optimized for ServOrbit Cloud VPS.

01

Create the VPS and choose the address

Order an Ubuntu 24.04 VPS with 512 MB of RAM. Certimate is a web administration console: it is published on a domain, over HTTPS. Choose a subdomain of one of your domains (for example certs.your-domain.com) or the VPS's free subdomain (certimate.{dns_slug}.servorbit-dns.com), HTTPS included. No need to buy a domain name to get started.

02

Install Certimate from the Marketplace

In your client area, select Certimate, choose the address and click Install. The script deploys the official container, generates the administrator password, applies it to the account before the first start, creates the data volume and configures the nginx reverse proxy over HTTPS.

03

Log in for the first time

Open https://your-domain: Certimate shows its login page. The username is [email protected] and the password was generated during installation; it is shown in your client area, on the application's page. The image's factory password (1234567890) is refused. Then change the email and password from the account settings.

04

Register your credentials

Under Access, add the authorisations your workflows will need: an API token from your DNS provider (Cloudflare, OVHcloud, Hetzner…) limited to editing the zones concerned, and key-based SSH access to each server that must receive certificates.

05

Create your first workflow

Under Workflows, start from a template: a request node (domains, DNS-01 challenge, ACME authority), a deployment node (SSH: certificate and key paths, then the command nginx -t && systemctl reload nginx) and a notification node. Run it once by hand, then enable the schedule for automatic renewal.

Frequently asked questions

Yes. Certimate is a web administration console: the installation publishes it on a domain, over HTTPS, behind nginx. You do not need to buy one: every ServOrbit VPS comes with a free subdomain (certimate.{dns_slug}.servorbit-dns.com) with an HTTPS certificate. You can also use a subdomain of one of your domains, for example certs.your-domain.com.

Complementary solutions

Application Deployment & DevOps

Certimate isn't orderable yet.