[{"data":1,"prerenderedAt":122},["ShallowReactive",2],{"seo-verification":3,"marketplace-app-en-certimate":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"marketplace-app-en-certimate",{"slug":9,"slugs":10,"categorySlugs":11,"name":16,"description":17,"phase":18,"unavailableReason":19,"docsUrl":20,"logo":21,"github":22,"tagline":23,"longDescription":24,"features":25,"useCases":33,"steps":43,"faq":59,"specs":75,"compatibleOs":87,"relatedApps":88,"relatedPosts":115,"category":119},"certimate",{"fr":9,"en":9,"ar":9,"es":9},{"fr":12,"en":13,"ar":14,"es":15},"cybersecurity","cybersecurity-bastion","الأمن-السيبراني-والحصن","ciberseguridad-bastion","Certimate","Open-source SSL\u002FTLS certificate manager: ACME issuance, deployment to your servers, automatic renewal and expiry alerts.",2,"awaiting_qa","https:\u002F\u002Fservorbit.com\u002Fblog\u002Fself-host-certimate-vps-ssl-certificates","https:\u002F\u002Fcdn.jsdelivr.net\u002Fgh\u002Fselfhst\u002Ficons\u002Fsvg\u002Fcertimate.svg","https:\u002F\u002Fgithub.com\u002Fcertimate-go\u002Fcertimate","Certimate — SSL certificates issued, deployed and renewed on their own: ACME DNS-01, SSH or cPanel deployment and alerts, on your VPS.","Certimate (MIT licence, more than 9,000 GitHub stars) automates the whole life cycle of an SSL\u002FTLS certificate: the request to an ACME authority, deployment wherever the certificate is used, renewal before it expires, and an alert when something fails. Everything is set up in a web interface, as visual workflows, instead of a collection of cron jobs and certbot scripts scattered across every server.\n\nA typical workflow requests a certificate (single domain, several domains or wildcard) through a DNS-01 challenge at your DNS provider — Cloudflare, OVHcloud, Hetzner, GoDaddy and more than 70 others —, pushes it over SSH to your nginx servers, to a cPanel hosting account, a Kubernetes secret or a cloud service, then notifies you by email, Telegram, Slack or webhook. Let's Encrypt, ZeroSSL, Google Trust Services and SSL.com are supported.\n\nOn ServOrbit, Certimate runs in a single container using about 20 MB of RAM, with its data in a volume, behind nginx over HTTPS. The image's factory password is never active: the installation sets a generated administrator password, shown in your client area.",[26,27,28,29,30,31,32],"Full life cycle — request, deployment, renewal and expiry tracking in one workflow, with no cron job to write and no script to maintain on each server.","DNS-01 or HTTP-01 challenge — wildcard and multi-domain certificates through DNS-01 at more than 70 providers (Cloudflare, OVHcloud, Hetzner, GoDaddy, Gandi…), without opening port 80 on target servers.","Several ACME authorities — Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com or Actalis, with RSA or ECC keys.","Deployment to more than 160 targets — SSH to your nginx or Apache servers, cPanel hosting, Nginx Proxy Manager, Proxmox VE, Kubernetes secrets, cloud CDNs and load balancers.","PEM, PFX and JKS formats — the same certificate delivered in the form each target expects, Java and Windows applications included.","Multi-channel alerts — email, Telegram, Slack, Discord, Mattermost, Matrix or webhook on every failure, and before a certificate expires.","Light and self-contained — a Go binary using about 20 MB of RAM, built-in SQLite database, no external database.",[34,37,40],{"title":35,"body":36},"An agency managing its clients' certificates","Twenty client sites spread over three servers and a cPanel hosting account: each certificate has its workflow, its expiry date visible on the dashboard and a Telegram alert when it fails. No more forgotten renewal discovered by the client on a Monday morning, and no more certbot to watch server by server.",{"title":38,"body":39},"One wildcard certificate for a whole platform","Your SaaS serves app.your-domain.com, api.your-domain.com and one subdomain per customer. A single *.your-domain.com certificate, obtained through DNS-01 at Cloudflare, is pushed over SSH to each nginx server and reloaded: no port 80 to open, no server renewing on its own.",{"title":41,"body":42},"Getting ready for short-lived certificates","Certificate authorities are reducing the lifetime of public certificates step by step, which multiplies renewals. Automated, centralised and monitored renewal becomes the only sustainable option: Certimate triggers each workflow on your schedule and warns you before expiry if a deployment failed.",[44,47,50,53,56],{"title":45,"body":46},"Create the VPS and choose the address","Order an Ubuntu 24.04 VPS with 512 MB of RAM. Certimate is a web administration console: it is published on a domain, over HTTPS. Choose a subdomain of one of your domains (for example certs.your-domain.com) or the VPS's free subdomain (certimate.{dns_slug}.servorbit-dns.com), HTTPS included. No need to buy a domain name to get started.",{"title":48,"body":49},"Install Certimate from the Marketplace","In your client area, select Certimate, choose the address and click Install. The script deploys the official container, generates the administrator password, applies it to the account before the first start, creates the data volume and configures the nginx reverse proxy over HTTPS.",{"title":51,"body":52},"Log in for the first time","Open https:\u002F\u002Fyour-domain: Certimate shows its login page. The username is admin@certimate.fun and the password was generated during installation; it is shown in your client area, on the application's page. The image's factory password (1234567890) is refused. Then change the email and password from the account settings.",{"title":54,"body":55},"Register your credentials","Under Access, add the authorisations your workflows will need: an API token from your DNS provider (Cloudflare, OVHcloud, Hetzner…) limited to editing the zones concerned, and key-based SSH access to each server that must receive certificates.",{"title":57,"body":58},"Create your first workflow","Under Workflows, start from a template: a request node (domains, DNS-01 challenge, ACME authority), a deployment node (SSH: certificate and key paths, then the command nginx -t && systemctl reload nginx) and a notification node. Run it once by hand, then enable the schedule for automatic renewal.",[60,63,66,69,72],{"q":61,"a":62},"Do I need a domain name for Certimate?","Yes. Certimate is a web administration console: the installation publishes it on a domain, over HTTPS, behind nginx. You do not need to buy one: every ServOrbit VPS comes with a free subdomain (certimate.{dns_slug}.servorbit-dns.com) with an HTTPS certificate. You can also use a subdomain of one of your domains, for example certs.your-domain.com.",{"q":64,"a":65},"Which credentials do I use to log in the first time?","The username is admin@certimate.fun and the password is the one generated during installation, shown in your client area on the application's page. The factory password published by the project (1234567890) is never active on a ServOrbit installation. Change the email and password at your first login, from the account settings.",{"q":67,"a":68},"How is it different from certbot?","certbot renews a certificate on the server where it runs. Certimate centralises: it obtains certificates in one place, deploys them to several servers and services (SSH, cPanel, Kubernetes, CDN), keeps the history of every run and alerts you when something fails. For a single server, certbot is enough; from a few servers or shared wildcard certificates onwards, Certimate saves you from watching each machine.",{"q":70,"a":71},"Can Certimate install certificates on my other servers?","Yes. SSH deployment copies the certificate and key to the location you choose on a remote server, then runs the reload command you specify (for example nginx -t && systemctl reload nginx). Use a dedicated SSH key and an account limited to the certificate directories. Other targets exist: cPanel, Nginx Proxy Manager, Proxmox VE, Kubernetes secrets, cloud services or webhook.",{"q":73,"a":74},"Are my DNS tokens and SSH keys protected?","They are stored in Certimate's database, on your VPS, in the certimate-data volume. Treat the console like a vault: strong password, HTTPS only, encrypted backup of the volume. Limit each DNS token to editing only the zones concerned and each SSH key to the certificate directories only: a leak would then not hand over everything else.",{"ram":76,"cpu":77,"disk":78,"stack":79,"port":83,"license":84,"version":85,"os":86},"512 MB minimum","1 vCPU","2 GB",[80,81,16,82],"Docker","Go","SQLite","8109","MIT","0.4.36","Ubuntu 24.04",[],[89,98,107],{"name":90,"slug":91,"categorySlug":92,"categoryName":93,"categoryColor":94,"logo":95,"tagline":96,"description":97},"Caddy","caddy","application-deployment-devops","Application Deployment & DevOps","text-success bg-success\u002F10","https:\u002F\u002Fcdn.simpleicons.org\u002Fcaddy","Automatic SSL for your applications — effortless HTTPS, auto-renewed certificates.","A modern web server and reverse proxy with automatic HTTPS. Let's Encrypt SSL certificates are obtained and renewed on their own, with minimal configuration via a Caddyfile.",{"name":99,"slug":100,"categorySlug":101,"categoryName":102,"categoryColor":103,"logo":104,"tagline":105,"description":106},"Uptime Kuma","uptime-kuma","monitoring-observability","Monitoring & Observability","text-amber-400 bg-amber-500\u002F10","https:\u002F\u002Fcdn.simpleicons.org\u002Fuptimekuma","Self-hosted uptime monitoring with beautiful status pages — unlimited monitors, no SaaS bill.","Simple, visual availability monitoring. Watch your HTTP, TCP and DNS endpoints and receive instant alerts.",{"name":108,"slug":109,"categorySlug":13,"categoryName":110,"categoryColor":111,"logo":112,"tagline":113,"description":114},"Infisical","infisical","Cybersecurity & Bastion","text-red-400 bg-red-500\u002F10","https:\u002F\u002Fcdn.jsdelivr.net\u002Fgh\u002Fselfhst\u002Ficons\u002Fsvg\u002Finfisical.svg","Self-hosted secrets manager — one encrypted vault for API keys, env vars and certificates, injected into your apps and CI\u002FCD instead of copied into `.env` files.","Open-source secrets manager — centralise API keys, env vars and certificates in a self-hosted vault, synced to CI\u002FCD pipelines and apps via a unified SDK. MIT-licensed Doppler\u002FVault alternative.",[116,117,118],"certificats-ssl-lets-encrypt-vps","certificats-tls-courts-automatiser-acme","deployer-avec-nginx-proxy-manager",{"key":120,"slug":13,"name":110,"objective":121,"icon":120,"color":111},"security","Harden infrastructure security.",1793758701032]