Home

CertMate Wiki

SSL certificate management for modern infrastructure. Multi-DNS-provider, multi-CA, Docker-first, with a REST API and a real-time dashboard.

This wiki is the long-form companion to the README. The README covers what CertMate is and how to install it; the wiki covers the per-feature configuration and the architectural details a self-hoster needs at 2 AM.

Getting started

• Installation — Docker (recommended), Kubernetes, Python virtualenv, systemd, all the way down to the file-permission level.
• Docker — Build pipeline, multi-platform images, docker-compose.yml for production, and the hardening flags that aren't on by default.

Core configuration

• DNS Providers — DNS providers with multi-account support, domain-alias CNAME delegation, and the credential format each plugin expects.
• CA Providers — Let's Encrypt, DigiCert ACME (External Account Binding), Private CA with custom trust bundles.
• Deploy Hooks — Shell-out hooks after issuance / renewal / revocation. The threat model is documented; you should read it before pasting commands.

Client certificates

• Client Certificates — Self-signed CA, lifecycle (issue → renew → revoke), batch import from CSV (100 rows per request), audit and rate limit defaults.
• Client Certificates Overview — One-page summary of the feature surface.

Reference

• API — REST endpoints, authentication (legacy bearer + scoped API keys with allowed_domains), response shapes, and the 403 DOMAIN_OUT_OF_SCOPE envelope.
• Architecture — Module layout (modules/api/, modules/web/, modules/core/), the dual API surface, the settings concurrency model, and where the audit log lives.
• Testing — pytest layout, the Docker-based integration fixture in tests/conftest.py, and the unit-only subset that runs without Docker.

Documented in the repository, not here

Everything below shipped after this wiki was last revised. It is documented in the application repository, under docs/, which is where these pages should send you rather than growing a second copy that drifts:

• Certificate discovery and inventory — deep TLS probing, the fingerprint-keyed inventory, Certificate Transparency monitoring, adopting a discovered certificate, and the cryptographic-readiness report.
• MCP server — the Model Context Protocol server in mcp/, its sixteen tools, and how an AI agent's actions are attributed in the audit trail.
• Kubernetes and the Helm chart — the chart published to GHCR on every release, and why it refuses to render more than one replica.
• Compliance — the audit chain, actor attribution, and the NIS2/eIDAS posture.
• Deployment probes — verifying that a renewed certificate is actually being served.

The docs/ tree is translated into five languages and is covered by tests that fail if a page stops being linked, if a link points at nothing, or if an example uses a port the application does not listen on. This wiki has no such checks, which is why it had told people to install certbot==4.1.1 against an application pinned to 2.10.0 for several months.

External

• Releases — Tagged releases with per-version notes.
• Issues — Bug reports and feature requests use the templates in .github/ISSUE_TEMPLATE/.
• Discussions — Questions and ideas.