awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
caddyserver avatar

caddyserver/certmagic

0
View on GitHub↗
pkg.go.dev/github.com/caddyserver/certmagic?tab=doc↗

Certmagic

Certmagic is a Go library for automating the issuance and renewal of TLS certificates. It functions as an automatic HTTPS provisioner and ACME client that handles the full lifecycle of certificates to ensure secure connectivity without manual intervention.

The library is distinguished by its support for on-demand TLS provisioning, which generates certificates dynamically during the TLS handshake based on the server name. It also provides automation for wildcard certificates through DNS challenge verification and integrates with the ZeroSSL API for certificate acquisition.

The project covers a broad range of capabilities, including ACME challenge resolution, automated renewal scheduling, and certificate revocation. It manages data persistence through pluggable storage backends and implements distributed locking and synchronization to coordinate certificate management across server clusters. Additional functionality includes OCSP stapling, in-memory caching, and the generation of TLS configurations for custom servers.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • TLS Certificate Management - Provides a comprehensive system for the automated provisioning, renewal, and lifecycle management of TLS security certificates.
  • HTTP Challenge Resolutions - Implements HTTP challenge resolution to automate domain ownership verification for certificate authorities.
  • On-Demand Certificate Issuance - Provides on-demand TLS provisioning to generate certificates dynamically during the TLS handshake.
  • Certificate Lifecycle Management - Manages the complete lifecycle of security certificates, including issuance, rotation, and renewal.
  • Certificate Renewal Managers - Automates the full lifecycle of security certificates, including the maintenance and renewal phase.
  • Domain Ownership Verification - Proves domain control by responding to ACME challenges via DNS records and temporary HTTP servers.
  • DNS and HTTP Challenges - Implements automated domain ownership verification using HTTP and DNS challenges to obtain ACME certificates.
  • Automatic Certificate Provisioning - Automatically obtains and renews TLS certificates to enable secure HTTPS serving with automatic redirects.
  • Certificate Data Persistence - Persists certificates and private keys to a backend for reliable retrieval during TLS handshakes.
  • ACME Certificate Clients - Implements an ACME client to automate the acquisition and management of TLS certificates from compliant authorities.
  • Certificate Renewal Schedulers - Monitors certificate expiration dates and automatically triggers the issuance process to prevent service interruptions.
  • Pluggable Storage Backends - Provides a pluggable key-value interface for persisting certificates and metadata via file systems or databases.
  • Background Job Queues - Manages asynchronous certificate renewal tasks with concurrency limits and duplicate request prevention.
  • Distributed Task Coordination - Synchronizes operations across a cluster using shared locks to prevent duplicate work during certificate issuance.
  • Distributed Locks - Uses lease-based synchronization in shared storage to prevent duplicate certificate issuance across server clusters.
  • DNS Zone Discovery - Identifies the authoritative DNS zone for a domain to verify ownership for security certificates.
  • Zone Apex Identification - Determines the root zone for a domain by recursing through labels until a Start of Authority record is found.
  • Wildcard Certificate Issuance - Automates the issuance of wildcard certificates using DNS challenge verification.
  • Certificate Authority API Integrations - Integrates with the ZeroSSL API to automate certificate acquisition and domain verification.
  • Certificate Revocations - Requests the invalidation of compromised or unnecessary certificates from the certificate authority.
  • Certificate Storage Backends - Synchronizes certificate data across a cluster using shared storage backends like databases or KV stores.
  • OCSP Response Caching - Fetches and caches pre-signed OCSP responses to improve certificate revocation check performance and privacy.
  • HTTPS Enforcements - Automatically redirects incoming unencrypted HTTP traffic to secure HTTPS connections.
  • On-Demand TLS Issuance - Generates and installs TLS certificates dynamically during the handshake based on the requested server name.
  • TLS Certificate Configuration - Generates ready-to-use TLS configurations for use in custom listeners or servers.
  • Certificate Caches - Indexes active certificates in memory by domain name to accelerate the TLS handshake process.
  • TLS Certificate Selection Logic - Determines the correct certificate to present during a handshake based on the Server Name Indication.
  • Wildcard Certificate Management - Automates the issuance and management of wildcard certificates using DNS challenge verification.
  • Asynchronous Task Managers - Coordinates concurrent background operations and non-blocking task execution for certificate management.
  • HTTPS Servers - Implements an HTTPS server that handles automatic certificate management and HTTP-to-HTTPS redirects.
  • Security And Privacy - Automatic HTTPS and TLS certificate management.
5,568 stars·334 forks·Go·Apache-2.0·27 views

Star history

Star history chart for caddyserver/certmagicStar history chart for caddyserver/certmagic

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does caddyserver/certmagic do?

Certmagic is a Go library for automating the issuance and renewal of TLS certificates. It functions as an automatic HTTPS provisioner and ACME client that handles the full lifecycle of certificates to ensure secure connectivity without manual intervention.

What are the main features of caddyserver/certmagic?

The main features of caddyserver/certmagic are: TLS Certificate Management, HTTP Challenge Resolutions, On-Demand Certificate Issuance, Certificate Lifecycle Management, Certificate Renewal Managers, Domain Ownership Verification, DNS and HTTP Challenges, Automatic Certificate Provisioning.

Which projects share features with caddyserver/certmagic?

Projects with overlapping indexed features include: certd/certd — Certd is a self-hosted platform that automates the full lifecycle of SSL certificates using the ACME protocol. It… go-acme/lego — Lego is an ACME certificate manager and lifecycle tool used to automate the request, renewal, and revocation of SSL… cloudflare/cfssl — This project is a toolkit for creating and managing X.509 certificate authorities, providing tools for the issuance,… smallstep/certificates — This project is a public key infrastructure management system designed to automate the issuance, renewal, and… dehydrated-io/dehydrated — Dehydrated is a shell-script ACME client that automates the lifecycle of TLS certificates from certificate authorities… neilpang/acme.sh — acme.sh is a shell-based certificate manager and ACME SSL certificate client. It automates the issuance, renewal, and…

Projects sharing features with Certmagic

These projects share indexed features with Certmagic. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • certd/certdcertd avatar

    certd/certd

    4,454View on GitHub↗

    Certd is a self-hosted platform that automates the full lifecycle of SSL certificates using the ACME protocol. It handles certificate application, renewal, and deployment across multiple domains through a pipeline-driven workflow engine, with DNS challenge orchestration and multi-cloud deployment capabilities. The platform distinguishes itself through its configurable pipeline system, which allows users to build multi-step workflows that can pass outputs between tasks, execute custom scripts, and handle errors. It supports multi-tenant access control with role-based permissions, encrypted cre

    JavaScriptacmeautoautomation
    View on GitHub↗4,454
  • go-acme/legogo-acme avatar

    go-acme/lego

    9,689View on GitHub↗

    Lego is an ACME certificate manager and lifecycle tool used to automate the request, renewal, and revocation of SSL and TLS certificates. It implements the ACME protocol to communicate with compliant certificate authorities and manages the full issuance process, including account registration and private key rollovers. The project distinguishes itself through extensive DNS automation, utilizing a provider-based abstraction to solve DNS-01 challenges across various third-party DNS providers. It supports advanced verification workflows such as CNAME-based challenge delegation, DNS zone discover

    Goacmeacme-clientcertificate
    View on GitHub↗9,689
  • cloudflare/cfsslcloudflare avatar

    cloudflare/cfssl

    9,443View on GitHub↗

    This project is a toolkit for creating and managing X.509 certificate authorities, providing tools for the issuance, signing, and management of TLS certificates and private keys. It includes a command-line utility for generating certificate signing requests, bundling certificate chains, and parsing PEM or DER files. The system features an HTTP API server that allows for remote signing and verification of certificates using JSON requests and responses. This architecture supports automated certificate provisioning and includes a signing proxy to forward requests to remote backend services. The

    Go
    View on GitHub↗9,443
  • smallstep/certificatessmallstep avatar

    smallstep/certificates

    8,245View on GitHub↗

    This project is a public key infrastructure management system designed to automate the issuance, renewal, and revocation of X.509, TLS, and SSH certificates. It functions as a machine identity provider and certificate authority, enabling the establishment of private PKI to secure inter-service communication and remote access. The system distinguishes itself through hardware-bound identity attestation, which ties cryptographic keys to physical device silicon or TPMs to prevent credential exfiltration. It supports a wide array of identity verification mechanisms, including OIDC, cloud-provider

    Goacmeacme-serverca
    View on GitHub↗8,245
    • Compare all 30 related projects→