caddyserver/certmagic
Certmagic
Certmagic is a Go library for automating the issuance and renewal of TLS certificates. It functions as an automatic HTTPS provisioner and ACME client that handles the full lifecycle of certificates to ensure secure connectivity without manual intervention.
The library is distinguished by its support for on-demand TLS provisioning, which generates certificates dynamically during the TLS handshake based on the server name. It also provides automation for wildcard certificates through DNS challenge verification and integrates with the ZeroSSL API for certificate acquisition.
The project covers a broad range of capabilities, including ACME challenge resolution, automated renewal scheduling, and certificate revocation. It manages data persistence through pluggable storage backends and implements distributed locking and synchronization to coordinate certificate management across server clusters. Additional functionality includes OCSP stapling, in-memory caching, and the generation of TLS configurations for custom servers.
Features
- TLS Certificate Management - Provides a comprehensive system for the automated provisioning, renewal, and lifecycle management of TLS security certificates.
- HTTP Challenge Resolutions - Implements HTTP challenge resolution to automate domain ownership verification for certificate authorities.
- On-Demand Certificate Issuance - Provides on-demand TLS provisioning to generate certificates dynamically during the TLS handshake.
- Certificate Lifecycle Management - Manages the complete lifecycle of security certificates, including issuance, rotation, and renewal.
- Certificate Renewal Managers - Automates the full lifecycle of security certificates, including the maintenance and renewal phase.
- Domain Ownership Verification - Proves domain control by responding to ACME challenges via DNS records and temporary HTTP servers.
- DNS and HTTP Challenges - Implements automated domain ownership verification using HTTP and DNS challenges to obtain ACME certificates.
- Automatic Certificate Provisioning - Automatically obtains and renews TLS certificates to enable secure HTTPS serving with automatic redirects.
- Certificate Data Persistence - Persists certificates and private keys to a backend for reliable retrieval during TLS handshakes.
- ACME Certificate Clients - Implements an ACME client to automate the acquisition and management of TLS certificates from compliant authorities.
- Certificate Renewal Schedulers - Monitors certificate expiration dates and automatically triggers the issuance process to prevent service interruptions.
- Pluggable Storage Backends - Provides a pluggable key-value interface for persisting certificates and metadata via file systems or databases.
- Background Job Queues - Manages asynchronous certificate renewal tasks with concurrency limits and duplicate request prevention.
- Distributed Task Coordination - Synchronizes operations across a cluster using shared locks to prevent duplicate work during certificate issuance.
- Distributed Locks - Uses lease-based synchronization in shared storage to prevent duplicate certificate issuance across server clusters.
- DNS Zone Discovery - Identifies the authoritative DNS zone for a domain to verify ownership for security certificates.
- Zone Apex Identification - Determines the root zone for a domain by recursing through labels until a Start of Authority record is found.
- Wildcard Certificate Issuance - Automates the issuance of wildcard certificates using DNS challenge verification.
- Certificate Authority API Integrations - Integrates with the ZeroSSL API to automate certificate acquisition and domain verification.
- Certificate Revocations - Requests the invalidation of compromised or unnecessary certificates from the certificate authority.
- Certificate Storage Backends - Synchronizes certificate data across a cluster using shared storage backends like databases or KV stores.
- OCSP Response Caching - Fetches and caches pre-signed OCSP responses to improve certificate revocation check performance and privacy.
- HTTPS Enforcements - Automatically redirects incoming unencrypted HTTP traffic to secure HTTPS connections.
- On-Demand TLS Issuance - Generates and installs TLS certificates dynamically during the handshake based on the requested server name.
- TLS Certificate Configuration - Generates ready-to-use TLS configurations for use in custom listeners or servers.
- Certificate Caches - Indexes active certificates in memory by domain name to accelerate the TLS handshake process.
- TLS Certificate Selection Logic - Determines the correct certificate to present during a handshake based on the Server Name Indication.
- Wildcard Certificate Management - Automates the issuance and management of wildcard certificates using DNS challenge verification.
- Asynchronous Task Managers - Coordinates concurrent background operations and non-blocking task execution for certificate management.
- HTTPS Servers - Implements an HTTPS server that handles automatic certificate management and HTTP-to-HTTPS redirects.
- Security And Privacy - Automatic HTTPS and TLS certificate management.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
