caddyserver/certmagic

Features

• TLS Certificate Management - Provides a comprehensive system for the automated provisioning, renewal, and lifecycle management of TLS security certificates.
• HTTP Challenge Resolutions - Implements HTTP challenge resolution to automate domain ownership verification for certificate authorities.
• On-Demand Certificate Issuance - Provides on-demand TLS provisioning to generate certificates dynamically during the TLS handshake.
• Certificate Lifecycle Management - Manages the complete lifecycle of security certificates, including issuance, rotation, and renewal.
• Certificate Renewal Managers - Automates the full lifecycle of security certificates, including the maintenance and renewal phase.
• Domain Ownership Verification - Proves domain control by responding to ACME challenges via DNS records and temporary HTTP servers.
• DNS and HTTP Challenges - Implements automated domain ownership verification using HTTP and DNS challenges to obtain ACME certificates.
• Automatic Certificate Provisioning - Automatically obtains and renews TLS certificates to enable secure HTTPS serving with automatic redirects.
• Certificate Data Persistence - Persists certificates and private keys to a backend for reliable retrieval during TLS handshakes.
• ACME Certificate Clients - Implements an ACME client to automate the acquisition and management of TLS certificates from compliant authorities.
• Certificate Renewal Schedulers - Monitors certificate expiration dates and automatically triggers the issuance process to prevent service interruptions.
• Pluggable Storage Backends - Provides a pluggable key-value interface for persisting certificates and metadata via file systems or databases.
• Background Job Queues - Manages asynchronous certificate renewal tasks with concurrency limits and duplicate request prevention.
• Distributed Task Coordination - Synchronizes operations across a cluster using shared locks to prevent duplicate work during certificate issuance.
• Distributed Locks - Uses lease-based synchronization in shared storage to prevent duplicate certificate issuance across server clusters.
• DNS Zone Discovery - Identifies the authoritative DNS zone for a domain to verify ownership for security certificates.
• Zone Apex Identification - Determines the root zone for a domain by recursing through labels until a Start of Authority record is found.
• Wildcard Certificate Issuance - Automates the issuance of wildcard certificates using DNS challenge verification.
• Certificate Authority API Integrations - Integrates with the ZeroSSL API to automate certificate acquisition and domain verification.
• Certificate Revocations - Requests the invalidation of compromised or unnecessary certificates from the certificate authority.
• Certificate Storage Backends - Synchronizes certificate data across a cluster using shared storage backends like databases or KV stores.
• OCSP Response Caching - Fetches and caches pre-signed OCSP responses to improve certificate revocation check performance and privacy.
• HTTPS Enforcements - Automatically redirects incoming unencrypted HTTP traffic to secure HTTPS connections.
• On-Demand TLS Issuance - Generates and installs TLS certificates dynamically during the handshake based on the requested server name.
• TLS Certificate Configuration - Generates ready-to-use TLS configurations for use in custom listeners or servers.
• Certificate Caches - Indexes active certificates in memory by domain name to accelerate the TLS handshake process.
• TLS Certificate Selection Logic - Determines the correct certificate to present during a handshake based on the Server Name Indication.
• Wildcard Certificate Management - Automates the issuance and management of wildcard certificates using DNS challenge verification.
• Asynchronous Task Managers - Coordinates concurrent background operations and non-blocking task execution for certificate management.
• HTTPS Servers - Implements an HTTPS server that handles automatic certificate management and HTTP-to-HTTPS redirects.
• Security And Privacy - Automatic HTTPS and TLS certificate management.

Star history