go-acme/lego
Lego
Lego is an ACME certificate manager and lifecycle tool used to automate the request, renewal, and revocation of SSL and TLS certificates. It implements the ACME protocol to communicate with compliant certificate authorities and manages the full issuance process, including account registration and private key rollovers.
The project distinguishes itself through extensive DNS automation, utilizing a provider-based abstraction to solve DNS-01 challenges across various third-party DNS providers. It supports advanced verification workflows such as CNAME-based challenge delegation, DNS zone discovery, and the issuance of wildcard certificates and IP address certificates.
Lego provides a command line interface for manual operations and supports automation via lifecycle-based hooks that trigger external scripts during the issuance process. It handles identity verification through DNS, HTTP, and TLS-ALPN methods, while maintaining account persistence and certificate data through a structured local archive.
The tool includes detailed logging for network interaction debugging and supports the use of pre-generated certificate signing requests.
Features
- ACME Clients - Implements the ACME protocol as a command-line tool for automated certificate lifecycle management.
- Certificate Archives - Stores and retrieves certificate data and private keys in a structured archive for persistence.
- Command Line Interfaces - Provides a terminal-based interface for managing certificate lifecycles, account registrations, and key rollovers.
- ACME Protocol Implementations - Implements standardized communication flows for interacting with certificate authorities via challenge-response mechanisms.
- CA Server Configurations - Allows specifying the CA server endpoints and settings required to validate and issue security certificates.
- Certificate Lifecycle Management - Manages the full lifecycle of obtaining, renewing, and rotating security certificates from compliant authorities.
- Certificate Renewal Managers - Automatically extends the validity of existing certificates before they expire to ensure continuous encryption.
- SSL/TLS Certificate Management - Requests and renews digital certificates by completing identity challenges through various protocols.
- Domain Ownership Verification - Proves domain control by solving identity challenges via DNS, HTTP, or TLS-ALPN methods.
- DNS Validation Providers - Provides a common interface to manage TXT records across diverse DNS APIs for automated ownership validation.
- ACME Account Archives - Stores account registration details and private keys in local archives for long-term management and recovery.
- DNS Challenge Modules - Automates the creation and deletion of DNS TXT records to prove domain ownership for the DNS-01 challenge.
- Lifecycle Event Hooks - Provides script triggers that execute during lifecycle events such as before creation or after deployment.
- Lifecycle Script Execution - Triggers external shell scripts at predefined stages of the certificate issuance and renewal process.
- Lifecycle Event Hooks - Lego triggers external scripts at specific stages of the issuance and renewal process to execute custom automation.
- Challenge Delegation - Supports delegating DNS challenge resolution to secondary zones using CNAME records.
- CNAME Challenge Resolution - Follows CNAME records during the validation process to verify domain ownership.
- Account Management - Manages ACME account registration, private key rollovers, and account recovery for CA communication.
- Custom Issuance Workflows - Integrates external scripts and pre-generated certificate signing requests into the automated issuance process.
- Certificate Signing Request Managers - Supports the use of pre-generated certificate signing requests (CSRs) alongside automatic key pair generation.
- Credential Revocation - Invalidates active certificates with the issuing authority to prevent trust in compromised credentials.
- Identity Challenge Dispatchers - Dispatches identity verification requests across multiple network layers to satisfy various certificate authority requirements.
- Wildcard Certificate Issuers - Generates single certificates that secure an unlimited number of subdomains for a primary domain.
- Wildcard Certificate Management - Automates the provisioning and renewal of wildcard certificates to secure primary domains and all subdomains.
- More to explore - Let's Encrypt client and ACME library.
- Security and Cryptography - ACME client library and CLI tool.
