acme - :lock: acmetool, an automatic certificate acquisition tool for ACME (Let's Encrypt)

  •        54

acmetool is an easy-to-use command line tool for automatically acquiring certificates from ACME servers (such as Let's Encrypt). Designed to flexibly integrate into your webserver setup to enable automatic verification. Unlike the official Let's Encrypt client, this doesn't modify your web server configuration.You can perform verifications using port 80 or 443 (if you don't yet have a server running on one of them); via webroot; by configuring your webserver to proxy requests for /.well-known/acme-challenge/ to a special port (402) which acmetool can listen on; or by configuring your webserver not to listen on port 80, and instead running acmetool's built in HTTPS redirector (and challenge responder) on port 80. This is useful if all you want to do with port 80 is redirect people to port 443.



Related Projects

acme-client - Let's Encrypt / ACME client written in PHP for the CLI.

  •    PHP

kelunik/acme-client is an ACME client written in PHP. ACME is the protocol that powers the Let's Encrypt certificate authority.

rancher-letsencrypt - :cow: Rancher service that obtains and manages free SSL certificates from the Let's Encrypt CA

  •    Go

A Rancher service that obtains free SSL/TLS certificates from the Let's Encrypt CA, adds them to Rancher's certificate store and manages renewal and propagation of updated certificates to load balancers. If using the HTTP challenge, a reverse proxy that routes to rancher-letsencrypt.

certmagic - Automatic HTTPS for any Go program: fully-managed TLS certificate issuance and renewal

  •    Go

CertMagic is the most mature, robust, and capable ACME client integration for Go. With CertMagic, you can add one line to your Go application to serve securely over TLS, without ever having to touch certificates.

boulder - An ACME-based CA, written in Go.

  •    Go

This is an implementation of an ACME-based CA. The ACME protocol allows the CA to automatically verify that an applicant for a certificate actually controls an identifier, and allows domain holders to issue and revoke certificates for their domains.Boulder has a Dockerfile to make it easy to install and set up all its dependencies. This is how the maintainers work on Boulder, and is our main recommended way to run it.

certbot - Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server

  •    Python

Certbot is part of EFF’s effort to encrypt the entire Internet. Secure communication over the Web relies on HTTPS, which requires the use of a digital certificate that lets browsers verify the identity of web servers (e.g., is that really Web servers obtain their certificates from trusted third parties called certificate authorities (CAs). Certbot is an easy-to-use client that fetches a certificate from Let’s Encrypt—an open certificate authority launched by the EFF, Mozilla, and others—and deploys it to a web server. Anyone who has gone through the trouble of setting up a secure website knows what a hassle getting and maintaining a certificate is. Certbot and Let’s Encrypt can automate away the pain and let you turn on and manage HTTPS with simple commands. Using Certbot and Let's Encrypt is free, so there’s no need to arrange payment.

dokku-letsencrypt - BETA: Automatic Let's Encrypt TLS Certificate installation for dokku

  •    Shell

dokku-letsencrypt is the official plugin for dokku that gives the ability to automatically retrieve and install TLS certificates from During ACME validation, your app will stay available at any time.Note: Your app must already be deployed and accessible in the browser in order to add letsencrypt to your app. Your app just being created is not enough. If you need to, add a temporary certificate to your app prior to adding letsencrypt by running dokku certs:generate <app> DOMAIN to make your app accessible.

dehydrated - letsencrypt/acme client implemented as a shell-script – just add water

  •    Shell

It uses the openssl utility for everything related to actually handling keys and certificates, so you need to have that installed. Please keep in mind that this software and even the acme-protocol are relatively young and may still have some unresolved issues. Feel free to report any issues you find with this script or contribute by submitting a pull request.

acme - A simple ACME command line tool without 3rd party deps!

  •    Go

A simple command line tool to manage TLS certificates with ACME-compliant CAs, which has no third party dependencies.If you're looking for a package to import in your program, or is what you'll want instead.

haproxy-acme-validation-plugin - :four_leaf_clover: Zero-downtime ACME / Let's Encrypt certificate issuing for HAProxy

  •    Shell

HAProxy plugin implementing zero-downtime ACME http-01 validation for domains served by HAProxy instances. The plugin leverages HAProxy's Lua API to allow HAProxy to answer validation challenges using token/key-auth files provisioned by an ACME client to a designated directory. The plugin is compatible with ACME clients supporting webroot authentication for http-01 challenges. - A pure Unix shell script implementing ACME client protocol

  •    Shell

It's probably the easiest & smartest shell script to automatically issue & renew the free certificates from Let's Encrypt.

acme-client - A Ruby client for the letsencrypt's ACME protocol.

  •    Ruby

acme-client is a client implementation of the ACME protocol in Ruby. You can find the ACME reference implementations of the server in Go and the client in Python.

certify - SSL Certificate Manager UI for Windows, powered by Let's Encrypt

  •    CSharp

The SSL/TLS Certificate Management GUI for Windows, powered by Let's Encrypt, allowing you to generate and install free SSL certificates for Windows/IIS (with automated renewal). Advanced users can explore the different validation modes, deployment modes and other advanced options.

Cryptlib - provides Encryption and Authentication Service

  •    C

cryptlib is a powerful security toolkit that allows even inexperienced crypto programmers to easily add encryption and authentication services to their software. It provides support for S/MIME and PGP/OpenPGP secure enveloping, SSL/TLS and SSH secure sessions, CA services such as CMP, SCEP, RTCS, and OCSP, and other security operations such as secure timestamping.

PolarSSL library - Crypto and SSL made easy

  •    C

Download PolarSSL PolarSSL is an SSL library written in ANSI C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products with as little hassle as possible. It is designed to be readable, documented, tested, loosely coupled and portable. It supports Symmetric encryption algorithms, hash algorithms, RSA with PKCS and X.509 certificate, SSL and TLS.


  •    Makefile

This is the working area for the Working Group internet-draft, "Automatic Certificate Management Environment (ACME)". Before submitting feedback, please familiarize yourself with our current issues list and review the working group documents and mailing list discussion. If you're new to this, you may also want to read the Tao of the IETF.

win-acme - win-acme - A Simple ACME Client for Windows (for use with Let's Encrypt)

  •    CSharp

This is a ACME CLI client for Windows built in native .NET and aims to be as simple as possible to use. It's built on top of the ACMESharp project. Download the latest release, unpack and run letsencrypt.exe, and follow the messages in the input prompt. There are some useful command line arguments which can help with advanced or unattended usage scenarios.

webpki - WebPKI X.509 Certificate Validation in Rust

  •    Rust

webpki is a library that validates Web PKI (TLS/SSL) certificates. webpki is designed to provide a full implementation of the client side of the Web PKI to a diverse range of applications and devices, including embedded (IoT) applications, mobile apps, desktop applications, and server infrastructure.

Nogotofail - Network Security Testing Tool

  •    Python

Nogotofail is a network security testing tool designed to help developers and security researchers spot and fix weak TLS/SSL connections and sensitive cleartext traffic on devices and applications in a flexible, scalable, powerful way. It includes testing for common SSL certificate verification issues, HTTPS and TLS/SSL library bugs, SSL and STARTTLS stripping issues, cleartext issues, and more.