certimate - Moses Yebei

certimate

Abstract

An open-source and free self-hosted SSL certificates ACME tool, automates the full-cycle of issuance, deployment, renewal, and monitoring visually. 完全开源免费的自托管 SSL 证书 ACME 工具，申请、部署、续期、监控全流程自动化可视化，支持各大主流云厂商。

The Problem

Managing SSL certificates across many cloud providers requires repeatedly handling ACME challenges, DNS‑based validation, and manual deployment. Teams that operate services on multiple platforms face a repetitive, error‑prone workflow for issuance, renewal, and placement of certificates.

What This Does

Certimate is a self‑hosted ACME client that automates the full certificate lifecycle. The repository is organised around three core packages:

pkg/ (1281 files) – core business logic, scheduler, and singleton management.
ui/ (655 files) – React front‑end built with Vite; provides a visual dashboard for status and configuration.
internal/ – split into certacme (ACME client, account handling, and >200 certifier plugins such as internal/certacme/certifiers/sp_cloudflare.go) and certmgmt (deployer plugins such as internal/certmgmt/deployers/sp_aws_alb.go).

Renewal is driven by internal/app/scheduler.go, which runs periodic jobs; internal/app/singleton.go ensures only one instance processes certificates at a time. The UI contacts the backend through the Express server started by cmd/serve_nonwindows.go or cmd/serve_windows.go.

How It Is Wired

Execution begins at a CLI entry point:

Entry point	Role
`cmd/intercmd.go`	Parses flags, loads configuration, dispatches to `serve` or one‑shot modes.
`cmd/serve_nonwindows.go` / `cmd/serve_windows.go`	Starts the HTTP server that serves the UI and API.
`cmd/version.go`	Prints the binary version.

The typical run flow:

cmd/intercmd.go reads config from internal/certacme/config.go (file path or env‑var driven).
The selected certifier (e.g., sp_cloudflare.go) is instantiated via internal/certacme/certifiers/registry.go.
internal/certacme/client.go performs the ACME challenge; DNS‑01 validation is handled by the certifier’s provider API.
Upon successful issuance, internal/certmgmt/deployers/registry.go selects the appropriate deployer (e.g., sp_aws_alb.go) to push the certificate to the target platform.
The scheduler (internal/app/scheduler.go) repeats the cycle at the configured interval; internal/app/singleton.go guards against overlapping runs.

All network calls stay within the Go process; no external database or runtime is required.

How To Use It

Setup

git clone https://github.com/moses-y/certimate
cd certimate
# Build binary
make build          # uses the Makefile
# Or build Docker image
docker build -t certimate -f Dockerfile .

Configuration Configuration is read by internal/certacme/config.go. Supported options include the ACME server URL, email, and the path to a JSON or YAML file containing provider credentials. The file format is defined in that source; no separate env‑var schema is imposed outside the Go code.

Running it

One‑shot renewal: ./certimate renew (invoked via cmd/intercmd.go).
Continuous server with UI: ./certimate serve (starts the Express server referenced in cmd/serve_nonwindows.go/cmd/serve_windows.go).
Docker: docker run -v /path/to/config:/etc/certimate certimate serve.

Real‑World Use

A mid‑size SaaS running services on both Cloudflare and AWS ALB can configure two certifiers and deployers:

# config.example.toml (illustrative)
certifiers = ["cloudflare"]
deployers = ["aws_alb"]

The scheduler (internal/app/scheduler.go) will, each day, ask Cloudflare to create a TXT record for domain validation, obtain the certificate via the ACME server, and then call internal/certmgmt/deployers/sp_aws_alb.go to install the cert on the ALB. The UI shows the status of each step, allowing operators to verify that renewal succeeded without logging into each cloud console.

Code Health & Issues

Static analysis reports:

208 test files exist across the repository.
16 documentation files (including README.md, CHANGELOG.md, and language‑specific guides).
No missing licence or lockfile; CI pipelines (github/workflows/*.yml) run tests and publish Docker images.

The most notable maintainability consideration is the extensive provider surface: over 200 certifier and 200+ deployer implementations (internal/certacme/certifiers/ and internal/certmgmt/deployers/). While this gives broad compatibility, it also means a larger surface for compatibility bugs and requires contributors to be familiar with many external APIs.

The Bottom Line

Certimate delivers a self‑hosted, multi‑cloud ACME solution out of the box. Its strength lies in the sheer number of integrated providers and the visual UI that removes much of the manual drudgery. Teams that need to manage certificates across many platforms and have ops resources to maintain the many integrations will find it valuable. New contributors should expect a steep learning curve because of the extensive plugin ecosystem, but the codebase is well‑structured with clear entry points and no missing build artefacts.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

2,345 files

Go1647
TSX401
TypeScript84
JSON29
Markdown16
YAML14

ReactExpressDocker

Module dependencies

The 10 most depended-upon modules of 229, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_onents_access_forms__context["_context"] n1_flow_designer_forms__context["_context"] n2_i_src_repository__pocketbase["_pocketbase"] n3_ui_src_api__api["_api"] n4_ui_src_i18n_locales["locales"] n5_ui_src_i18n_resources_index["index"] n6_ts_icons_createIconComponent["createIconComponent"] n7_ui_src_i18n_resources_utils["utils"] n8__designer_nodes_TryCatchNode["TryCatchNode"] n9_ui_src_i18n_index["index"] n4_ui_src_i18n_locales --> n5_ui_src_i18n_resources_index n9_ui_src_i18n_index --> n4_ui_src_i18n_locales n9_ui_src_i18n_index --> n5_ui_src_i18n_resources_index

Dependencies

9 of 185 declared dependencies are a major version behind. Resolved 64 of 185 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^24.13.3	26.2.0	2 major
`react`	^18.3.1	19.2.8	1 major
`react-dom`	^18.3.1	19.2.8	1 major
`react-router`	^7.18.0	8.3.0	1 major
`@eslint/js`	^9.39.5	10.0.1	1 major
`@types/react`	^18.3.31	19.2.18	1 major
`@types/react-dom`	^18.3.7	19.2.4	1 major
`eslint`	^9.39.5	10.8.1	1 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium5

low1

Pin third-party GitHub Actions to a commit SHAhigh7 occurrences

.github/workflows

BRAINSia/free-disk-space@v2, docker/setup-qemu-action@v4, docker/setup-buildx-action@v4, docker/metadata-action@v6

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Remove continue-on-error from steps that gate correctnesshigh

.github/workflows/gh_pr_check.yml

line 140 on a correctness step

A failing test suite reports a green check, which is precisely the path this audit exists to close.

Fix: Delete continue-on-error, or move a genuinely advisory step into a separate non-required job.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/push_docker_image.yml

2 workflow(s) declare no permissions, 2 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium3 occurrences

Dockerfile

node:24-alpine, golang:1.25-alpine, alpine:latest (mutable tag)

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Add a non-root USER to the imagemedium

Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/gh_pr_check.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.