SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 tls-certificate Open-Source Projects
-
Project mention: Installing a Let's Encrypt TLS Certificate on a Brother Printer with Certbot | news.ycombinator.com | 2026-03-27
* https://github.com/acmesh-official/acme.sh/wiki/How-to-use-A...
BIND 9 example:
* https://dan.langille.org/2020/12/19/creating-a-very-specific...
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
Project mention: LetsEncrypt – Expiration Notification Service Has Ended | news.ycombinator.com | 2025-06-30
It's unfortunate to see this go away, but understandable given the costs involved. If you use a web server like Caddy, you can automate certificate renewal (https://caddyserver.com/docs/automatic-https). If notifications are important, they also provide an event subscription system (https://github.com/caddyserver/certmagic#events) so you can subscribe to cert-related events, run custom code, trigger event handlers, etc.
-
acme-dns
Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.
Project mention: Installing a Let's Encrypt TLS Certificate on a Brother Printer with Certbot | news.ycombinator.com | 2026-03-27> That looks like a viable solution since it requires a one-time setup on the main domain and ongoing access to the second (validation) domain.
At my last job we deployed a special sub-domain for that purpose: dnsauth.example.com
We deployed a single (no-HA) externally exposed BIND server with a bunch of scripts that folks could connect to (we had deploy script to users/developrs). Nowadays there even purpose-build DNS servers for this purpose:
* https://github.com/acme-dns/acme-dns
-
-
-
-
-
Actually, the story in this case is a bit more complicated than I initially thought: https://github.com/mozilla/crlite/issues/367.
-
stecCA
An easy to deploy Certificate Authority / Public Key Infrastructure using CFSSL, Lemur and Docker magic!
-
-
-
cryptonice
CryptoNice is both a command line tool and library which provides the ability to scan and report on the configuration of SSL/TLS for your internet or internal facing web services. Built using the sslyze API and ssl, http-client and dns libraries, cryptonice collects data on a given domain and performs a series of tests to check TLS configuration and supporting protocols such as HTTP2 and DNS.
-
njs-acme
Nginx NJS module runtime to work with ACME providers like Let's Encrypt for automated no-reload TLS certificate issue/renewal.
-
eks-alb-istio-with-tls
This repository demonstrate how to configure end-to-end encryption on EKS platform using TLS certificate from Amazon Certificate Manager, AWS Application LoadBalancer and Istio as service mesh.
-
tls-ca-manage
Multi-level Certificate Authority Management tool, front-end tool to OpenSSL, written in bash shell.
-
WNetWrap
WinINet wrapper - tiny windows HTTPS library, no dependencies. 封装了WinInet的强大http请求库 make POST and GET requests
-
-
tako
Build, run, and manage app instances anywhere, without thinking about the boring stuff (by lilienblum)
That is the direction I have been exploring with Tako, which is a small deployment tool for running apps on your own servers.
-
go-lang-https-self-signed
Sample of a self signed certificate https server in golang. This repo demonstrates to you the best way to up your self signed cert in golang. It shows in a simple way how to generate and trust the ssl certificate and how to serve a https server in golang.
-
sslx
A fast, modern alternative to OpenSSL's CLI - inspect, grade, and manage certificates from the terminal
I've been building a cert tool called sslx and one of the commands that turned out to be the most useful is expiry. It checks multiple hosts in one go:
-
-
dcert
A Rust CLI and MCP server for X.509 certificate analysis, format conversion, and key verification. Reads certificates from PEM files or HTTPS endpoints. Validates TLS connections, checks revocation status, converts between PFX and PEM formats and integrates with AI-powered IDEs via the Model Context Protocol (MCP) and Vault.
Project mention: Show HN: Dcert – a CLI to debug TLS handshakes, certs and latency in one place | news.ycombinator.com | 2026-01-18 -
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
tls-certificate discussion
tls-certificate related posts
-
Installing a Let's Encrypt TLS Certificate on a Brother Printer with Certbot
-
Not all browsers perform revocation checking
-
CRLite: Certificate Revocation Checking in Firefox
-
Lets Encrypt Ending TLS Client Authentication Certificate Support in 2026
-
Setting up ssl on AGH
-
Sanic v22.6 Released - Includes HTTP/3
-
Hands-free SSL certificate generation from a CA
-
A note from our sponsor - SaaSHub
www.saashub.com | 14 Jun 2026
Index
What are some of the best open-source tls-certificate projects? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | acme.sh | 46,879 |
| 2 | certmagic | 5,565 |
| 3 | acme-dns | 2,766 |
| 4 | trustme | 602 |
| 5 | uacme | 506 |
| 6 | acme-dns-certbot-joohoi | 258 |
| 7 | certinfo | 242 |
| 8 | crlite | 153 |
| 9 | stecCA | 152 |
| 10 | kitsec-core | 149 |
| 11 | win-ca | 119 |
| 12 | cryptonice | 101 |
| 13 | njs-acme | 92 |
| 14 | eks-alb-istio-with-tls | 64 |
| 15 | tls-ca-manage | 43 |
| 16 | WNetWrap | 40 |
| 17 | sslmgr | 32 |
| 18 | tako | 31 |
| 19 | go-lang-https-self-signed | 16 |
| 20 | sslx | 7 |
| 21 | pkisauce | 6 |
| 22 | dcert | 2 |
| 23 | know-tls-cert | 1 |
Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com