certmagic provides API for TLS Automation with full control over almost every aspect of the system.

Main features:

• Fully automated certificate management including issuance and renewal, with support for certificate revocation. Also works in conjunction with your own certificates.

• Wildcard certificates.

• One-line, fully managed HTTPS servers, with HTTP->HTTPS redirects.

• Multiple issuers supported: get certificates from multiple sources/CAs for redundancy and resiliency.

• Solves all 3 common ACME challenges: HTTP, TLS-ALPN, and DNS (and capable of others.)

• Robust error handling:

  • Challenges are randomized to avoid accidental dependence and rotated to overcome certain network blockages.

  • Robust retries for up to 30 days.

  • Exponential backoff with carefully-tuned intervals.

  • Retries with optional test/staging CA endpoint instead of production, to avoid rate limits.

• All libdns DNS providers work out-of-the-box.

• Pluggable storage backends (default: file system) and key sources.

• Automatic OCSP stapling.

• Distributed solving of all challenges (works behind load balancers.)

• Supports on-demand issuance of certificates.

• Optional event hooks for observation.

• One-time private keys by default (new key for each cert) to discourage pinning and reduce scope of key compromise.

• Works with any certificate authority (CA) compliant with the ACME specification RFC 8555.

• Must-Staple (optional; not default.)

• Full support for draft-ietf-acme-ari (ACME Renewal Information; ARI) extension.