Open-source DigiCert alternatives

acme.sh is an ACME protocol client written entirely in Unix shell. It implements the full ACME protocol and uses a single script to issue, renew and install SSL/TLS certificates automatically. It is released under the GPL-3.0 license and works with Bash, dash and sh, with no dependency on Python.

It supports ECDSA certificates as well as SAN and wildcard certificates, and its topics reference certificate authorities such as Let's Encrypt, ZeroSSL and Buypass. The project is described as simple to learn, and it does not need root access.

Since 2021 acme.sh has been sponsored and maintained by ZeroSSL, and it now has a dedicated website. As certificate lifetimes shorten, automated renewal becomes more important, which is the problem the tool addresses. It suits system administrators and developers who want a minimal, scriptable alternative to Certbot for web servers, appliances and containers.

Certbot is a command-line tool from the Electronic Frontier Foundation for obtaining TLS certificates from Let's Encrypt and, optionally, switching on HTTPS for your web server. It is written in Python and is a common client for automated certificate issuance.

Beyond Let's Encrypt, Certbot can act as a client for any other certificate authority that supports the ACME protocol, which makes it usable in setups that rely on a different issuer. The repository's topics point to ACME client functionality, certificate management and Let's Encrypt integration. Check the project documentation for supported web servers, plugins and renewal options.

Lego is an ACME client and library written in Go, built to obtain and renew certificates from Let's Encrypt and other ACME certificate authorities. It can be used as a command-line tool or embedded in other Go software, which makes HTTPS certificates easy to automate.

It implements ACME v2 as defined in RFC 8555 and supports related standards, including the TLS-ALPN challenge extension, certificates for IP addresses, Renewal Information and several draft extensions. Its challenge support covers HTTP-01, DNS-01 and TLS-ALPN-01, and it ships with integrations for more than 200 DNS providers. It can register with a CA, obtain certificates from scratch or from an existing CSR, renew and revoke them, and handle SAN certificates and custom challenge solvers.

Lego is released under the MIT license. It is described as an independent, free project that relies on donations, and its documentation is hosted online. If a DNS provider is missing, users are encouraged to open an issue to request support.

step-ca, published as smallstep/certificates, is an online private certificate authority built for automated certificate management in DevOps environments. It is the server counterpart to the step command-line tool, and both are maintained by Smallstep Labs.

It can issue HTTPS server and client certificates trusted by browsers, as well as TLS certificates for virtual machines, containers, APIs, database connections and Kubernetes pods. It also issues SSH certificates: users can obtain them with single sign-on tokens, and hosts can obtain them using cloud instance identity documents. As an ACME server it supports the popular challenge types, and a Go wrapper and the step CLI help with scripting.

step-ca is written in Go and released under Apache-2.0. It is tuned for a two-tier PKI, and the README points teams that need multiple authorities, active revocation through CRL or OCSP, device attestation or a web admin UI to Smallstep's separate commercial product.