AcmefyerAgent-based Certificate ManagerCertificates that renew themselves.
Acmefyer is an SSL certificate manager for your own network: it obtains SSL/TLS certificates from Let’s Encrypt, ZeroSSL, BuyPass or Google Trust Services, renews them in time and rolls them out wherever they are needed. Installation happens from the inside: an agent on the target system picks up the certificate itself, without PowerShell remoting and without inbound ports.
One certificate, many services: Acmefyer renews it and the agents install it everywhere.
Certificate lifetimes are shrinking.
The browser vendors Apple, Google, Microsoft and Mozilla and the certificate authorities decided in the CA/Browser Forum to shorten the lifetime of public TLS certificates step by step: from 398 days to 47 days by 2029. Domain validation can then be reused for only 10 days.
At 47 days, every certificate is replaced roughly once a month, on every web server, every mail system and every firewall. That can no longer be done by hand. Acmefyer renews automatically and installs the new certificate via the agent, with no one having to step in.
Source: CA/Browser Forum, Ballot SC-081v3, approved on 11 April 2025.
Every ACME challenge
HTTP-01 with a built-in challenge server, DNS-01 for around 190 DNS providers, including wildcard certificates (*.example.com), and TLS-ALPN-01.
Automatic renewal
Scheduling with backoff, a lock per certificate and idempotency. Nothing runs twice, nothing expires.
Rollout via agent
The agent on the target system picks up the certificate itself and installs it locally, without inbound ports.
Secure by default
AES-256-GCM for secrets, Argon2id passwords, AD/LDAP sign-in with roles, optional TOTP and an audit log.
Notifications
Email, Teams, Telegram, PRTG or webhook. With templates, rate limiting and deduplication.
Two interfaces, one core
Web interface in the browser, in German and English, light and dark. Plus a terminal interface right on the server.
At a glance: how many certificates are valid, which expire soon, where an error is pending and which agents are online.
Domains in projects, with status, deployments, challenge and expiry. What expires soon or is stuck is marked in red.
One domain and its targets: through the agents the certificate goes to IIS, Exchange, FortiGate and NGINX, each with the result of its last run.
Choosing a new target: from a PEM folder via IIS and Exchange to NGINX, Traefik, Tomcat and appliances, run on the agent or the server.
The agents with status and last contact. New agents join through a setup package per platform that installs itself as a service.
The agent finds on its own what speaks TLS on its server, with names, ports and the certificate currently in place.
All certificates in the network, from the agents' scans and a network scan: what Acmefyer does not manage yet is at the top.
Everything configurable in the browser: updates, license, HTTPS, sign-in with AD/LDAP and two-factor, agents and proxy.
No holes in the firewall, no PowerShell remoting.
Many tools and scripts push certificates from the outside: via PowerShell remoting, file shares or remote logins. That requires open ports on every target system and administrator credentials stored in one central place.
The Acmefyer agent runs directly on the target system. It opens an encrypted connection to the Acmefyer server itself, picks up the certificate and installs it locally.
This is how certificates get into IIS and other HTTP.sys applications, Exchange, MailStore Server, PRTG, ScriptRunner, the Windows certificate store, NGINX, Apache, Traefik, HAProxy, Tomcat, Gitea, any service that reads PEM files, or custom scripts. In addition, Acmefyer exports PEM and PFX files to the file system or a Windows share, transfers them via SSH, calls webhooks and installs certificates on firewall appliances via REST API, e.g. FortiGate.
For each target you choose who performs the rollout: the server itself or an agent. The server only offers the safe actions, namely export, SSH and webhook. Firewall appliances such as a FortiGate are always served by an agent, for example one in the DMZ right next to the firewall.
- Connection
- Outbound only, from the agent to the server, via HTTPS with mutual certificate verification (mTLS). No inbound port is needed on the target systems.
- Firewall
- One rule: agent to the server on port 443 when the web UI has HTTPS with a publicly trusted certificate, otherwise to the agent port (default 8444). No WinRM, no file share, no RDP.
- Credentials
- The server stores no administrator passwords for the target systems. The agent works with the rights of its local service.
- Installed locally
- IIS bindings, HTTP.sys bindings, Exchange, MailStore Server, PRTG Network Monitor, ScriptRunner, Gitea, Windows certificate store, NGINX, Apache, Traefik (also in a container), HAProxy, Tomcat keystores (PKCS#12/JKS), services such as Postfix or PostgreSQL, custom scripts and the web interface of Spherifyer (connects itself, no agent)
- Internal networks
- Target systems need no internet access. Only the Acmefyer server talks to the certificate authority.
- Detection
- The agent finds the applications serving TLS on its system, such as NGINX and Apache sites, Traefik also in Docker containers, HAProxy, IIS, Exchange, MailStore Server, PRTG, ScriptRunner, Gitea in a container, mail and database servers or Proxmox, with certificate file and expiry. On Windows also Tomcat, Apache and NGINX bundled by vendors, and every other port that speaks TLS, with the program behind it. Where one fits a certificate, the deployment is one click away; if certbot, acme.sh or a container renews the certificate already, the scan says so. An overview lists every certificate found and which of them Acmefyer does not manage yet; the server can also scan your own network for them read-only, with no agent at all.
- Setup
- The server generates a setup package per platform (Windows and Linux, x64, ARM64 and 32-bit) with the configuration built in. Or it installs the agent once itself: on Linux via SSH, on Windows via PowerShell remoting, detecting the target's processor. Likewise an agent can be uninstalled from the server without leftovers: service, program, configuration and identity. For PDQ Deploy and other software distribution the package installs itself with the parameter setup and removes itself with uninstall, without prompts and with an exit code.
The server obtains the certificate over the internet. The agents on the target systems open a connection to the server themselves and install it locally. Nothing is opened from the outside.
For firewall appliances such as a FortiGate, an agent in the DMZ performs the rollout. Only its outbound connection to the server passes through the firewall; the server itself needs no path into the DMZ.
A script server accesses every target from the outside: each target system must keep several ports open for its connections. With Acmefyer there is exactly one inbound connection, from the agents to the Acmefyer server on port 443 (with HTTPS; without HTTPS on the agent port 8444). The target systems need no open port.
- 01
Add a domain
Define the certificate authority, challenge and target systems once.
- 02
Issue
Acmefyer answers the challenge and obtains the certificate.
- 03
Roll out
The agents install the certificate on the target systems.
- 04
Renew
In the renewal window everything repeats automatically, with notification.
- Platforms
- Windows and Linux, as an executable and as a .deb and .rpm package
- Programs
acmefyer-serverfor the service, web and terminal interface ·acmefyer-agentfor the target systems- Data storage
- Embedded database, secrets encrypted with AES-256-GCM
- Sign-in
- Local admin with initial password, AD/LDAP with roles by group or OU, optional TOTP
- Default address
127.0.0.1:443, freely configurable- Network
- Server: outbound to the certificate authority (and, for DNS-01, to the DNS provider), and to www.wedigo.net for license activation, also through a proxy (taken over from the Windows settings or set in the web interface and the console). Agents: outbound to the server only.
- Updates
- Automatic self-update from signed releases, optionally within a maintenance window. If a new version does not start cleanly, the service returns to the previous version on its own. Can be switched off or set to notify only.
Between an ACME client and an enterprise platform.
There are roughly four ways to manage SSL certificates: an ACME client on every server, custom scripts with remote access, a certificate lifecycle management platform, or monitoring that warns before expiry.
Acmefyer combines the central certificate management of a platform with the simple operation of an ACME client: one server for all certificates, agents on the target systems, bought once.
- ACME client per server
- For example Certbot, win-acme, Certify The Web or Posh-ACME. They renew certificates on the server they are installed on. Acmefyer manages all certificates in one place and rolls them out via agent to many systems, with shared notifications and an audit log.
- Custom scripts
- PowerShell via WinRM or file shares, Certbot hooks via SSH. That requires open ports on the target systems and administrator passwords on the script server. With Acmefyer the agents connect outbound only, see Rollout.
- Certificate lifecycle management platforms
- For example Venafi (CyberArk), Keyfactor, AppViewX or Sectigo Certificate Manager, with features for private PKI, many certificate authorities and company-wide policies. Acmefyer focuses on certificates via ACME, runs as a single program on Windows and Linux and is bought once.
- Expiry monitoring
- For example certificate checks in PRTG, Zabbix or Nagios. They warn before expiry, but a person still has to replace the certificate. Acmefyer renews and replaces the certificate itself and reports the result, also to PRTG if you like.
Acmefyer 1.x
- Unlimited certificates, domains and agents
- All updates of the 1.x version family
- License key by email right away, activated online
- 14-day money-back guarantee
- Try it free without a key: 1 domain with 1 subdomain (or wildcard) and 1 agent, all features