Let's Encrypt certs,
the Go way
package main
import (
"log"
"github.com/kintsdev/certy"
)
func main() {
// Create a new certificate manager
manager := certy.NewManager(
"[email protected]", // Your email for Let's Encrypt
"./certs", // Directory to store certificates
true, // Use staging environment first
)
// Issue a certificate for a domain
err := manager.IssueCert("example.com")
if err != nil {
log.Fatalf("Failed to issue certificate: %v", err)
}
}Certificate management
built for Go developers
Everything you need for automated Let's Encrypt certificate lifecycle — from issuing to renewal.
Automatic Let's Encrypt
Issue and renew SSL certificates automatically via Let's Encrypt. Production and staging environment support out of the box.
HTTP-01 Challenge
Built-in ACME challenge handler for domain verification. Just wrap your HTTP handler and Let's Encrypt validates automatically.
Custom Certificates
Add your own PEM certificates alongside Let's Encrypt ones. Use AddCustomCert() with cert and key data.
Thread-Safe Operations
Concurrent certificate issuance with proper mutex locking. Safe to use across multiple goroutines without data races.
Automatic Renewal
Certificates are renewed 30 days before expiry automatically. ECDSA P-256 keys, RSA 4096-bit account keys, 88-day cert lifetime.
Staging Environment
Test with Let's Encrypt staging servers first. 300 new orders per 3 hours — switch to production when you're ready.
Three steps to
production TLS
Install the Library
Run go get github.com/kintsdev/certy to add Certy to your Go project.
Create Manager & Issue
Call NewManager(email, path, staging) then IssueCert(domain).
Serve with Auto-TLS
Use GetCert in your TLS config and wrap with HTTPHandler for challenges.
HTTP server with
automatic certificates
Drop Certy into any Go HTTP server. Use GetCert for automatic certificate selection and HTTPHandler for ACME challenge handling.
- TLS config with
GetCertificatecallback - ACME challenge handler wraps your existing routes
- Custom certs via
AddCustomCert(domain, cert, key) - Certs stored in organized directory structure
manager := certy.NewManager(
"[email protected]", "./certs", false,
)
server := &http.Server{
Addr: ":8443",
TLSConfig: &tls.Config{
GetCertificate: manager.GetCert,
},
Handler: http.HandlerFunc(
func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintf(w, "Hello from %s!", r.Host)
},
),
}
// Wrap with ACME challenge handler
server.Handler = manager.HTTPHandler(server.Handler)
log.Fatal(server.ListenAndServeTLS("", ""))TLS for every Go
service you ship
From single-server microservices to multi-domain platforms, Certy handles the certificate lifecycle so you don't have to.
Go Microservices
Embed Certy in each service to handle its own TLS certificate. No sidecar, no external agent — just your binary and a Let's Encrypt endpoint.
Internal & Self-Hosted Tools
Deploy internal dashboards or admin panels with valid TLS on a custom domain, renewed automatically — no manual certbot cron jobs needed.
Multi-Tenant SaaS Platforms
Issue and renew certificates for customer-provided custom domains at scale. Programmatically manage hundreds of certs through the Go API.
Regulated & Compliance Environments
Never let a TLS certificate expire in a compliance-sensitive environment again. Certy tracks expiry and renews with configurable lead time.
CI/CD & Ephemeral Environments
Provision valid TLS for short-lived preview environments in your deployment pipeline, then let Certy clean up automatically on teardown.
Edge & IoT Deployments
A tiny, zero-dependency binary is ideal for edge nodes and IoT gateways that need TLS but can't run heavy certificate management agents.
0
External Dependencies
Auto
Certificate Renewal
ACME
HTTP-01 Challenge
Ready to automate
your certificates?
Automatic Let's Encrypt certificates with HTTP-01 challenges, auto-renewal, and thread-safe design. Open source, production ready.
Frequently asked questions
What is Certy?
Certy is a Go library that automates Let's Encrypt SSL/TLS certificate management. It handles certificate issuance, storage, and renewal so your services stay secure without manual intervention.
How do I add Certy to my Go project?
Install with go get github.com/kintsdev/certy, then call certy.New() with your domain and email. Certy handles the ACME HTTP-01 challenge and renews certificates before expiry automatically.
Does Certy support automatic certificate renewal?
Yes. Certy monitors certificate expiry and renews before the deadline, ensuring your services are never caught with an expired certificate.
What ACME challenge types does Certy support?
Certy currently supports the HTTP-01 challenge, which works with any standard web server configuration and does not require DNS access.
Can I use Certy alongside custom or internal certificates?
Yes. Certy supports custom certificate injection alongside Let's Encrypt certificates, letting you manage internal PKI and public-facing certs from one place.