CertMate is an SSL certificate management system with a web UI and REST API. It automates issuing and renewing Let's Encrypt certificates via DNS-01 challenges across 20+ DNS providers, with unified backups and multi-account support.

Configuration

version: "3.8"

services:
  certmate:
    image: fabriziosalmi/certmate:2.21.3
    environment:
      - FLASK_ENV=production
      - SECRET_KEY=${SECRET_KEY} # 🔐 Flask session secret
      - API_BEARER_TOKEN=${API_BEARER_TOKEN} # 🔐 API / web UI token
      - BEHIND_PROXY=${BEHIND_PROXY}
      - CLOUDFLARE_TOKEN=${CLOUDFLARE_TOKEN}
      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
      - LOG_LEVEL=${LOG_LEVEL}
    ports:
      - 8000
    volumes:
      - certmate_certificates:/app/certificates
      - certmate_data:/app/data
      - certmate_logs:/app/logs
      - certmate_backups:/app/backups
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

volumes:
  certmate_certificates:
  certmate_data:
  certmate_logs:
  certmate_backups:

[variables]
main_domain = "${domain}"
SECRET_KEY = "${password:32}"
API_BEARER_TOKEN = "${password:32}"

[config]
mounts = []

[[config.domains]]
serviceName = "certmate"
port = 8000
host = "${main_domain}"

[config.env]
SECRET_KEY = "${SECRET_KEY}" # 🔐 Flask session secret
API_BEARER_TOKEN = "${API_BEARER_TOKEN}" # 🔐 API / web UI token
BEHIND_PROXY = "true"
CLOUDFLARE_TOKEN = ""
LETSENCRYPT_EMAIL = ""
LOG_LEVEL = "INFO"

Base64

To import this template in Dokploy: create a Compose service → Advanced → Base64 import and paste the content below:

ewogICJjb21wb3NlIjogInZlcnNpb246IFwiMy44XCJcblxuc2VydmljZXM6XG4gIGNlcnRtYXRlOlxuICAgIGltYWdlOiBmYWJyaXppb3NhbG1pL2NlcnRtYXRlOjIuMjEuM1xuICAgIGVudmlyb25tZW50OlxuICAgICAgLSBGTEFTS19FTlY9cHJvZHVjdGlvblxuICAgICAgLSBTRUNSRVRfS0VZPSR7U0VDUkVUX0tFWX0gIyDwn5SQIEZsYXNrIHNlc3Npb24gc2VjcmV0XG4gICAgICAtIEFQSV9CRUFSRVJfVE9LRU49JHtBUElfQkVBUkVSX1RPS0VOfSAjIPCflJAgQVBJIC8gd2ViIFVJIHRva2VuXG4gICAgICAtIEJFSElORF9QUk9YWT0ke0JFSElORF9QUk9YWX1cbiAgICAgIC0gQ0xPVURGTEFSRV9UT0tFTj0ke0NMT1VERkxBUkVfVE9LRU59XG4gICAgICAtIExFVFNFTkNSWVBUX0VNQUlMPSR7TEVUU0VOQ1JZUFRfRU1BSUx9XG4gICAgICAtIExPR19MRVZFTD0ke0xPR19MRVZFTH1cbiAgICBwb3J0czpcbiAgICAgIC0gODAwMFxuICAgIHZvbHVtZXM6XG4gICAgICAtIGNlcnRtYXRlX2NlcnRpZmljYXRlczovYXBwL2NlcnRpZmljYXRlc1xuICAgICAgLSBjZXJ0bWF0ZV9kYXRhOi9hcHAvZGF0YVxuICAgICAgLSBjZXJ0bWF0ZV9sb2dzOi9hcHAvbG9nc1xuICAgICAgLSBjZXJ0bWF0ZV9iYWNrdXBzOi9hcHAvYmFja3Vwc1xuICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkXG4gICAgaGVhbHRoY2hlY2s6XG4gICAgICB0ZXN0OiBbXCJDTURcIiwgXCJjdXJsXCIsIFwiLWZcIiwgXCJodHRwOi8vbG9jYWxob3N0OjgwMDAvaGVhbHRoXCJdXG4gICAgICBpbnRlcnZhbDogMzBzXG4gICAgICB0aW1lb3V0OiAxMHNcbiAgICAgIHJldHJpZXM6IDNcbiAgICAgIHN0YXJ0X3BlcmlvZDogNDBzXG5cbnZvbHVtZXM6XG4gIGNlcnRtYXRlX2NlcnRpZmljYXRlczpcbiAgY2VydG1hdGVfZGF0YTpcbiAgY2VydG1hdGVfbG9nczpcbiAgY2VydG1hdGVfYmFja3VwczpcbiIsCiAgImNvbmZpZyI6ICJbdmFyaWFibGVzXVxubWFpbl9kb21haW4gPSBcIiR7ZG9tYWlufVwiXG5TRUNSRVRfS0VZID0gXCIke3Bhc3N3b3JkOjMyfVwiXG5BUElfQkVBUkVSX1RPS0VOID0gXCIke3Bhc3N3b3JkOjMyfVwiXG5cbltjb25maWddXG5tb3VudHMgPSBbXVxuXG5bW2NvbmZpZy5kb21haW5zXV1cbnNlcnZpY2VOYW1lID0gXCJjZXJ0bWF0ZVwiXG5wb3J0ID0gODAwMFxuaG9zdCA9IFwiJHttYWluX2RvbWFpbn1cIlxuXG5bY29uZmlnLmVudl1cblNFQ1JFVF9LRVkgPSBcIiR7U0VDUkVUX0tFWX1cIiAjIPCflJAgRmxhc2sgc2Vzc2lvbiBzZWNyZXRcbkFQSV9CRUFSRVJfVE9LRU4gPSBcIiR7QVBJX0JFQVJFUl9UT0tFTn1cIiAjIPCflJAgQVBJIC8gd2ViIFVJIHRva2VuXG5CRUhJTkRfUFJPWFkgPSBcInRydWVcIlxuQ0xPVURGTEFSRV9UT0tFTiA9IFwiXCJcbkxFVFNFTkNSWVBUX0VNQUlMID0gXCJcIlxuTE9HX0xFVkVMID0gXCJJTkZPXCJcbiIKfQ==

Instructions

CertMate

Getting started

Deploy the template and open the app domain.
Log in with the API bearer token: it is auto-generated by the template and stored in the API_BEARER_TOKEN environment variable (Dokploy → your service → Environment). The same token authenticates REST API requests (Authorization: Bearer <token>).
In Settings, set your Let's Encrypt email and add credentials for your DNS provider (Cloudflare, Route53, etc.) to issue certificates through DNS-01 challenges.

Notes

CLOUDFLARE_TOKEN can optionally be set as an environment variable instead of configuring it in the UI.
Certificates, application data and backups are persisted in the certmate_certificates, certmate_data and certmate_backups volumes.
API documentation is available at /docs/ (Swagger) and /redoc/ on your domain.

CertMate

Configuration

Base64

Instructions

CertMate

Getting started

Notes

Links

Tags

On this page