AcmefyerAgent-based Certificate ManagerCertificates that renew themselves.
Acmefyer is an SSL certificate manager for your own network: it obtains SSL/TLS certificates from Let’s Encrypt, ZeroSSL, BuyPass or Google Trust Services, renews them in time and rolls them out wherever they are needed. Installation happens from the inside: an agent on the target system picks up the certificate itself, without PowerShell remoting and without inbound ports.
From renewal window to IIS binding: one run, fully logged.
Certificate lifetimes are shrinking.
The browser vendors Apple, Google, Microsoft and Mozilla and the certificate authorities decided in the CA/Browser Forum to shorten the lifetime of public TLS certificates step by step: from 398 days to 47 days by 2029. Domain validation can then be reused for only 10 days.
At 47 days, every certificate is replaced roughly once a month, on every web server, every mail system and every firewall. That can no longer be done by hand. Acmefyer renews automatically and installs the new certificate via the agent, with no one having to step in.
Source: CA/Browser Forum, Ballot SC-081v3, approved on 11 April 2025.
Every ACME challenge
HTTP-01 with a built-in challenge server, DNS-01 for around 190 DNS providers, including wildcard certificates (*.example.com), and TLS-ALPN-01.
Automatic renewal
Scheduling with backoff, a lock per certificate and idempotency. Nothing runs twice, nothing expires.
Rollout via agent
The agent on the target system picks up the certificate itself and installs it locally, without inbound ports.
Secure by default
AES-256-GCM for secrets, Argon2id passwords, AD/LDAP sign-in with roles, optional TOTP and an audit log.
Notifications
Email, Teams, Telegram, PRTG or webhook. With templates, rate limiting and deduplication.
Two interfaces, one core
Web interface in the browser, in German and English, light and dark. Plus a terminal interface right on the server.
No holes in the firewall, no PowerShell remoting.
Many tools and scripts push certificates from the outside: via PowerShell remoting, file shares or remote logins. That requires open ports on every target system and administrator credentials stored in one central place.
The Acmefyer agent runs directly on the target system. It opens an encrypted connection to the Acmefyer server itself, picks up the certificate and installs it locally.
This is how certificates get into IIS, Exchange, the Windows certificate store, NGINX, Apache or custom scripts. In addition, Acmefyer exports PEM and PFX files to the file system or a Windows share, transfers them via SSH, calls webhooks and installs certificates on firewall appliances via REST API, e.g. FortiGate.
For each target you choose who performs the rollout: the server itself or an agent. The server only offers the safe actions, namely export, SSH and webhook. Firewall appliances such as a FortiGate are always served by an agent, for example one in the DMZ right next to the firewall.
- Connection
- Outbound only, from the agent to the server, via HTTPS with mutual certificate verification (mTLS). No inbound port is needed on the target systems.
- Firewall
- One rule: agent to the server port (default 8443). No WinRM, no file share, no RDP.
- Credentials
- The server stores no administrator passwords for the target systems. The agent works with the rights of its local service.
- Installed locally
- IIS bindings, Exchange, Windows certificate store, NGINX, Apache and custom scripts
- Internal networks
- Target systems need no internet access. Only the Acmefyer server talks to the certificate authority.
The server obtains the certificate over the internet. The agents on the target systems open a connection to the server themselves and install it locally. Nothing is opened from the outside.
For firewall appliances such as a FortiGate, an agent in the DMZ performs the rollout. Only its outbound connection to the server passes through the firewall; the server itself needs no path into the DMZ.
A script server accesses every target from the outside: each target system must keep several ports open for its connections. With Acmefyer there is exactly one inbound connection, from the agents to the Acmefyer server on port 8443. The target systems need no open port.
- 01
Add a domain
Define the certificate authority, challenge and target systems once.
- 02
Issue
Acmefyer answers the challenge and obtains the certificate.
- 03
Roll out
The agents install the certificate on the target systems.
- 04
Renew
In the renewal window everything repeats automatically, with notification.
- Platforms
- Windows and Linux, as an executable and as a .deb and .rpm package
- Programs
acmefyer-serverfor the service, web and terminal interface ·acmefyer-agentfor the target systems- Data storage
- Embedded database, secrets encrypted with AES-256-GCM
- Sign-in
- Local admin with initial password, AD/LDAP with roles, optional TOTP
- Default address
127.0.0.1:8443, freely configurable- Network
- Server: outbound to the certificate authority (and, for DNS-01, to the DNS provider), and to www.wedigo.net for license activation, also through a proxy (taken over from the Windows settings or set in the console). Agents: outbound to the server only.
- Updates
- Automatic self-update from signed releases, optionally within a maintenance window. If a new version does not start cleanly, the service returns to the previous version on its own. Can be switched off or set to notify only.
Between an ACME client and an enterprise platform.
There are roughly four ways to manage SSL certificates: an ACME client on every server, custom scripts with remote access, a certificate lifecycle management platform, or monitoring that warns before expiry.
Acmefyer combines the central certificate management of a platform with the simple operation of an ACME client: one server for all certificates, agents on the target systems, bought once.
- ACME client per server
- For example Certbot, win-acme, Certify The Web or Posh-ACME. They renew certificates on the server they are installed on. Acmefyer manages all certificates in one place and rolls them out via agent to many systems, with shared notifications and an audit log.
- Custom scripts
- PowerShell via WinRM or file shares, Certbot hooks via SSH. That requires open ports on the target systems and administrator passwords on the script server. With Acmefyer the agents connect outbound only, see Rollout.
- Certificate lifecycle management platforms
- For example Venafi (CyberArk), Keyfactor, AppViewX or Sectigo Certificate Manager, with features for private PKI, many certificate authorities and company-wide policies. Acmefyer focuses on certificates via ACME, runs as a single program on Windows and Linux and is bought once.
- Expiry monitoring
- For example certificate checks in PRTG, Zabbix or Nagios. They warn before expiry, but a person still has to replace the certificate. Acmefyer renews and replaces the certificate itself and reports the result, also to PRTG if you like.
Acmefyer 1.x
- Unlimited certificates, domains and agents
- All updates of the 1.x version family
- License key by email right away, activated online
- 14-day money-back guarantee
- Try it free without a key: 1 domain with 1 subdomain (or wildcard) and 1 agent, all features