Instead of acme.sh
acme.sh alternatives
acme.sh is a free Unix shell ACME client for automating SSL/TLS certificates across Linux, macOS, Windows through Cygwin, and self-hosted systems. It can issue, renew, install, and revoke certificates, with daily renewal checks, ECDSA, RSA, SAN, and wildcard support, and validation through web, standalone, Apache, Nginx, DNS, and other modes. It supports ZeroSSL, Let’s Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and other RFC8555-compliant authorities. Its shell implementation needs no Python dependency and generally no root or sudo access.
- 1
Certify The Web
Free plan APILinuxMac+3Teams needing centralized certificate deployment and monitoring — Certify The Web adds web management, role-based access, monitoring, and deployment tasks for many server and cloud targets.
- 2
GeoTrust
Paid APILinuxWeb+1Businesses wanting certificates plus security scanning — GeoTrust combines SSL certificates and automation with daily certificate monitoring and vulnerability scans, unlike acme.sh’s ACME client focus.
- 3
Certbot
Free plan LinuxMacSelf-hosted+1Command-line administrators using Let’s Encrypt — Certbot focuses on Let’s Encrypt certificates, with Apache and Nginx integrations and renewal rules based on remaining certificate lifetime.
- 4
EJBCA
Free plan Open source APILinuxMac+3Organizations running multi-PKI certificate authorities — EJBCA provides full open-source PKI with CA, RA, and VA modules, enrollment APIs, validation services, and HSM integrations.
- 5
lego
Free plan APILinuxMac+1Developers wanting a Go ACME library — lego is an independent Go ACME client and library with CLI and library use, four challenge methods, and over 200 DNS providers.
- 6
Let's Encrypt
Free plan Open source APILinuxMac+3Users seeking a free certificate authority — Let’s Encrypt is the certificate authority itself, issuing 90-day DV certificates and wildcard certificates through DNS-01 rather than acting as a client.
- 7
OpenXPKI
Free plan APILinuxSelf-hosted+1Enterprises managing customizable X.509 PKI workflows — OpenXPKI offers multi-realm enterprise PKI with customizable workflows, web administration, enrollment interfaces, connectors, and PKCS#11 HSM support.
- 8
AWS Certificate Manager
Free plan APIWeb - 9
cert-manager
Free plan APILinuxSelf-hosted - 10
Dogtag Certificate System
Free plan APILinuxSelf-hosted - 11
ManageEngine Key Manager Plus
Free plan APILinuxSelf-hosted+2 - 12
Google Cloud Certificate Manager
Free plan APIWeb - 13
win-acme
Free plan Windows - 14
KeyTalk CKMS
Free trial AndroidAPIiPhone+5 - 15
Keyfactor Platform
Free trial APISelf-hostedWeb - 16
Oracle Cloud Infrastructure Certificates
Free plan Web - 17
DigiCert ONE
Paid APILinuxMac+3 - 18
DigiCert Trust Lifecycle Manager
Paid APILinuxWeb+15.9 Visit site - 19
Entrust Certificate Manager
Paid AndroidAPIiPhone+3 - 20
Qualys Certificate Inventory
Free plan Web - 21
Garnet Certificate Lifecycle Management
Paid APILinuxWindows - 22
Sectigo Certificate Manager
Free trial APIWeb - 23
Certynx
Paid APISelf-hostedWeb - 24
GlobalSign Atlas
Paid APIWeb
Readers may still seek alternatives when they want a graphical control plane, broader certificate-management workflows, paid support, vulnerability scanning, or a different implementation language. acme.sh’s manual DNS mode also needs a new TXT record for every renewal, so it cannot renew automatically in that case. When switching, weigh whether you need centralized monitoring, enterprise PKI functions, integrations with specific servers or cloud services, multiple certificate authorities, or a Go library instead of a shell client. Also compare each option’s operating systems, certificate scope, automation model, and price against acme.sh’s free plan.
← Back to acme.sh The whole certificate management software list