Choosing an SSL certificate automation tool: acme.sh, Certimate, AWS ACM or a hosted service
Every certificate automation tool issues certificates over ACME, and that part works much the same everywhere. This article compares acme.sh, Certimate and hosted services such as AWS ACM on three points: Automatic renewal. Let's Encrypt certificates expire after 90 days, and since March 2026 commercial certificates are capped at 200 days, so renewing by hand will eventually slip. All the tools…
Choosing an SSL certificate automation tool: acme.sh, Certimate, AWS ACM or a hosted service is a decision that involves weighing several factors. All certificate automation tools issue SSL certificates over ACME protocol, but the way they handle automatic renewal, deployment of renewed certificates and failure alerts varies.
Automatic renewal is a critical feature as Let's Encrypt certificates expire after 90 days and commercial certificates are capped at 200 days. All reviewed tools renew certificates automatically, but cloud provider's own certificate services have certain limits.
The deployment of renewed certificates and the ability to target multiple servers, CDNs, object storage or load balancers depend on the tool's built-in integrations or self-scripting. acme.sh can deploy certificates to few CDNs and servers, but requires manual scripting for other services like AWS ACM and Alibaba Cloud DCDN. Certimate offers a more extensive list of cloud services it can deploy to, including AWS, Kubernetes, CDNs, WAFs and load balancers.
However, it requires self-hosting, which means managing a server and storing cloud access keys, potentially putting it beyond some company policies.
Hosted services like LapseZero run issuance, renewal, deployment and alerts on the provider's side. They offer deployments to multiple cloud services and servers, including AWS, Alibaba Cloud CDN, load balancers and more. Failures are reported via email, Slack, Telegram or webhook. However, handing over cloud access keys to a third-party service can be a significant hurdle for some organizations, making self-hosting and Certimate a better fit.
In conclusion, the best tool depends on the specific needs of your infrastructure. acme.sh is suitable for simpler deployments involving a few servers and domains. Certimate offers a self-hosted dashboard for more complex environments, while hosted services like LapseZero might be the best choice if you want to offload server management and want a broader integration with cloud services, despite the potential concerns regarding cloud access key management.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
