CertHub
MIT Open Source · Self-hosted

Issuing is only half.
Ship certificates all the way live. 证书签下来，
只完成了一半

CertHub keeps issue, renew, deploy and verification on one self-hosted ledger. SSH targets ship automatically; console-only targets get a ready-to-upload ZIP. CertHub 把申请、续期、部署、验收放进一本自托管台账：能 SSH 的自动推，只能控制台上传的自动打包。

Use free on GitHub →在 GitHub 免费使用 → Install guide查看安装手册

Your private keys stay on your machines · Docker Compose私钥留在自己的机器 · Docker Compose 部署

PRO 控制台 CertHub Pro Web 控制台：证书状态总览、优先处理队列与系统健康检查
5 supportedCommunity official support scopeCommunity 官方支持范围
3 DNSAliyun · Tencent · Huawei阿里 · 腾讯 · 华为
2 pathsSSH auto · manual ZIPSSH 自动 · 手动 ZIP
fullchainverify before failure上线前检查完整链

Why CertHub为什么是 CertHub

One inventory.
From issue to live HTTPS. 一本台账。
从申请管到HTTPS 上线。

Stop babysitting ~90-day calendars across dozens of domains. CertHub runs the full loop on your machines — and matches how deploy actually works in the wild. 别再给人肉盯「约 90 天一轮」的日历。CertHub 在你自己的机器上跑完整链路，并且对齐真实世界的部署方式。

Outcome 01结果 01

Stop watching calendars不用再人肉盯日历

Issue, renew and alert on a schedule. Every certificate keeps its status and next action in one place.申请、续期、告警按日程跑；每张证书的状态和下一步动作集中在一起。

Outcome 02结果 02

Live where it must该亮绿的地方真亮绿

Auto-push over SSH/SCP + nginx reload. ZIP when only a CDN console accepts humans. Full-chain check before WeChat fails you.能 SSH 的自动推（SCP + nginx reload）；只能控制台上传就打 ZIP。完整证书链先验，别等微信小程序报错。

Outcome 03结果 03

Keys stay yours私钥不出你的环境

Private Docker stack. Multi-cloud DNS under one config. Pro adds the official Web console and REST automation — still self-hosted.私有化 Docker，三云 DNS 一份配置；Pro 增加官方 Web 控制台和 REST 自动化，同时保持自托管。

A Closer Look 产品怎么用

Four moments that matter in production — not a feature dump. 先看四个天天会用到的动作，不堆功能名。

Catch incomplete chains before WeChat does别等微信报错，先查出证书链缺中间证

Prefer fullchain.cer, count certificates in the file, and probe the live host. Deploying only the server cert (missing intermediates) shows up as an explicit failure.优先用 fullchain.cer，检查文件里有几段证书，再探测线上主机。如果只部署了站点证书、缺中间证书，这里会直接报出来。

verify-chains
$ ./cert-manager.sh verify-chains
✓ api.example.com · 2 certs · fullchain.cer
✓ mini.example.com · WeChat-ready
# incomplete chains are reported, not ignored
System architecture →系统架构 → Deploy guide证书部署说明

Where platforms usually break平台常断在这里

Hardest link · Deploy最硬一环 · 部署

Issuing is half the job.
Getting it live is the rest. 申请只是半程。
难的是让它上线。

~90-day renew never stops. Domains scatter across calendars, hosts, CDN, and cloud panels. Some targets take SSH push; some only take a human ZIP upload. CertHub keeps both on one ledger — and verifies full chains so mini programs don’t fail on missing intermediates. 约 90 天一轮停不下来；域名散在日历、机器、CDN、云面板。有的目标走 SSH 推送，有的只能控制台传 ZIP。CertHub 两种路径同一本台账，并校验完整证书链，避免小程序缺中间证挂掉。

Aliyun Tencent Huawei
auto

Auto path自动路径

  • SSH / nginx
  • SCP + nginx reloadSCP + nginx reload
manual

Manual ZIP手动 ZIP

  • Skipped in batch批量跳过
  • ZIP downloadZIP 下载
  • Human upload人工上传
mini.example.com2 certs · OK含中间证 · 正常
api.example.comfullchain.cer
legacy.example.commissing intermediate缺中间证书

Choose the right layer先选对工具层级

Why not just use acme.sh?为什么不只用 acme.sh？

CertHub does not replace the ACME engine. It wraps the operational loop around it.CertHub 不替代 ACME 引擎，而是把签发之后的运维闭环补齐。

Capability能力acme.shHosted service托管服务CertHub
ACME issue & renewACME 申请与续期✓Usually通常支持✓
Keys stay in your environment私钥留在自己的环境✓Depends视服务而定✓
SSH multi-host deploymentSSH 多机部署Build it自行编排Depends视服务而定✓
Console-only ZIP workflow控制台手传 ZIP 流程Build it自行处理Depends视服务而定✓
Full-chain live verification完整链线上校验Build it自行处理Depends视服务而定✓
Web + REST inventoryWeb + REST 统一台账—Usually通常支持Pro

Hosted products vary. “Depends” avoids claiming that every provider behaves the same.不同托管产品能力不一，“视服务而定”不代表所有服务都缺少该能力。

Your certs stay on your machines 证书留在你自己的机器上

Not a hosted SaaS peeking at private keys. Docker on your side. DNS secrets and SSH keys stay inside your perimeter. 不是托管 SaaS，私钥不出你的环境。Docker 自己跑；DNS 密钥与 SSH 密钥留在内网。

acme.shBash engineCLICronyqSSH / SCPfullchainPro Web/APISelf-hosted
honest limits先说清楚做不到什么 Set CERTHUB_API_TOKEN; put Web behind VPN if exposed. Community covers the complete basic workflow for five certificates. Direct CDN console API push remains a planned Pro capability until delivered. 设好 CERTHUB_API_TOKEN；对外请放 VPN 后面。Community 为 5 张证书提供完整基础闭环。CDN 控制台 API 直推在正式交付前仍标记为 Pro 规划能力。

Open source first开源版先跑通

Open-source Community. Licensed Pro capacity. Community 开源使用，Pro 按授权容量交付

Community is MIT-licensed and has no built-in certificate-count lock; official testing and support cover five certificates. Pro adds licensed capacity and the private Web/API operations surface. Community 采用 MIT 许可证，不内置证书数量锁；官方测试与支持覆盖 5 张证书。Pro 增加授权容量与私有 Web/API 操作面。

免费版 · ¥0

Five officially supported · CLI workflow官方支持 5 张 · 命令行闭环

MIT-licensed scripts and YAML, without a built-in certificate-count lock.MIT 开源脚本与 YAML，不内置证书数量锁。

入门版 · ¥99／年

Capacity plus the full console证书容量 + 完整控制台

Every Pro tier includes dashboard, certificate operations, online configuration, logs and REST.所有付费档位均包含仪表盘、证书操作、在线配置、日志与 REST。

Install the MIT edition →安装 MIT 开源版 → Explore CertHub Pro了解 CertHub Pro

Questions? 还有问题？

How does CertHub work?CertHub 怎么工作？

Configure domains, DNS, and targets in YAML. ACME DNS-01 issues; the deploy layer pushes over SSH when automatic, or packs ZIP when only a human upload works; renew + chain verify stay on the same ledger.在 YAML 里配域名、DNS、部署目标。ACME DNS-01 申请；部署层能 SSH 的自动推，只能手传的打 ZIP；续期与证书链校验仍在同一本台账。

Who is it for?适合谁？

Ops teams tired of ~90-day renew calendars across many domains — especially when some hosts take SSH and others only take a console upload.被「约 90 天一轮 + 域名很多」折磨的运维——尤其有的机器能 SSH 推，有的只能控制台上传。

How is this different from acme.sh alone?和单独用 acme.sh 有什么不同？

acme.sh mainly issues a file. CertHub Community adds the CLI delivery loop; Pro adds the official Web console and REST operations surface.acme.sh 主要解决申请。CertHub Community 补齐命令行交付闭环；Pro 再增加官方 Web 控制台和 REST 操作面。

Is it free?免费吗？

Community is MIT-licensed and does not technically stop at certificate six. Five certificates define the official testing, documentation and support scope; the complete CLI workflow remains open source.Community 采用 MIT 许可证，不会在第 6 张证书时被技术停用。5 张定义的是官方测试、文档与支持范围，完整 CLI 工作流仍然开源。

What is planned beyond the MIT edition?开源版之外还计划做什么？

Pro adds 10, 50 and 200-certificate capacity tiers plus production-scale delivery capabilities. Direct provider integrations that are still being built remain clearly marked as planned.Pro 提供 10、50、200 张证书容量，并增加生产级交付能力；仍在开发的厂商直连接口会继续明确标为规划能力。

Get CertHub today 现在就上手 CertHub

Clone, compose, configure, issue. Four steps on your own machines. 克隆、编排、配置、签发。四步，都在你自己的机器上。

bootstrap
$ git clone https://github.com/huiyonghkw/CertHub.git
$ cd CertHub && docker compose up -d
$ docker exec acme-ssl-manager /scripts/cert-manager.sh generate example.com
✓ then: verify-chains
Open GitHub →打开 GitHub → Install guide安装手册 Full docs完整文档