CertMate
CertMate is an SSL certificate management system with a web UI and REST API. It automates issuing and renewing Let's Encrypt certificates via DNS-01 challenges across 20+ DNS providers, with unified backups and multi-account support.
Deploy CertMate on Dokploy
- Install Dokploy on your server if you haven't already.
- In your Dokploy panel, open a project and click Create Service → Template.
- Search for CertMate and click Create — Dokploy configures domains, environment variables, and volumes for you.
Alternatively, create a Compose service, go to Advanced → Import from Base64, and paste this payload:
ewogICJjb21wb3NlIjogInNlcnZpY2VzOlxuICBjZXJ0bWF0ZTpcbiAgICBpbWFnZTogZmFicml6aW9zYWxtaS9jZXJ0bWF0ZToyLjIxLjNcbiAgICBlbnZpcm9ubWVudDpcbiAgICAgIC0gRkxBU0tfRU5WPXByb2R1Y3Rpb25cbiAgICAgIC0gU0VDUkVUX0tFWT0ke1NFQ1JFVF9LRVl9ICMg8J+UkCBGbGFzayBzZXNzaW9uIHNlY3JldFxuICAgICAgLSBBUElfQkVBUkVSX1RPS0VOPSR7QVBJX0JFQVJFUl9UT0tFTn0gIyDwn5SQIEFQSSAvIHdlYiBVSSB0b2tlblxuICAgICAgLSBCRUhJTkRfUFJPWFk9JHtCRUhJTkRfUFJPWFl9XG4gICAgICAtIENMT1VERkxBUkVfVE9LRU49JHtDTE9VREZMQVJFX1RPS0VOfVxuICAgICAgLSBMRVRTRU5DUllQVF9FTUFJTD0ke0xFVFNFTkNSWVBUX0VNQUlMfVxuICAgICAgLSBMT0dfTEVWRUw9JHtMT0dfTEVWRUx9XG4gICAgZXhwb3NlOlxuICAgICAgLSA4MDAwXG4gICAgdm9sdW1lczpcbiAgICAgIC0gY2VydG1hdGVfY2VydGlmaWNhdGVzOi9hcHAvY2VydGlmaWNhdGVzXG4gICAgICAtIGNlcnRtYXRlX2RhdGE6L2FwcC9kYXRhXG4gICAgICAtIGNlcnRtYXRlX2xvZ3M6L2FwcC9sb2dzXG4gICAgICAtIGNlcnRtYXRlX2JhY2t1cHM6L2FwcC9iYWNrdXBzXG4gICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWRcbiAgICBoZWFsdGhjaGVjazpcbiAgICAgIHRlc3Q6IFtcIkNNRFwiLCBcImN1cmxcIiwgXCItZlwiLCBcImh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9oZWFsdGhcIl1cbiAgICAgIGludGVydmFsOiAzMHNcbiAgICAgIHRpbWVvdXQ6IDEwc1xuICAgICAgcmV0cmllczogM1xuICAgICAgc3RhcnRfcGVyaW9kOiA0MHNcblxudm9sdW1lczpcbiAgY2VydG1hdGVfY2VydGlmaWNhdGVzOlxuICBjZXJ0bWF0ZV9kYXRhOlxuICBjZXJ0bWF0ZV9sb2dzOlxuICBjZXJ0bWF0ZV9iYWNrdXBzOiIsCiAgImNvbmZpZyI6ICJbdmFyaWFibGVzXVxubWFpbl9kb21haW4gPSBcIiR7ZG9tYWlufVwiXG5TRUNSRVRfS0VZID0gXCIke3Bhc3N3b3JkOjMyfVwiXG5BUElfQkVBUkVSX1RPS0VOID0gXCIke3Bhc3N3b3JkOjMyfVwiXG5cbltjb25maWddXG5tb3VudHMgPSBbXVxuXG5bW2NvbmZpZy5kb21haW5zXV1cbnNlcnZpY2VOYW1lID0gXCJjZXJ0bWF0ZVwiXG5wb3J0ID0gODAwMFxuaG9zdCA9IFwiJHttYWluX2RvbWFpbn1cIlxuXG5bY29uZmlnLmVudl1cblNFQ1JFVF9LRVkgPSBcIiR7U0VDUkVUX0tFWX1cIiAjIPCflJAgRmxhc2sgc2Vzc2lvbiBzZWNyZXRcbkFQSV9CRUFSRVJfVE9LRU4gPSBcIiR7QVBJX0JFQVJFUl9UT0tFTn1cIiAjIPCflJAgQVBJIC8gd2ViIFVJIHRva2VuXG5CRUhJTkRfUFJPWFkgPSBcInRydWVcIlxuQ0xPVURGTEFSRV9UT0tFTiA9IFwiXCJcbkxFVFNFTkNSWVBUX0VNQUlMID0gXCJcIlxuTE9HX0xFVkVMID0gXCJJTkZPXCIiCn0=
Configuration
The exact Docker Compose and template configuration this template deploys.
Instructions
CertMate
Getting started
- Deploy the template and open the app domain.
- Log in with the API bearer token: it is auto-generated by the template and stored in the
API_BEARER_TOKENenvironment variable (Dokploy → your service → Environment). The same token authenticates REST API requests (Authorization: Bearer <token>). - In Settings, set your Let's Encrypt email and add credentials for your DNS provider (Cloudflare, Route53, etc.) to issue certificates through DNS-01 challenges.
Notes
CLOUDFLARE_TOKENcan optionally be set as an environment variable instead of configuring it in the UI.- Certificates, application data and backups are persisted in the
certmate_certificates,certmate_dataandcertmate_backupsvolumes. - API documentation is available at
/docs/(Swagger) and/redoc/on your domain.
Related Templates
Cachkey
Version: 0.1.0
Cachkey is an open-source, self-hosted manager for secrets and environment variables: encrypted values, per-environment access for your team, a CLI and a read-only API for servers and CI.
kuukura
Version: 2026.10.13
kuukura is a self-hosted secrets vault for small teams: values are decrypted only on your server, reveals require a passkey, and every access is audit-logged. Requires a Google OAuth client ID and secret, set in the Environment tab before deploying.
OpenResty Manager
Version: 1.2.0
The easiest using, powerful and beautiful OpenResty Manager (Nginx Enhanced Version) , open source alternative to OpenResty Edge, which can enable you to easily reverse proxy your websites with security running at home or internet, including Access Control, HTTP Flood Protection, Free SSL, without having to know too much about OpenResty or Let's Encrypt.
Pocket ID
Version: 2.14.0
Pocket ID is a simple OpenID Connect and OAuth 2.0 provider that lets users authenticate to applications with passkeys.
Ackee
Version: latest
Ackee is a self-hosted analytics tool for your website.
AdGuard Home
Version: latest
AdGuard Home is a network-wide ad and tracker blocker. Self-host it on your own server with Dokploy, which deploys AdGuard Home as a Docker Compose service in a few clicks.
Self-host CertMate in minutes
Dokploy is a free, open source deployment platform. Deploy CertMate and 585+ other templates on your own infrastructure with a single click.