Review before mutation
Inspect the exact runtime, native paths, supported configuration, provider mode, and intended certificates before a managed operation begins.
Open-source certificate operations
Operate lego without operating blind.
AcmeMux starts as a graphical control plane for an existing lego ACME client and its native workspace. The destination is a self-hosted certificate lifecycle platform that can find, issue, renew, deploy, and account for certificates without making operators surrender control of their keys or infrastructure.
Source published; first tagged release qualification is in progress
Expected next certificate replacement
Loading certificate status Dogfood target: a new public certificate about every 72 to 96 hours- ACME profile
- Loading
- Issued
- Loading
- Expires
- Loading
- Deployment
- Azure App Service
Public certificate metadata only. Inspect the live certificate pipeline.
Native workspaceNo second certificate store
Upstream legoNo ACME protocol reimplementation
No telemetryNo analytics or tracking identifiers
Apache 2.0Open source with practical terms
The long view
From one lego workspace to the place an operator runs certificate lifecycle.
The MVP solves a deliberately narrow problem: make one trusted host and one native lego workspace safer to operate. That is the foundation, not the finish line.
AcmeMux is intended to grow into an on-premises control plane for public and private certificates: unified inventory, discovery, policy, renewal, alerts, deployment, audit evidence, access control, and tested recovery. Each layer must remain understandable to the person responsible when automation fails at 2 a.m.
See the path from MVP to lifecycle platformWhy AcmeMux
Automation should remove toil, not evidence.
ACME clients make certificate issuance repeatable. Day-two operation still leaves important questions: Which binary is running? Which workspace will change? Are credentials scoped correctly? Did renewal change anything? What happens after a restart? AcmeMux turns those questions into reviewed state instead of shell history.
Constrain execution
AcmeMux invokes the selected lego executable directly. It does not expose a shell, arbitrary commands, inherited environments, or unrestricted hook execution.
Keep ownership clear
lego remains responsible for ACME behavior, accounts, certificates, keys, archives, and renewal decisions. AcmeMux manages neither a competing protocol stack nor a shadow workspace.
Recover conservatively
Durable operation state, bounded output, redaction, workspace coordination, and restart handling help distinguish completed, failed, interrupted, partial, and ambiguous outcomes.
One operational path
From an existing workspace to understandable renewal.
- 1
Bring your trusted lego runtime
Install an exact supported Linux amd64 lego executable. AcmeMux verifies its path, digest, build identity, ownership, permissions, and capabilities before adoption.
- 2
Adopt or create native configuration
Connect one native lego workspace. Typed forms update supported YAML and restrictive credential files while unknown or unsafe fields remain visible and block managed execution.
- 3
Evaluate certificates safely
Run a reviewed whole-workspace operation manually or on one durable daily schedule. lego still applies ACME Renewal Information, lifetime rules, provider behavior, and renewal eligibility.
- 4
Read the outcome
Refresh native inventory and inspect certificate health, exact expiration evidence, runtime identity, provider selection, and the latest bounded secret-redacted result.
Curated compatibility
Useful coverage without pretending every compiled option is safe.
AcmeMux supports a deliberately reviewed subset of lego. A provider being compiled into lego does not automatically make it supported in the AcmeMux interface.
Certificate authorities
DNS-01 providers
Challenge modes
Trusted-host security
The interface is convenient. The boundary stays strict.
Certificate automation handles DNS credentials, account keys, certificate private keys, and authority over public names. AcmeMux treats the host and service identity as security boundaries, not implementation details.
Understand the security model- Loopback application listener behind administrator-managed HTTPS
- Single administrator with Argon2id password protection
- Hashed, rotating, expiring, and revocable sessions
- No product telemetry, crash reporting, or tracking identifiers
- Secret-aware output limits and repeated redaction
- Hardened non-root systemd service on Debian 13 amd64
Build operational understanding
Practical ACME guidance, not search-engine filler.
AcmeMux documentation and learning material explain the boundaries that matter when certificate automation moves from a one-line command to a service you rely on.
Foundation
ACME DNS-01 challenge explained
How TXT-record validation works, why it enables wildcard certificates, and how to limit DNS credentials.
Operations
Operating the lego ACME client safely
Workspace ownership, scheduling, credential handling, and what a control plane should preserve.
Reliability
Renewal without hidden failure
Design around ARI, propagation, atomic deployment, observation, restart safety, and ambiguous outcomes.
ACME profiles
Let's Encrypt short-lived certificates
What the roughly six-day profile changes, why renewal automation matters, and what AcmeMux supports today.
Direct answers
Frequently asked questions
Is AcmeMux an ACME client?
No. AcmeMux is a graphical control plane for an administrator-provisioned upstream lego client. lego continues to implement ACME and DNS-provider protocols.
Does AcmeMux store certificate private keys?
Not in its application database. Accounts, certificates, chains, keys, archives, and configuration remain in the adopted native lego workspace.
Can AcmeMux issue wildcard certificates?
Yes, when the certificate uses a supported DNS-01 provider. Wildcard validation cannot use HTTP-01.
Does AcmeMux deploy certificates to web servers?
No. Certificate deployment, service reloads, notifications, and arbitrary hooks are outside the current product boundary. Keep deployment automation separate and tightly scoped.
Which Linux distributions are supported?
The initial qualified platform is Debian 13 amd64 using the supplied source-built systemd installation. Success elsewhere does not imply support.
Does the website or product track usage?
No. AcmeMux collects no analytics, usage telemetry, crash reports, or tracking identifiers. The optional one-time renewal alert uses AWS's confirmation flow; AcmeMux stores only hashed abuse-limit keys and resets the notification topic after delivery.
Help shape the release