CertWarden

CertWarden

Docker app from ZappyZap's Repository

Overview

Cert Warden is a centralized ACME (Let's Encrypt) certificate manager. It obtains and renews certificates in one place, then lets your clients and servers fetch them over an API, or pushes them out automatically. Supports http-01, dns-01 (Cloudflare, ACME-DNS, acme.sh, custom scripts...) and dns-01 aliasing. Initial login: admin / password (change it immediately). Once a certificate named 'serverdefault' exists, the web UI is also served over HTTPS on port 4055.

Readme

View on GitHub

Cert Warden

Centralized Certificate Management Conveniently Leverage Let's Encrypt to Secure Your Infrastructure

More Information

https://www.certwarden.com/

Download

Binary Releases

https://github.com/gregtwallace/certwarden/releases

GitHub Packages

https://github.com/gregtwallace/certwarden/pkgs/container/certwarden

Sources

Backend https://github.com/gregtwallace/certwarden-backend

Frontend https://github.com/gregtwallace/certwarden-frontend

Categories

SecurityNetwork > Management

Download Statistics

13,411
Total Downloads

Related apps

Explore more like this

Explore all
SecurityManagement apps

Links

Projectcertwarden.comRegistrygithub.comTemplateraw.githubusercontent.com

Details

Repository
ghcr.io/gregtwallace/certwarden:latest
Registry
https://github.com/gregtwallace/certwarden/pkgs/container/certwarden
Last Updated2026-09-05
First Seen2026-10-23

Runtime arguments

Web UI
http://[IP]:[PORT:4050]/
Network
bridge
Shell
sh
Privileged
false
Extra Params
--restart=unless-stopped

Template configuration

Time ZoneVariableenv

Time zone used for logs and scheduled tasks (renewals, backups).

Target
TZ
Default
America/Toronto
Value
America/Toronto
HTTP PortPorttcp

Primary HTTP server (web UI and API). Redirects to HTTPS once the 'serverdefault' certificate is configured.

Target
4050
Default
4050
Value
4050
HTTPS PortPorttcp

Primary HTTPS server (web UI and API). Active once the 'serverdefault' certificate is configured.

Target
4055
Default
4055
Value
4055
HTTP-01 Challenge PortPorttcp

Internal http-01 challenge server. Port 80 of your domain(s) must be forwarded / proxied to this port when using the http-01 challenge. Not needed if you only use dns-01.

Target
4060
Default
4060
Value
4060
pprof HTTP PortPorttcp

pprof debug server (HTTP). Disabled by default (enable_pprof in config.yaml). Leave empty unless debugging.

Target
4065
pprof HTTPS PortPorttcp

pprof debug server (HTTPS). Disabled by default (enable_pprof in config.yaml). Leave empty unless debugging.

Target
4070
DataPathrw

Persistent storage for the database, config.yaml, backups and logs.

Target
/app/data
Default
/mnt/user/appdata/certwarden/data
Value
/mnt/user/appdata/certwarden/data