Publicly-trusted TLS certificates for airgapped and egress-restricted fleets.
Like certbot, but built for machines the internet can't reach: ACME DNS-01 validation through a DMZ broker, thin agents that keep private keys local, and an offline courier mode for zero-egress environments.
Status: phase 1 (standalone mode) working. gapcert issue / renew / status
with DNS-01 solvers for acme-dns, Route53, Cloudflare, and RFC2136/TSIG, deploy
hooks, and hermetic integration tests against pebble. See
GAPCERT-KICKOFF.md for the architecture and build plan;
examples/config.example.yaml for configuration.
$ gapcert status
NAME DOMAINS EXPIRES DAYS STATUS
internal-wildcard *.internal.example.com 2026-10-24 88 okgapcert issue obtains every configured certificate now; gapcert renew (run
it from cron or a systemd timer) re-issues only what is inside its renewal
window, rotating the private key and firing the configured deploy hook.
Build: make build (Go 1.26+). Gate: make gate (lint + vet + unit +
integration; integration needs pebble and pebble-challtestsrv on PATH).
— amitpatole