One cert manager to rule them all, one CA to find them, one browser to bring them all, and in encryption bind them.
Thanks goes to Thanks @apples723! Get the Image here- Docker Hub
SphereSSL is a modern, user-friendly certificate manager, built with ASP.NET.
Make SSL certificate creation and renewal effortless for everyone—whether you’re a hobbyist or a professional.
Handles both manual and automated DNS challenges, supports multiple DNS providers, and puts the power of SSL in the hands of, well… literally everyone.
- Fast, Intuitive Dashboard
Simple “Quick Create” flow, certificate management, and helpful links. - Auto & Manual DNS
Automated DNS record creation with Cloudflare, AWS, etc.
Manual entry for literally any DNS provider. - Renewal Scheduling
Toggle auto-renew on/off, get renewal notifications, and never let a cert expire. - Multi-User Support
Share certs/orders for collaborative management (future roadmap). - Import/Export
Convert, download, or upload certs in your preferred formats. - Enterprise Ready
Unlimited domains, no arbitrary limits, tons of provider integrations.
SphereSSL does not include a default administrator password.
-
Copy
.env.exampleto.env. -
Open
.envand replace the placeholder with a strong temporary password:SPHERESSL_ADMIN_PASSWORD=your-strong-temporary-password
-
Start SphereSSL:
docker compose up -d
-
Sign in using the administrator username configured in
app.configand the password entered in.env. -
Change the administrator password through SphereSSL Settings after signing in.
-
After confirming the new password works, remove
SPHERESSL_ADMIN_PASSWORDfrom.envor delete.env.
The administrator password is hashed and stored in SphereSSL’s database during initial setup. Existing installations do not require the environment variable when restarting.
docker build -t spheressl .
docker run -d
-p 7171:7171
-v $(pwd)/data:/app/data
-v $(pwd)/certs:/app/certs
-v $(pwd)/logs:/app/logs
--name spheressl
--restart unless-stopped
spheressl
docker pull kl3mta3/spheressl:latest
docker run -d
-p 7171:7171
-v $(pwd)/data:/app/data
-v $(pwd)/certs:/app/certs
-v $(pwd)/logs:/app/logs
--name spheressl
--restart unless-stopped
kl3mta3/spheressl:latest
Request your certificate and let SphereSSL handle the rest!
Tip: For advanced setup, head to the Wiki.
- AWS Route53
- Cloudflare
- Cloudns.net
- DigitalOcean
- DNSMadeEasy
- DreamHost
- DuckDNS
- Gandi
- GoDaddy
- Hetzner
- Linode
- Namecheap
- Porkbun
- Vultr
- …and more coming soon!
See API Credential Requirements for details.
- Full User Guide & FAQ
- What is SSL?
- What is DNS?
- Auto Add Records
- Auto Renew
- And much more in the Wiki!
Pull requests are welcome!
If you spot a bug or want to add a provider, open an issue or submit a PR.
- Add more DNS providers
- Webhooks & external integrations
- Fully automated enterprise deployment
See the roadmap for more.
This project is licensed under the Business Source License 1.1 (BSL-1.1).
See LICENSE for details.
Yes, the source is open. You can fork it, study it, use it, and self-host for free. You can absolutely use SphereSSL to manage certificates for your own company, organization, or projects. The only thing you can’t do is turn it into a paid product, paid service, or SaaS for others without permission.
Some folks argue that only MIT/Apache/OSI-approved licenses are “real” open source. I disagree. “Open source” is about sharing knowledge and empowering builders, not giving SaaS companies a free product to resell 1,000,000 times.
If you want to call it “source-available,” that’s fine. The point is: You get the code, you get the freedom to use it for anything except commercial exploitation. That’s the trade-off.
- Questions? Open an Issue
- Feature requests? We wanna hear ‘em!
- Need help? See the Wiki.
The more you know...