Just Enough CertsKeep your site green

A self-hosted SSL/TLS certificate manager. It obtains certificates from many sources, validates domains, deploys to CDNs and servers, and renews before expiry.

Get started

What is JEC?

GitHub

Many certificate sources

ACME (Let's Encrypt, ZeroSSL, Google and more, with EAB), the certificate services of Alibaba Cloud and Tencent Cloud, Namecheap, a local directory, or an upload.

Learn more

Automatic domain validation

Over 200 DNS providers and CNAME delegation; HTTP validation through a website directory, or answered by JEC itself or at the edge of Alibaba Cloud ESA.

Learn more

Deploy anywhere

Over twenty targets, including Alibaba Cloud, Tencent Cloud, Huawei Cloud, Cloudflare, AWS, Kubernetes, Synology, BaoTa and SSH; every new version replaces the old certificate.

Learn more

Renewal before expiry

Certificates renew within their renewal window, following the CA's renewal information (ARI); failures are retried with backoff, and the certificate actually served is checked.

Learn more

Notifications

More than ten channels, such as email, Telegram, DingTalk, Feishu, WeCom, Bark, ntfy, webhooks and scripts, each with its own events and language.

Learn more

Secure and auditable

Private keys and secrets are encrypted at rest; two-factor authentication, OIDC single sign-on, API tokens and an audit log. Runs as a single container.

Learn more

Every certificate at a glance

The overview lists every certificate by days left, the most urgent first, with what needs attention, what expires in the next 90 days and the latest activity.