Acmebot
Open source · Self-hosted in your Azure environment

Automated TLS Certificate Management
for Microsoft Azure

Acmebot issues and renews ACME certificates, stores them in Azure Key Vault, and lets your Azure services consume them. Self-hosted in your Azure environment and open source under Apache-2.0.

Get StartedDeploy to Azure
5+Verified ACME CAs
15+DNS provider integrations
9+Azure service integrations

Certificate automation in your Azure environment

Reduce expiry risk, retire one-off renewal scripts, and keep certificate work inside Azure-native security and monitoring.

Keep private keys in Key Vault

Key Vault generates or reuses the private key, and Acmebot merges the ACME-issued chain back into the same certificate.

Operate certificate fleets

Each managed certificate keeps its own renewal state, next check time, CA-guided timing when available, and fallback behavior.

Replace one-off scripts

Use the dashboard for daily work, the HTTP API for integrations, and the CLI for repeatable automation.

Issue apex, wildcard, and SAN names

Cover zone apex, wildcard, and multi-SAN certificates across multiple DNS zones and providers from one deployment.

Route results to your team

Send operation results to Slack, Microsoft Teams, Logic Apps, Power Automate, or your own webhook endpoint.

Use the CA your policy requires

Start with Let's Encrypt, or use GlobalSign, Google Trust Services, SSL.com, ZeroSSL, or a custom ACME v2 endpoint.

Designed for production rollout

Manage issuance and renewal in your subscription, with access controls and visibility into your own deployment.

Connect to your environment

Use your Key Vault, DNS provider, managed identity, and monitoring resources. Review deployment prerequisites before issuing a certificate.

Use one operation model

Issue, renew, revoke, and track operations through the same model whether you use the dashboard, HTTP API, CLI, or scheduled renewal.

Keep access and visibility clear

Protect the dashboard with authentication and app roles, scope Azure access with managed identity, and monitor your own deployment with Azure Application Insights.

Bring renewed certificates to Azure services

Choose a service for integration guidance. Each service controls certificate pickup and rotation. If its native managed certificate meets your needs, that may be simpler.

App ServiceWeb Apps / Functions / Containers
Container AppsIncluding custom DNS suffix
Front DoorStandard / Premium
Application Gatewayv2
API ManagementCustom domains
Web PubSubPremium tier
Event Grid NamespacesHTTP / MQTT custom domains
SignalR ServicePremium tier
Virtual MachinesCustom certificate deployment

DNS providers

Use the DNS provider you already run, or connect Acmebot to your own DNS automation API.

Azure DNS
Azure Private DNS
Cloudflare
Amazon Route 53
Google Cloud DNS
GoDaddy
Akamai Edge DNS
DNS Made Easy
Gandi LiveDNS
OVH
TransIP DNS
PowerDNS
Custom DNS

Need another provider? The Custom DNS provider can connect Acmebot to your own DNS automation API.

Certificate authorities

Use a verified ACME v2 endpoint, choose a CA with EAB, or point Acmebot at your own ACME directory URL.

Let's EncryptFree

Common default for public certificates. No external account binding credentials are required.

GlobalSignEAB

Commercial CA option for automated certificate issuance through ACME.

Google Trust ServicesEAB

Google public CA endpoint for ACME-issued certificates.

SSL.comEAB

Commercial CA endpoint for 90-day certificates through ACME.

ZeroSSLEAB

ACME CA option for teams that already use ZeroSSL accounts.

Deploy to Azure

Start with the Azure Public template, then connect DNS permissions and dashboard authentication for your environment.

Acmebot v5 GA

Provision the Function App, storage, monitoring resources, application settings, and optional Key Vault for a new Acmebot environment.

  • Scheduled renewals
  • ARI-aware timing
  • Key Vault storage
  • Private network support
  • Application Insights in your subscription
Azure Public

Also available from the Terraform Registry

From prerequisites to verified HTTPS

Follow the setup guide, then verify both the Key Vault certificate and the certificate your application serves.

1

Check prerequisites and deploy

Review Azure permissions and DNS access, then deploy with your chosen ACME endpoint, managed identity, and Key Vault.

2

Configure DNS and issue

Grant DNS-01 TXT record permissions, secure dashboard access, and issue a certificate. Confirm its current version in Key Vault.

3

Bind and verify HTTPS

Connect the consuming service, verify its public HTTPS certificate, and check it again after renewal and service synchronization.

Read the Documentation

Technical articles

Further reading on certificate lifetimes and operating Azure Functions. Use the guides here for deployment and integration steps.

More articles from Polymind on DEV Community →

Sponsors

Thank you to the organizations and individuals who support Acmebot development.

Interested in supporting the project?

Become a Sponsor

Open source

Apache License 2.0 — open source and free to use.

GitHub

Source code, issues, releases, and contributions

Documentation

Deployment guides, operations guidance, and reference material

Discussions

Usage questions, design discussions, and community support