HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
caddyserver
certmagic
Go2018–2025
caddyserver / certmagic

certmagic

Automatic HTTPS for any Go program: fully-managed TLS certificate issuance and renewal

Web DevelopmentNetworking
Explore on GitHubRead Hacker News discussions
12Distinct people
17Mentions
1Explicit recommenders
5.6KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Automatic HTTPS for any Go program: fully-managed TLS certificate issuance and renewal

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

Caddy's TLS features are available in CertMagic (https://github.com/caddyserver/certmagic) for your daily Golang web app development. Highly recommended!

QUFB used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year17 dated mentions

Observed mentions: 2018-12-10 17:12:13 UTC to 2025-06-30 13:21:55 UTC.

0123452018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC110
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC505
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC101
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC202
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC312
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC303

What Hacker News says

17 sources
smjburton·Jun 30, 2025
It's unfortunate to see this go away, but understandable given the costs involved. Another option is to run Caddy as a web server, which provides automatic cert renewal (https://caddyserver.com/docs/automatic-https). If notifications are still important, they also provide an event subscription system (https://github.com/caddyserver/certmagic#events) so you can subscribe to cert-related events, run custom code, trigger event handlers, etc.
In LetsEncrypt – Expiration Notification Service Has Ended
ajayvk·Oct 18, 2023Submission

Show HN: Clace – Secure hypermedia web applications using Starlark and go

Hey, My name is Ajay. I have been working on a new open source project https://github.com/claceio/clace for the past few months. Clace is an Apache-2 licensed platform for building secure internal web applications. The end goal is to allow fully custom applications as well as workflow type applications. Custom apps are supported currently, workflows will come later. Clace allows you to build Hypermedia first web applications, where the server API returns HTML instead of JSON. With the HTMX[1] library on the client side, it makes developing and maintaining interactive websites much easier as compared to the regular Javascript SPA model. Background: My experience has been in distributed systems and data integration. I have seen the challenges companies face building and maintaining internal tools. Since internal tools generally do not have
Read the rest
a large team building it, you want them to be as easy to build and maintain as possible. Since the tools generally have access to sensitive systems on the backend, you want them to be secure. Most security audits are done as part of the initial deployment, subsequent updates are not thoroughly reviewed, which is a security risk. Clace is built with these goals: - Enable development of secure internal web applications. The security policy should be set upfront and subsequently enforced by the platform. - Simplify ongoing maintenance of such apps by removing build and dependency related issues. Doing app code updates should be hassle-free, be it after six months or even six years. - Have flexible deployment options, allowing for use by individuals and teams with appropriate authentication and authorization policies at the the platform level. Technology: Clace is a single binary application, built in go, using sqlite for app metadata. Clace apps are written in Starlark [2], which gives a simple python based syntax. The API routes are defined to be Hypermedia first, each API specifies what HTML to return for a full page reload and what to return for a partial request from HTMX. Go HTML templates are used for the response. The starlark code runs in a sandbox, it can make external calls through plugins. The plugin boundary is used to enforce security policies[3]. This allows for policies like permit GET requests but not POST/DELETE, which are difficult to do with a container or jail based approach. Clace bundles esbuild to allow importing javascript libraries as ESModules. TailwindCSS/DaisyUI watcher integration is supported, although many simple apps can use classless CSS libraries. The goal is to have a no build approach, the dev artifacts are checked into git and directly used for serving prod. Importing new ESM libraries or new TailwindCSS classes requires a one time setup operation, which runs automatically in dev mode. Other than that, most code changes do not need a build step. Content hash based file names with a virtual file system is used, similar to hashfs[4]. This allow for aggressive static content caching, even without a build step doing file renames. For deployment, certmagic[5] is used for automatic TLS certs. App routing is supported based on path and/or domain, allowing for deployment flexibility. The plan is to allow plugins to be loaded dynamically using go-plugin[6], currently two plugins are built into the server, exec for running CLI command and http for REST API calls. Building UI for CLI tools and backend for frontend type use-cases are supported currently. https://github.com/claceio/clace/tree/main/examples/ has some simple sample apps (the _gen files are auto generated), the demo apps are running at https://demo.clace.io/ Ajay [1]: https://htmx.org/ [2]: https://github.com/google/starlark-go [3]: https://clace.io/docs/applications/appsecurity/#security-mod... [4]: https://github.com/benbjohnson/hashfs [5]: https://github.com/caddyserver/certmagic [6]: https://github.com/hashicorp/go-plugin
2 points · Open discussion
mholt·Sep 12, 2023
Makes sense -- I will often go for what I'm familiar with, too. Aside from creating CertMagic, I think CertMagic has a few benefits over autocert. It is designed to scale to thousands of certificates. It will staple OCSP for you automatically. It can obtain certificates "on demand" during handshakes. It is more robust to failures and can keep sites up even when other ACME libs let you down. CertMagic supports all challenge types; I think autocert only does TLS-ALPN challenge, which requires port 443. There's a lot of other improvements and enhancements that autocert is lacking IMO. A scan of the readme should help illustrate: https://pkg.go.dev/github.com/caddyserver/certmagic#section-... But I guess use what works for you!
In Caddy is the first and only web server to use HTTPS automatically and by default
mholt·Jun 15, 2023
Ah, that makes sense! I wonder if we should be doing some basic sanity checks on newly obtained certificates in Caddy, and treat this as a failure, and try the next configured CA instead. (Obviously SCT signatures will require some external resource so we would have to weigh that a bit more, maybe make it configurable...) Issue opened here to discuss, though it does sound troublesome/tedious: https://github.com/caddyserver/certmagic/issues/240
In Let's Encrypt Acme API Outage
Fileformat·Oct 25, 2020
I kept running into DNS issues, and needed to triple-check that I was pointing to the right DNS servers, so I made this utility website that does exactly that: which-dns [1] This isn't a new idea ([2]), but mine supports https (hat tip to Matt Holt's certmagic [3]), is ad-free, and the source is available [4]. Let me know what you think! [1] https://which.nameserve.rs [2] http://www.whatsmydnsserver.com/ [3] https://github.com/caddyserver/certmagic [4] AGPL. It is my first foray into golang. https://github.com/redirect2me/which-dns
In Show HN: Which DNS servers are you pointing to?
RabbitmqGuy·Apr 17, 2020
For our backend[1], - We are using the default test framework that comes with Go; go test. - We usually follow Postel's law which translated to Go, would be: `Accept interfaces, return concrete types`[2] This enables us to pass in fake interfaces during tests. I haven't checked what kind of performance cost(if any) we may be paying by passing around interfaces instead of concrete implementations; but performance has not been a problem so far so we are just happy with our approach. - We do not use any http web frameworks, we are just using stdlib's net/http. We pair that with certmagic[3] for automated TLS certificate issuance and renewal. I like the performance of Go, it is easy to pick up and it comes with a pretty great stdlib. What I do not like is the fact that it has nil pointers, and you tend to run into one or two nil pointer dere
Read the rest
ference errors once in a while. 1. https://errorship.com/ 2. https://blog.chewxy.com/2018/03/18/golang-interfaces/ 3. https://github.com/caddyserver/certmagic
In Ask HN: How are you using Go to write production-grade back end services?
mholt·Feb 26, 2020
> An edge web server should carry no knowledge of a concept of a cluster. Caddy doesn't. That's what's so interesting! > It should simply be able to ask something for a cert. It does. > I suggest the following path: Oh good! That's pretty close to how it actually works already! I'm happy to explain more how Caddy actually works before we start armchairing solutions here. Or, feel free to read the code for yourself: https://github.com/mholt/certmagic/
In Techcrunch SSL Cert Expired

Showing the 15 most recent of 17 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.