Comparison

Certbot alternative for multiple servers

Looking for a Certbot alternative for multiple servers? Certbot can already automate renewal across a fleet with orchestration and hooks. Compare CertLocker when you also need shared inventory, scoped delivery, live endpoint verification and audit history.

Use Certbot when...

‣ Your existing automation and renewal hooks cover the servers you operate
‣ Your chosen ACME CA and validation plugins cover your requirements
‣ You don't need a team dashboard or audit trail
‣ Each server manages its own certs independently

Use CertLocker when...

✓ You need shared ownership, permissions and evidence across environments
✓ You need one inventory of all certs with visibility across the team
✓ You want ACME issuance plus Gateway delivery to HAProxy / win-acme
✓ Your certs come from multiple public issuers, uploads, or mixed sources
✓ Secrets, probes, and just-in-time SSH belong alongside cert operations

Feature comparison

Feature	CertLocker	Certbot
ACME client to Let's Encrypt and other CAs	✓ Multi-issuer catalogue	✓ (LE by default; other CAs via --server)
Centralized certificate inventory	✓ Team-wide	✗ Per-server files
Upload / custody of commercial and internal certs	✓	✗
ACME delivery endpoint for infrastructure	✓ Gateway	✗
HAProxy and win-acme compatible ACME path	✓	✗
DNS-01 automation	✓ Cloudflare, Route 53, GCP, Azure	✓ Via DNS plugins
Wildcard certificates	✓	✓ (DNS-01)
Automatic renewal workflows	✓ Platform-managed	✓ certbot renew
Endpoint TLS probes	✓	✗
Secrets and private-key management	✓ Version history	✗
Just-in-time SSH / bastion access	✓	✗
RBAC, SSO, and audit evidence	✓	✗
AI agents / MCP scoped tokens	✓	✗
Cost	Hosted onboarding; services scoped by agreement	Free / open source

Different tools for different problems

Certbot and CertLocker overlap on ACME issuance, but they solve different operational problems. Certbot is an excellent per-server ACME client: it talks to a CA, completes HTTP-01 or DNS-01 validation, installs the cert locally, and renews with cron. That loop can also be orchestrated across a fleet, and DNS-01 can validate domains without exposing an HTTP challenge endpoint.

CertLocker is both an ACME client and an ACME delivery layer. As a client it can request certificates from Let's Encrypt, ZeroSSL, Sectigo, Google, and other catalogue issuers, with reusable DNS clients and workflow history. As a delivery endpoint, HAProxy, win-acme, or any standards-compliant ACME client can pull certificate material from the CertLocker Gateway using scoped tokens.

The team benefit is the control plane around that: inventory, RBAC, secrets, endpoint probes, just-in-time host access, and audit evidence. Certbot remains a fine choice when your renewal and deployment automation covers the work; CertLocker is for the operational layer Certbot was never meant to provide.

One control plane. Scoped delivery. Full audit.

Use ACME where it already fits, then add the team inventory, verification, secrets, and access control Certbot was never meant to provide.

Services & access