Certimate on AWS User Guide

Overview

This image runs Certimate, the open source platform that automates the full life cycle of your SSL/TLS certificates. Certimate issues certificates through the ACME protocol from a wide range of certificate authorities, renews them automatically before they expire, and deploys each renewed certificate to your hosting targets, all driven from a visual workflow editor in a full web console. It removes the brittle cron scripts and manual copying that certificate management usually relies on.

Certimate ships as a single self-contained Go binary installed at /opt/certimate/certimate and runs as a dedicated unprivileged certimate system account under a systemd service that starts it on boot and restarts it on failure. It is built on PocketBase, so all runtime state, the administrator account, ACME registrations, issued certificates and deploy-target credentials, lives in an embedded database directory at /opt/certimate/pb_data.

Certimate binds to the loopback interface only (127.0.0.1:8090) and is never exposed directly. An nginx reverse proxy publishes the web console on port 80, with realtime streaming enabled so the workflow editor and live views work in the browser. The administrator password is generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password. It is written to /root/certimate-credentials.txt with mode 0600 so that only the root user can read it, and the well-known upstream default password does not work on a launched instance.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 (and 443 if you configure TLS) from the networks that need to reach the console
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Connecting to your instance

Certimate is one product available as an Amazon Machine Image for one or more operating system variants. Each variant has its own default SSH login user. Connect over SSH as the user for the variant you launched:

The rest of this guide is the same across variants: the web console, the workflow editor and the certificate operations are identical whatever base operating system you launched.

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Certimate. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the console. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg Certimate Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=certimate}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Step 3: Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant (see the table above). For the Ubuntu 24.04 variant the login user is ubuntu:

ssh -i your-key.pem ubuntu@<instance-public-ip>

Step 4: Retrieve the Admin Password

Certimate generates a unique administrator password on the first boot of every instance. Read it from the root-only credentials file:

sudo cat /root/certimate-credentials.txt

The file contains the administrator email, the generated password, and the console URL:

certimate.admin_email=admin@certimate.fun
certimate.admin_password=<admin-password>
certimate.console_url=http://<instance-public-ip>/

The account name is admin@certimate.fun and the password is unique to this instance. The well-known upstream default password does not work on a launched instance.

Step 5: Confirm Certimate Is Running

Over SSH, confirm the Certimate server and the nginx proxy are active:

sudo systemctl is-active certimate nginx

Both services report as active:

active
active

Certimate binds to loopback only and is fronted by nginx, so its health endpoint is reachable from the instance over plain HTTP on port 80:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/api/health

HTTP 200

Confirm the installed version:

/opt/certimate/certimate --version

certimate version v0.4.27

You can also confirm the generated administrator credential authenticates against the console API from the instance. This reads the password from the root-only file into a shell variable and never prints it:

PW=$(sudo grep '^certimate.admin_password=' /root/certimate-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'login HTTP %{http_code}\n' -X POST \
  http://127.0.0.1/api/collections/_superusers/auth-with-password \
  -H 'Content-Type: application/json' \
  -d "{\"identity\":\"admin@certimate.fun\",\"password\":\"$PW\"}"

A successful sign-in returns HTTP 200:

login HTTP 200

Step 6: Sign In to the Web Console

Open the console in your browser. Certimate uses relative URLs, so it works directly against the instance public IP with no DNS setup:

http://<instance-public-ip>/

You are presented with the Certimate sign-in page. Enter the administrator email admin@certimate.fun and the password from Step 4.

After signing in you reach the dashboard, which summarises your certificate totals, how many are expiring soon or already expired, your workflow counts, and shortcuts to create a workflow or configure certificate authorities.

Change the administrator password from Settings after your first sign-in.

Step 7: Connect a Certificate Authority and Deploy Targets

Certimate requests certificates through ACME, so before you issue anything you register with a certificate authority. Open Settings and add a certificate authority such as Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com or Actalis. For DNS-01 challenges you also add the credentials for your DNS provider (for example an Amazon Route 53 access key) under Credentials.

Next, add the places you want renewed certificates delivered to. Certimate supports 150+ deploy targets including Kubernetes ingresses, content delivery networks, web application firewalls, load balancers and object storage. Each target is configured once under Credentials and then referenced from your workflows.

Step 8: Build an Issue and Deploy Workflow

Open Workflows and choose Create workflow, then start from the Standard template. The visual editor lays out the standard operating procedure as connected nodes: a Start trigger, an Application node that requests the certificate from your chosen authority, a Deployment node that pushes the issued certificate to your targets, a Notification node on the failure path, and an End node.

Configure the Application node with the domain names to request and the certificate authority to request from, configure the Deployment node with one or more deploy targets, then Publish the workflow. Your workflows are listed under Workflows, where you can activate a schedule, run one on demand, and review its run history.

Once a workflow is active, Certimate re-issues the certificate on schedule and fans each renewal out to every configured target automatically, so a renewed certificate reaches all of your endpoints without manual copying.

Step 9: Expiry Monitoring and Notifications

The dashboard tracks how many certificates are expiring soon or already expired. Add a Notification node to your workflows and configure a channel under Settings (email and popular messaging channels are supported) so Certimate alerts you if an issuance or deployment fails, giving you a safety net before any certificate lapses.

Step 10: Serve the Console over TLS

For production, put the console behind HTTPS. Point a DNS name at the instance, obtain a certificate (you can even use a Certimate workflow to issue one), and add a TLS server block to the bundled nginx configuration at /etc/nginx/sites-available/certimate that listens on 443 and proxies to http://127.0.0.1:8090, then open port 443 in the instance security group. Certimate itself continues to bind loopback only; nginx terminates TLS.

Step 11: Data and Maintenance

All Certimate state lives in the embedded database directory /opt/certimate/pb_data on the instance. Back it up by stopping the service briefly and archiving that directory:

sudo systemctl stop certimate
sudo tar czf /root/certimate-pb_data-backup.tgz -C /opt/certimate pb_data
sudo systemctl start certimate

Keep the operating system patched with your normal update process. Restart the service after any configuration change with sudo systemctl restart certimate.

Support

cloudimg provides 24/7 technical support for this product by email and live chat. Our engineers help with deployment, ACME certificate authority setup, DNS-01 and HTTP-01 challenge configuration, deploy-target integration (Kubernetes, CDNs, WAFs, load balancers, object storage), workflow design, renewal and expiry monitoring, notifications, and TLS setup for the console.

Contact: support@cloudimg.co.uk