Review before mutation
Inspect the exact runtime, native paths, supported configuration, provider mode, and intended certificates before a managed operation begins.
Open-source certificate operations
Operate lego without operating blind.
AcmeMux is a graphical control plane for an existing lego ACME client and its native workspace. Configure supported providers, run constrained certificate operations, schedule renewal evaluation, and understand certificate health from one self-hosted interface.
Initial release qualification in progress for Debian 13 amd64
Certificate health
All current certificates healthy Native inventory observed moments ago- Runtime
- Exact lego build reviewed
- Workspace
- Native files authoritative
- Schedule
- Daily evaluation enabled
- Latest result
- Completed and redacted
Illustrative interface. AcmeMux never copies private keys into its own database.
Native workspaceNo second certificate store
Upstream legoNo ACME protocol reimplementation
No telemetryNo analytics or tracking identifiers
Apache 2.0Open source with practical terms
Why AcmeMux
Automation should remove toil, not evidence.
ACME clients make certificate issuance repeatable. Day-two operation still leaves important questions: Which binary is running? Which workspace will change? Are credentials scoped correctly? Did renewal change anything? What happens after a restart? AcmeMux turns those questions into reviewed state instead of shell history.
Constrain execution
AcmeMux invokes the selected lego executable directly. It does not expose a shell, arbitrary commands, inherited environments, or unrestricted hook execution.
Keep ownership clear
lego remains responsible for ACME behavior, accounts, certificates, keys, archives, and renewal decisions. AcmeMux manages neither a competing protocol stack nor a shadow workspace.
Recover conservatively
Durable operation state, bounded output, redaction, workspace coordination, and restart handling help distinguish completed, failed, interrupted, partial, and ambiguous outcomes.
One operational path
From an existing workspace to understandable renewal.
- 1
Bring your trusted lego runtime
Install an exact supported Linux amd64 lego executable. AcmeMux verifies its path, digest, build identity, ownership, permissions, and capabilities before adoption.
- 2
Adopt or create native configuration
Connect one native lego workspace. Typed forms update supported YAML and restrictive credential files while unknown or unsafe fields remain visible and block managed execution.
- 3
Evaluate certificates safely
Run a reviewed whole-workspace operation manually or on one durable daily schedule. lego still applies ACME Renewal Information, lifetime rules, provider behavior, and renewal eligibility.
- 4
Read the outcome
Refresh native inventory and inspect certificate health, exact expiration evidence, runtime identity, provider selection, and the latest bounded secret-redacted result.
Curated compatibility
Useful coverage without pretending every compiled option is safe.
AcmeMux supports a deliberately reviewed subset of lego. A provider being compiled into lego does not automatically make it supported in the AcmeMux interface.
Certificate authorities
DNS-01 providers
Challenge modes
Trusted-host security
The interface is convenient. The boundary stays strict.
Certificate automation handles DNS credentials, account keys, certificate private keys, and authority over public names. AcmeMux treats the host and service identity as security boundaries, not implementation details.
Understand the security model- Loopback application listener behind administrator-managed HTTPS
- Single administrator with Argon2id password protection
- Hashed, rotating, expiring, and revocable sessions
- No product telemetry, crash reporting, or tracking identifiers
- Secret-aware output limits and repeated redaction
- Hardened non-root systemd service on Debian 13 amd64
Build operational understanding
Practical ACME guidance, not search-engine filler.
AcmeMux documentation and learning material explain the boundaries that matter when certificate automation moves from a one-line command to a service you rely on.
Foundation
ACME DNS-01 challenge explained
How TXT-record validation works, why it enables wildcard certificates, and how to limit DNS credentials.
Operations
Operating the lego ACME client safely
Workspace ownership, scheduling, credential handling, and what a control plane should preserve.
Reliability
Renewal without hidden failure
Design around ARI, propagation, atomic deployment, observation, restart safety, and ambiguous outcomes.
Direct answers
Frequently asked questions
Is AcmeMux an ACME client?
No. AcmeMux is a graphical control plane for an administrator-provisioned upstream lego client. lego continues to implement ACME and DNS-provider protocols.
Does AcmeMux store certificate private keys?
Not in its application database. Accounts, certificates, chains, keys, archives, and configuration remain in the adopted native lego workspace.
Can AcmeMux issue wildcard certificates?
Yes, when the certificate uses a supported DNS-01 provider. Wildcard validation cannot use HTTP-01.
Does AcmeMux deploy certificates to web servers?
No. Certificate deployment, service reloads, notifications, and arbitrary hooks are outside the current product boundary. Keep deployment automation separate and tightly scoped.
Which Linux distributions are supported?
The initial qualified platform is Debian 13 amd64 using the supplied source-built systemd installation. Success elsewhere does not imply support.
Does the website or product track usage?
No. AcmeMux collects no analytics, usage telemetry, crash reports, or tracking identifiers. This website also runs without analytics or advertising.
Native files remain authoritative