Skip to content
golang autocert library for letsencrypt
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
examples cleanup: revert import path Mar 25, 2019
LICENSE Initial commit Mar 5, 2018
config.go added a warning if errorHandler is not set, added a note on using wil… Feb 25, 2019
renew.go fix: replace lego xenolf import with go-acme Mar 25, 2019
simplecert.go fix: replace lego xenolf import with go-acme Mar 25, 2019
utils.go cleanup, added ListenAndServeTLSCustom Feb 22, 2019

     _                 _                    _
 ___(_)_ __ ___  _ __ | | ___  ___ ___ _ __| |_
/ __| | '_ ` _ \| '_ \| |/ _ \/ __/ _ \ '__| __|
\__ \ | | | | | | |_) | |  __/ (_|  __/ |  | |_
|___/_|_| |_| |_| .__/|_|\___|\___\___|_|   \__|

Golang Library for automatic LetsEncrypt SSL Certificates

Go Report Card License Golang Linux macOS windows GoDoc

Obtains certificates automatically, and manages renewal and hot reload for your Golang application. It uses the LEGO Library to perform ACME challenges, and the mkcert utility to generate self-signed trusted certificates for local development.

Main goals:

  • ease of use: simplicity and integration with go standard library
  • transparency: products of intermediate steps are preserved, dedicated logfile for simplecert
  • flexibility: configurable design and cross platform support

UPDATE: The vendored lego version has been updated to v2.2.0 and now supports issuing wildcard certificates by using ACMEv2 challenges.

You need to supply the following data to simplecert: Domains, Contact Email and a Directory to store the certs in (CacheDir). On startup, call the simplecert.Init() function and pass your config. You will receive a certReloader instance, that has a GetCertificateFunc to allow hot reloading the cert upon renewal. See Usage for a detailed example.

A new certificate will be obtained automatically if the domains have changed, both in local and in production mode.

For more advanced usage, see the config section for all configuration options.



go get -u -v


Simplecert provides a few wrappers similar to http.ListenAndServe from the go standard library:

For running on a production server:

func ListenAndServeTLS(addr string, handler http.Handler, mail string, domains ...string) error

For local development:

func ListenAndServeTLSLocal(addr string, handler http.Handler, domains ...string) error

The custom wrapper allows to pass a simplecert.Config and a tls.Config:

func ListenAndServeTLSCustom(addr string, handler http.Handler, cfg *Config, tlsconf *tls.Config, domains ...string) error

There is a util for redirecting HTTP requests to HTTPS:

func Redirect(w http.ResponseWriter, req *http.Request)

Local Development

To make local development less of a pain, simplecert integrates mkcert, to obtain self signed certificates for your desired domains, trusted by your computer.

Follow the installation instructions to install the mkcert commandline tool.

In order to use simplecert for local development, set the Local field in the config to true.

Certificates generated for local development are not checked for expiry, the certificates generated by mkcert are valid for 10 years!


Using wildcard certificates in local mode does not work out of the box, since /etc/hosts doesn't support resolving wild card entries.

You'll have to use other services like dnsmasq. Just edit dnsmasq.conf and add the following line:


This will resolve all requests to domains that end on with

Host Entries

To resolve the domain name for your certificate to your localhost, simplecert adds an entry for each domain name to your /etc/hosts file.

This can be disabled by setting the UpdateHosts field in the config to false.


Simplecert has a default configuration available: simplecert.Default

You will need to update the Domains, CacheDir and SSLEmail and you are ready to go.

// do the cert magic
cfg := simplecert.Default
cfg.Domains = []string{"", ""}
cfg.CacheDir = "/etc/letsencrypt/live/"
cfg.SSLEmail = ""
cfg.DNSProvider = "cloudflare"
certReloader, err := simplecert.Init(cfg)
if err != nil {
    log.Fatal("simplecert init failed: ", err)

// redirect HTTP to HTTPS
// CAUTION: This has to be done AFTER simplecert setup
// Otherwise Port 80 will be blocked and cert registration fails!
log.Println("starting HTTP Listener on Port 80")
go http.ListenAndServe(":80", http.HandlerFunc(redirect))

// init strict tlsConfig with certReloader
// you could also use a default &tls.Config{}, but be warned this is highly insecure
tlsconf := tlsconfig.NewServerTLSConfig(tlsconfig.TLSModeServerStrict)

// now set GetCertificate to the reloaders GetCertificateFunc to enable hot reload
tlsconf.GetCertificate = certReloader.GetCertificateFunc()

// init server
s := &http.Server{
    Addr:      ":443",
    TLSConfig: tlsconf,

// lets go
log.Fatal(s.ListenAndServeTLS("", ""))


Simplecert uses the letsencrypt ACMEv2 API and supports HTTP, TLS and DNS Challenges.

For the DNS challenge, an API token of an provider must be exported as environment variable.

Graceful service shutdown and restart

In case of using the HTTP or TLS challenges, port 80 or 443 must temporarily be freed.

The simplecert.Config contains to functions that can be set to accomplish this:

  • WillRenewCertificate, called just before the certificate will be renewed.
  • DidRenewCertificate, called after the certificate was renewed.

These functions can be used to gracefully stop the running service, and bring it back up once the certificate renewal is complete.

If you want to exchange the certificates on disk and force the running service to reload them, simply send a SIGHUP signal to your running instance:

kill -HUP <pid>

Backup mechanism

Simplecert creates a backup of your old certificate when it is being renewed.

All data is stored in the configured CacheDir.

In case something goes wrong while renewing, simplecert will rollback to the original cert.


You can pass a custom simplecert.Config to suit your needs.

Parameters are explained below.

// Config allows configuration of simplecert
type Config struct {

    // renew the certificate X hours before it expires
    // LetsEncrypt Certs are valid for 90 Days
    RenewBefore int

    // Interval for checking if cert is closer to expiration than RenewBefore
    CheckInterval time.Duration

    // SSLEmail for contact
    SSLEmail string

    // ACME Directory URL. 
    // Can be set to for testing
    DirectoryURL string

    // Endpoints for webroot challenge
    // CAUTION: challenge must be received on port 80 and 443
    // if you choose different ports here you must redirect the traffic
    HTTPAddress string
    TLSAddress  string

    // UNIX Permission for the CacheDir and all files inside
    CacheDirPerm os.FileMode

    // Domains for which to obtain the certificate
    Domains []string

    // Path of the CacheDir
    CacheDir string

    // DNSProvider name for DNS challenges (optional)
    // see:
    DNSProvider string

    // Local runmode
    Local bool

    // UpdateHosts adds the domains to /etc/hosts if running in local mode
    UpdateHosts bool

    // Handler funcs for graceful service shutdown and restoring
    WillRenewCertificate func()
    DidRenewCertificate  func()
    FailedToRenewCertificate func(error)


The examples directory contains two simple use cases.

A custom initialization:

go run examples/custom/main.go

And a simple example for local development:

go run examples/simple/main.go


Simplecert writes all its logs to the simplecert.log file inside the configured cache directory.



You can’t perform that action at this time.