Certes is an ACME client runs on .NET 4.5+ and .NET Standard 1.3+, supports ACME v2 and wildcard certificates. It is aimed to provide an easy to use API for managing certificates during deployment processes.
Install Certes nuget package into your project:
Install-Package Certes
or using .NET CLI:
dotnet add package Certes
Creating new ACME account:
var acme = new AcmeContext(WellKnownServers.LetsEncryptStagingV2);
var account = acme.NewAccount("admin@example.com", true);
Place a wildcard certificate order (DNS validation is required for wildcard certificates)
var order = await acme.NewOrder(new[] { "*.your.domain.name" });
Generate the value for DNS TXT record
var authz = (await order.Authorizations()).First();
var dnsChallenge = await authz.Dns();
var dnsTxt = acme.AccountKey.DnsTxt(dnsChallenge.Token);
Add a DNS TXT record to _acme-challenge.your.domain.name
with dnsTxt
value.
For non-wildcard certificate, HTTP challenge is also available
var order = await acme.NewOrder(new[] { "your.domain.name" });
Get the token and key authorization string
var authz = (await order.Authorizations()).First();
var httpChallenge = await authz.Http();
var keyAuthz = httpChallenge.KeyAuthz;
Save the key authorization string in a text file,
and upload it to http://your.domain.name/.well-known/acme-challenge/<token>
Ask the ACME server to validate our domain ownership
await challenge.Validate();
Download the certificate once validation is done
var privateKey = KeyFactory.NewKey(KeyAlgorithm.ES256);
var cert = await order.Generate(new CsrInfo
{
CountryName = "CA",
State = "Ontario",
Locality = "Toronto",
Organization = "Certes",
OrganizationUnit = "Dev",
CommonName = "your.domain.name",
}, privateKey);
Export PFX
var pfxBuilder = cert.ToPfx(privateKey);
var pfx = pfxBuilder.Build("my-cert", "abcd1234");
Check the APIs for more details.
For ACME v1, please see the doc here.
The CLI is available as a dotnet global tool. .NET Core Runtime 2.1+ (currently in preview) is required to use dotnet tools.
To install Certes CLI (you may need to restart the console session if this is the first dotnet tool installed)
dotnet install tool --global dotnet-certes --version 1.0.1-master-812
Use the --help
option to get started
certes --help
or check this AppVeyor script for renewing certificate on Azure webapps.
We use SemVer for versioning. For the versions available, see the tags on this repository.
Also check the changelog to see what's we are working on.