SHSelfHostIndex

acme.sh vs cert-manager

A side-by-side comparison of two self-hosted reverse proxy & gateways options — licensing, setup difficulty, resource needs, and what each one replaces.

Not the right match-up?
AC acme.sh Pure shell ACME client for TLS certificates VS cert-manager Automated TLS certificate management for Kubernetes
Featureacme.shcert-manager
Deploy effortRead-the-docs projectRead-the-docs project
Health score100 · Excellent94 · Excellent
CategoryReverse Proxy & GatewaysReverse Proxy & Gateways
LicenseGPL-3.0Apache-2.0
LanguageShellGo
Setup difficultyEasyMedium
Min. RAM32 MB256 MB
Deploymentbinary, sourcekubernetes, helm
GitHub stars★ 47,695★ 14,087
First released20162017
ReplacesCertbotCertbot

What are acme.sh and cert-manager?

acme.sh

acme.sh is an open-source ACME protocol client implemented entirely in shell script for obtaining and renewing TLS certificates. It has no dependencies and is widely self-hosted on servers and routers.

  • Pure shell implementation
  • No dependencies
  • Many DNS provider APIs
  • Automatic renewal

Read the full acme.sh guide →

cert-manager

cert-manager is an open-source CNCF project that automates the issuance and renewal of TLS certificates in Kubernetes. It integrates with Let's Encrypt and other issuers for self-hosted clusters.

  • Automatic certificate renewal
  • ACME and CA issuers
  • Kubernetes native
  • DNS and HTTP challenges

acme.sh vs cert-manager: key differences

Acme.sh is written in Shell, while cert-manager is built with Go. Licensing differs — GPL-3.0 for acme.sh versus Apache-2.0 for cert-manager. Acme.sh is the lighter option, starting around 32 MB of RAM against 256 MB for cert-manager. Acme.sh has the considerably larger community, at 47,695 GitHub stars versus 14,087.

Why pick each one

Choose acme.sh if…

  • Zero dependencies
  • Huge DNS provider support
  • Runs almost anywhere

Watch out for

  • CLI only
  • Shell scripts to debug
acme.sh details

Choose cert-manager if…

  • Hands-off certificate renewal
  • CNCF graduated project
  • Many issuer integrations

Watch out for

  • Kubernetes only
  • Debugging issuance can be tricky
cert-manager details

Frequently asked questions

Is acme.sh or cert-manager better?

acme.sh is the stronger all-round pick: it has both the larger community and the simpler easy setup. Consider cert-manager if its specific feature set fits your needs better.

Are acme.sh and cert-manager free and open-source?

Yes. acme.sh is licensed under GPL-3.0 and cert-manager under Apache-2.0. Both can be self-hosted at no software cost.

Can I run acme.sh and cert-manager with Docker?

acme.sh: check the project docs for container support. cert-manager: check the project docs for container support.

Which is lighter on resources, acme.sh or cert-manager?

acme.sh has the smaller minimum footprint at 32 MB of RAM, compared to about 256 MB for cert-manager. Real-world usage depends on library size, user count, and enabled features.

Related comparisons