Cert Camel
Guides
In the order you would actually meet them. The first two get a working install watching real certificates; the rest are there when you need them.
-
Install it
Download the release and unzip it, or clone the repository — either way you get one folder and run the setup script. Ten minutes, no installer, nothing written outside the folder. By the end it is watching real certificates and telling you when they expire.
-
Connect your DNS
The step that turns watching into renewing. Cert Camel proves you own a domain by writing a temporary DNS record, so it needs an API credential from whoever hosts your DNS — Cloudflare, Route 53, Azure and about a dozen others.
-
Deploy to HAProxy
Optional, and the part most tools get wrong. Covers the one-time HAProxy change that makes certificate paths stable, why deployment goes through the Data Plane API rather than the runtime socket, and how a pair of nodes behind a shared address is verified individually.
-
Let it run unattended
Four Windows scheduled tasks: renew, check, monthly summary, and keeping the page alive across reboots. What each one is allowed to change, where to find them, and which times are yours to move.
Reference
The full documentation. The first two are the same text that ships inside the tool — denser than the guides above, and written for someone already running it. The security overview is written for deciding whether to.
Read me →
The complete manual: how certificates are grouped, wildcards, certificate authorities, staging, logs and the audit trail, alerts, and every status the page can show you.
How a certificate reaches the wire →
The mechanism end to end: how watched hostnames become certificates, why a wildcard is kept apart from the rest, when renewal actually fires, which crt-list a certificate lands in, and how a node is proved to be serving it rather than merely holding it.
The console certificate →
The certificate the console itself is served with: where it lives on disk, how to put a replacement there by hand, and the ways back in when it stops working — which is exactly when the console cannot tell you anything.
HAProxy setup →
The deployment guide in full, including crt-list handling, verification against individual nodes, and what Cert Camel deliberately never writes to your configuration.
Windows Server install →
Installing where nobody is signed in: which account has to own the scheduled tasks and the encrypted credentials, why that cannot be changed afterwards, and who can open the console once it is running.
Security overview →
What the loopback binding and token actually protect against, how credentials are stored, what reaches the logs and what never does.
Questions people ask first
Does anything need to be reachable from the internet?
No. Renewal proves domain ownership through a DNS record, never by answering a request, so nothing needs a public address, an open port or a hole in a firewall. It works from behind NAT on a home connection.
Do I have to use HAProxy?
No. Watching and renewing work on their own, and plenty of people will want only that — a page that tells them what expires when, and files that renew themselves. Deployment is a separate, optional step that currently supports HAProxy through its Data Plane API.
What does it cost?
Nothing, and the certificates are free too — Let’s Encrypt and other ACME authorities issue at no charge. If you already pay a certificate authority for organisation-validated certificates, Cert Camel can use them instead.
Does it phone home?
No telemetry, no analytics, no CDN. The page loads nothing from the internet, so it works on an isolated network. The only outbound connections it ever makes are to your DNS provider, your certificate authority, your own load balancers, and — when you press Check for updates — GitHub.
What happens if a renewal fails?
It is recorded, it can email you, and the certificate you already have keeps working — renewal starts well before expiry precisely so a failure has room to be noticed and fixed. Every run is written to an append-only audit trail with what changed, who or what triggered it, and whether it worked.
Can I see it before installing anything?
The screenshots through these guides are the real interface, unedited. Beyond that, all of it — every line is on GitHub, MIT licensed, and you can read the whole thing without downloading anything. Security is the honest place to start: what it protects, what it does not, and everything it writes to disk.