gapcert

Publicly-trusted TLS certificates for machines the internet can't reach.

gapcert issues real, publicly-trusted certificates over ACME DNS-01 — the validation method that checks a TXT record on public DNS instead of connecting to your server. The host receiving the certificate never needs an inbound path from the internet. It only needs someone, somewhere with outbound access to talk to the CA and your DNS provider — and that someone doesn't have to be the airgapped box.

Four ways to reach the certificate authority

Pick the one that matches how much network your fleet has.

Mode	For hosts that…	The tool
Standalone	have outbound internet access	one binary, like certbot
Broker + agents	can reach a DMZ service but not the internet	gapcertd + gapcert agent
Wildcard distribution	should share one *.zone cert (and stay out of CT logs)	broker-held shared key
Offline courier	have no network path at all	signed bundles on removable media

Across every mode, per-host private keys are generated locally and never transit the network — only CSRs travel.

Why DNS-01

certbot's default (HTTP-01) needs the CA to reach your server on port 80 — impossible for internal hosts. DNS-01 never touches the target machine: the CA only checks _acme-challenge.<name> on public DNS. So the machine getting the certificate can live on a private network, behind split-horizon DNS, or on no network at all.

Wildcards require DNS-01 anyway, and a *.internal.example.com certificate keeps your internal hostnames out of the public Certificate Transparency logs that every per-host certificate is published to. See the security model for the trade-offs.

Get started

New to gapcert? Start with the quickstart. Choosing a deployment shape? Read the modes overview.

$ gapcert
gapcert — certificates for airgapped and egress-restricted systems

Usage:
  gapcert issue  [-config FILE] [-force] [NAME ...]   obtain certificates now
  gapcert renew  [-config FILE] [-force] [NAME ...]   renew certificates that are due
  gapcert status [-config FILE]                       show stored certificates and expiry
  gapcert agent   <enroll|obtain|renew|status> ...    broker-backed mode
  gapcert courier <init|pair|export|run|import> ...   offline zero-egress mode
  gapcert version                                     print version

gapcert is written in Go and ships as two static binaries — gapcert (agent / standalone / courier) and gapcertd (broker) — so an airgapped host needs no runtime installed.