Modes overview

gapcert has one ACME DNS-01 core and four transports around it. They differ only in where the credentials live and how the request reaches the CA.

Choosing

Does the host that needs the cert have outbound internet?
├─ yes ─────────────────────────────────────────► Standalone
└─ no
   ├─ can it reach a DMZ service on your network?
   │  ├─ yes, one cert per host ─────────────────► Broker + agents
   │  └─ yes, share one *.zone cert ─────────────► Wildcard distribution
   └─ no network path at all ────────────────────► Offline courier

At a glance

	Standalone	Broker + agents	Wildcard	Courier
Host needs internet	yes	no	no	no
DNS/ACME creds live on	the host	the broker	the broker	the outside companion
Per-host key stays local	yes	yes	shared key	yes
Transport	direct	mTLS	mTLS	signed bundles on media
Binary	gapcert	gapcertd + gapcert agent	gapcertd + gapcert agent	gapcert courier

What's shared

• Keys never transit the network. Except the wildcard case (one key shared by design), every private key is generated on the host that will use it and only a CSR travels.
• DNS-01 only. The CA validates a public TXT record; the target host is never contacted. The recommended setup delegates that TXT record to a throwaway challenge zone so no credential can touch production DNS.
• Deploy hooks + renewal. Every mode can run a hook after (re)issue and is meant to be driven on a schedule.
• Default-deny. The broker and the courier companion refuse any name not explicitly permitted by policy.

Read the security model for the trust boundaries and honest residual risks of each mode.