Certes 5.0.0-beta.1

This is a prerelease version of Certes.

dotnet add package Certes --version 5.0.0-beta.1

NuGet\Install-Package Certes -Version 5.0.0-beta.1

This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.

<PackageReference Include="Certes" Version="5.0.0-beta.1" />

For projects that support PackageReference, copy this XML node into the project file to reference the package.

<PackageVersion Include="Certes" Version="5.0.0-beta.1" />
                    

                            Directory.Packages.props

<PackageReference Include="Certes" />
                    

                            Project file

For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.

paket add Certes --version 5.0.0-beta.1

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

#r "nuget: Certes, 5.0.0-beta.1"

#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.

#:package Certes@5.0.0-beta.1

#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.

#addin nuget:?package=Certes&version=5.0.0-beta.1&prerelease
                    

                            Install as a Cake Addin

#tool nuget:?package=Certes&version=5.0.0-beta.1&prerelease
                    

                            Install as a Cake Tool

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

Certes

Certes is an ACME client library for .NET. It creates accounts, places orders, completes HTTP-01, DNS-01 and TLS-ALPN-01 challenges, and exports issued certificates as PEM or PFX.

Supported targets: net10.0, net8.0 and netstandard2.0.

New in 5.0.0-beta.1

Core async APIs now accept an optional CancellationToken, propagated through HTTP requests, retries, pagination, downloads, and polling. Recompile consumers: the additional parameter changes binary signatures. Custom interface implementations, mocks, and method-group delegates also need updating.

Cancellation does not roll back requests accepted by a CA or interrupt synchronous cryptographic work. See the v5 upgrade guide for migration and recovery details. This is a prerelease; DNS-PERSIST-01 is not included, and public-CA interoperability has not been re-verified for this beta.

dotnet add package Certes --version 5.0.0-beta.1

New in 4.1

ACME Renewal Information (ARI, RFC 9773): retrieve suggested renewal windows and create replacement orders.
Discover certificate profiles and select a profile when creating an order.
Order certificates for IPv4 and IPv6 addresses (RFC 8738), with IP subject alternative names in CSRs and TLS-ALPN validation certificates.

These features require support from the ACME server. See the API guide for usage and challenge requirements.

Getting started

var acme = new AcmeContext(WellKnownServers.LetsEncryptStagingV2);
var account = await acme.NewAccount("admin@example.com", true);
var order = await acme.NewOrder(new[] { "example.com" });

Test against a staging CA before using a production CA.

Documentation

The dotnet-certes package provides a command-line tool built on this library.

Licensed under the MIT license.

Product	Compatible and additional computed target framework versions.
.NET	net5.0 was computed. net5.0-windows was computed. net6.0 was computed. net6.0-android was computed. net6.0-ios was computed. net6.0-maccatalyst was computed. net6.0-macos was computed. net6.0-tvos was computed. net6.0-windows was computed. net7.0 was computed. net7.0-android was computed. net7.0-ios was computed. net7.0-maccatalyst was computed. net7.0-macos was computed. net7.0-tvos was computed. net7.0-windows was computed. net8.0 is compatible. net8.0-android was computed. net8.0-browser was computed. net8.0-ios was computed. net8.0-maccatalyst was computed. net8.0-macos was computed. net8.0-tvos was computed. net8.0-windows was computed. net9.0 was computed. net9.0-android was computed. net9.0-browser was computed. net9.0-ios was computed. net9.0-maccatalyst was computed. net9.0-macos was computed. net9.0-tvos was computed. net9.0-windows was computed. net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed.
.NET Core	netcoreapp2.0 was computed. netcoreapp2.1 was computed. netcoreapp2.2 was computed. netcoreapp3.0 was computed. netcoreapp3.1 was computed.
.NET Standard	netstandard2.0 is compatible. netstandard2.1 was computed.
.NET Framework	net461 was computed. net462 was computed. net463 was computed. net47 was computed. net471 was computed. net472 was computed. net48 was computed. net481 was computed.
MonoAndroid	monoandroid was computed.
MonoMac	monomac was computed.
MonoTouch	monotouch was computed.
Tizen	tizen40 was computed. tizen60 was computed.
Xamarin.iOS	xamarinios was computed.
Xamarin.Mac	xamarinmac was computed.
Xamarin.TVOS	xamarintvos was computed.
Xamarin.WatchOS	xamarinwatchos was computed.

Compatible target framework(s)

Included target framework(s) (in package)

Learn more about Target Frameworks and .NET Standard.

.NETStandard 2.0
- BouncyCastle.Cryptography (>= 2.7.0)
- System.Text.Json (>= 9.0.1)
net10.0
- BouncyCastle.Cryptography (>= 2.7.0)
net8.0
- BouncyCastle.Cryptography (>= 2.7.0)

NuGet packages (37)

Showing the top 5 NuGet packages that depend on Certes:

Package	Downloads
LettuceEncrypt Provides API for configuring ASP.NET Core to automatically generate HTTPS certificates. This configures your server to use the ACME protocol to connect with a certificate authority (CA), such as Let's Encrypt (https://letsencrypt.org), to verify ownership of your domain name and generate a HTTPS certificate. This happens automatically when the server starts up, and will renew the certificate automatically when the expiration date is near. This only works with Kestrel, which is the default server configuration for ASP.NET Core projects. Other servers, such as IIS and nginx, are not supported.	651.9K
uwap.WebFramework Cross-platform .NET library written in C# that allows you to create a web server for dynamic and/or static websites and web apps with ease.	278.2K
FluffySpoon.AspNet.LetsEncrypt Package Description	188.0K
LagoVista.Net.LetsEncrypt Provides Middleware and services to request and store certificates from the Let's Encrypt service for ASP.NET Core applications	129.4K
DH.LettuceEncrypt 用于DH框架的Let's Encrypt生成库。参考https://github.com/natemcmaster/LettuceEncrypt	122.6K

GitHub repositories (11)

Showing the top 11 popular GitHub repositories that depend on Certes:

Repository	Stars
natemcmaster/LettuceEncrypt Free, automatic HTTPS certificate generation for ASP.NET Core web apps	1.7K
sjkp/letsencrypt-siteextension Azure Web App Site Extension for easy installation and configuration of Let's Encrypt issued SSL certifcates for custom domain names.	739
junkai-li/NetCoreKevin 🤖基于.NET搭建的企业级中台AI知识库智能体开源架构：AISkills技能管理、AI语音电话模式、智能体记忆、AI-Qdrant知识库、知识库重排模型、AI联网搜索、多智能体协同、聊天记录压缩策略、智能体权限管控、AgentFramework、RAG检索增强、本地Ollama AI模型调用、智能体技能可控加载、领域事件、一库多租户、Log4、Jwt、CAP、SignalR、Mcp、Hangfire、RabbitMQ、前端（Vue + Ant Design）	527
Maarten88/rrod Exploring a new web architecture with React, Redux, Orleans and Dotnet Core	385
ffMathy/FluffySpoon.AspNet.EncryptWeMust	153
ark-mod/ArkBot ARK Survival Evolved application that monitors and extracts data from local ARK servers and exposes this data through a Web App, Web API and Discord Bot. Provides important functions to players: dino listings, food-status, breeding info, statistics; and server admins: rcon-commands, server managing etc.	134
kl3mta3/SphereSSL Web-powered SSL certificate manager with DNS integration, auto-renewals, and cert tracking. It's like if Certbot and ZeroSSL had a baby. Certbot but more friendly, smarter, and with a dashboard.	126
NethermindEth/dotnet-libp2p A libp2p implementation for .NET in C#.	126
aloopkin/WinCertes An ACMEv2 client for Windows	122
sjkp/letsencrypt-azure The easiest way to use lets encrypt certificates on Azure	113
stratdev3/SimpleW Lightweight Web Server for .NET. Simple by design. Standalone or embedded.	104

Version	Downloads	Last Updated
5.0.0-beta.1	75	9/29/2026
4.1.0	3,898	9/27/2026
4.0.0	908	9/23/2026
4.0.0-beta.1	65	9/23/2026
3.0.4	1,390,873	1/4/2023
3.0.3	339,497	10/4/2021
3.0.0	194,516	7/18/2021
2.3.4	709,145	3/27/2020
2.3.3	407,153	12/17/2018
2.3.2	86,611	10/20/2018
2.3.1	12,704	10/16/2018
2.3.0	32,087	6/15/2018
2.2.2	13,552	5/31/2018
2.2.1	13,617	5/15/2018
2.2.0	14,344	5/5/2018

First v5 prerelease, focused on cancellable library operations and CLI commands.
DNS-PERSIST-01 is not included. See the
[v5 upgrade guide](https://github.com/fszlin/certes/blob/v5.0.0-beta.1/docs/v5-upgrade.md)
before upgrading. Public-CA interoperability has not been re-verified for this
prerelease; automated issuance checks use the local Pebble test CA.

### Breaking changes
- Core asynchronous interfaces, implementations, and convenience extensions now
accept a final optional `CancellationToken`. This replaces the old signatures:
recompile consumers and update custom implementations, mocks, callbacks, and
method-group delegates. Most ordinary calls continue to compile unchanged.
Library target frameworks and runtime dependency minimums are unchanged.

### Added
- Cancellation throughout ACME discovery, HTTP requests, bad-nonce retries,
authorization lookups, order pagination, alternate-chain downloads, and polling
delays ([#299](https://github.com/fszlin/certes/issues/299)). Cancellation is
cooperative and does not interrupt synchronous cryptographic operations or roll
back requests already accepted by a CA.
- CLI Ctrl+C cancellation with exit code **130**; success remains **0** and
parsing/operation errors remain **1**. A second Ctrl+C permits immediate process
termination. HTTP timeouts remain operation errors, not user cancellations.

### Changed
- Upgrade the CLI to Spectre.Console.Cli 0.55.0 and asynchronous dispatch
([#405](https://github.com/fszlin/certes/issues/405)), preserving command names,
options, and normal JSON result shapes.
- With explicit `--out`, `account new` saves the account key before requesting
account creation, and `order finalize` saves a newly generated certificate key
before sending the CSR. Existing output files are atomically replaced before
sending; the saved file remains even when the subsequent request fails or is
cancelled. Use dedicated output paths and retain the keys for recovery.
- When account/order creation succeeds but cancellation stops the follow-up
resource lookup, the CLI emits the returned `location` in JSON and exits 130.
Requests cancelled before a response arrives still require reconciliation with
the CA. Without explicit key output, in-flight cancellation can still lose a
generated key; see the upgrade guide for persistence and recovery limits.
- Refresh CLI/build/test dependencies and add Linux unit-coverage reporting and
CodeQL analysis. Retire the obsolete Azure Functions integration-test helper;
integration tests use local Pebble.

### Fixed
- Preserve complete ACME responses and terminal protocol errors when cancellation
arrives late, including account/order locations and successful account key
changes. Cancelled discovery does not cache a cancelled task.

Full changelog: https://github.com/fszlin/certes/blob/v5.0.0-beta.1/docs/CHANGELOG.md