Modern ACME for Modern PHP
Look, you need TLS certs. You don't need another weekend reading RFC 8555. CoyoteCert is a PHP 8.3+ client that talks ACME to Let's Encrypt, ZeroSSL, Buypass, and anyone else with a compliant directory. It issues. It renews. It revokes. It does not explode at 3am.
No global state. No shelling out to certbot and praying. No 600-line configs. Just a PHP library that speaks ACME to any compliant CA and then gets out of your hair.
HTTP challenge? Built in. DNS-01 for wildcards? Cloudflare, Route 53, DigitalOcean, ClouDNS, Hetzner already packed in. Running something weirder? Three methods to implement — supports, deploy, cleanup — and you're certified.
Comes with a CLI for issuing and renewing. Not a PHP person? Still fine. Drop vendor/bin/coyote issue in cron. Idempotent, atomic, skips what isn't due. There is no separate renew command — issue handles both. Run it every hour. The CA won't even notice.
Accounts, orders, authorizations, finalization. Nonces, replay protection, JWS signing. All the boring plumbing happens inside the library. You just ask for a cert.
PHP 8.3 readonly classes. Enums for every state. Return types everywhere. Your IDE knows what it's doing, and so will you.
P-256, P-384, P-521 or honest 2048 to 4096 bit RSA. Store them on disk, in Vault, in KMS, in a cigar box. One interface, one method.
Every request, challenge poll, and retry goes through a logger you hand us. When something goes sideways you get receipts.
Point it at a CA. Hand it a domain and a solver. Get back a fullchain and a private key. That's the whole show. The paperwork is hiding in the basement where it belongs.
Certificate object. Not a sack of PEM you have to shake out.use CoyoteCert\CoyoteCert; use CoyoteCert\Provider\LetsEncrypt; use CoyoteCert\Storage\FilesystemStorage; use CoyoteCert\Challenge\Dns\CloudflareDns01Handler; $cert = CoyoteCert::with(new LetsEncrypt()) ->storage(new FilesystemStorage('/var/certs')) ->identifiers(['example.com', '*.example.com']) ->email('[email protected]') ->challenge(new CloudflareDns01Handler(apiToken: 'your-api-token')) ->issueOrRenew();
If it speaks ACME v2, CoyoteCert will chat. Swap the directory URL. Keep your code. Life's short.
Cloudflare, Route 53, DigitalOcean are already in there. Running something else? Implement supports, deploy, and cleanup and ship it.
First-party package. Facade, Artisan commands, HTTP-01 over the cache store (no nginx changes needed), and a daily scheduled renewal task. Zero boilerplate beyond publishing the config.
coyotecert-laravel on GitHub →use Blendbyte\CoyoteCertLaravel\Facades\Cert; Cert::for('example.com')->issueOrRenew();
We ordered from every supplier so you don't have to. Here's what actually shipped.
| CoyoteCert | ACMECert | acmephp | kelunik/acme | yaac | |
|---|---|---|---|---|---|
| ARI (RFC 9773) | ✓ | ✓ | ✗ | ✗ | ✗ |
| EAB auto-provisioning 1 | ✓ | manual | manual | ✗ | ✗ |
| IP SANs (RFC 8738) | ✓ | ✓ | ✗ | ✗ | ✗ |
| TLS-ALPN-01 | ✓ | ✓ | ✗ | ✗ | ✗ |
| Built-in DNS providers | 6 | none | 3 | none | none |
| CLI shipped with package | ✓ | ✗ | ✓ | ✗ | ✗ |
| Laravel integration | ✓ | ✗ | ✗ | ✗ | ✗ |
¹ CoyoteCert fetches EAB credentials directly from your ZeroSSL API key (no copy-pasting tokens). "manual" means EAB is supported but credential wrangling is on you.
Cells verified from each library's public repository, May 2026. Wrong? Open a PR. We check before merging.
Composer, the way nature intended. No weird PECL extensions. Just OpenSSL.
$ composer require blendbyte/coyotecert
Test on staging. Flip to prod when it stops crashing. (It won't.)
CoyoteCert::with(new LetsEncrypt())->issueOrRenew();
Skip the PHP script. Slap the CLI in cron. Done. There is no renew command — issue handles both.
0 * * * * vendor/bin/coyote issue --identifier example.com --webroot /var/www/html --provider letsencrypt --storage /etc/certs --email [email protected]
Answers to the questions that send people to GitHub issues at 2am. We've been there. Here's what actually fixes it.
nginx found it first. nginx always finds it first, and not in a helpful way.
Your location / block swallows the request before it reaches .well-known/acme-challenge/. Add a dedicated block above everything else:
location ^~ /.well-known/acme-challenge/ {
root /var/www/html;
default_type text/plain;
}
The ^~ prefix stops nginx from even considering regex locations once this prefix matches. Apache users: check that AllowOverride None is not blocking the directory, and that no .htaccess rule is redirecting HTTP to HTTPS before the token can be served.
Sometimes. If Always Use HTTPS is enabled, the 80-to-443 redirect fires before the token is ever served and the CA gets a redirect instead of a token.
Easiest fix: switch to DNS-01. Cloudflare is a built-in DNS provider, so it is a one-line handler swap and the orange cloud stays orange.
Committed to HTTP-01? Grey-cloud the record (DNS only) during issuance, then flip it back. Cloudflare's proxy can be asked to step aside briefly. It doesn't like it, but it cooperates.
Missing storage, or the storage path changes between runs. Without a storage backend, needsRenewal() always returns true because there is nowhere to check what you already have. Like a dog who has never seen a ball before. Every single time.
->storage(new FilesystemStorage('/etc/coyotecert'))
Same path, every run. If you are using DatabaseStorage, confirm the connection points at the same database as last time and not your staging environment.
Yes, but DNS-01 only. RFC 8555 forbids wildcard validation over HTTP-01 or TLS-ALPN-01. That is not a CoyoteCert limitation. It is a rule carved into the RFC the same way the ACME Corporation name was stamped into every box of defective rocket skates.
->identifiers(['*.example.com', 'example.com']) ->challenge(new CloudflareDns01Handler(...))
*.example.com covers subdomains but not the apex itself, so include both if you need the root. And *.*.example.com is not a thing. The exception message will remind you of this fact.
Use LetsEncryptStaging. The certificates are not browser-trusted but the full ACME handshake is byte-for-byte identical to production. Hammer it as many times as you need.
$coyote = CoyoteCert::with(new LetsEncryptStaging())
// ... rest of your config
When everything looks good, swap to LetsEncrypt and issue once for real. Do not skip staging and go straight to production. Someone does this every time, and they always end up filing a rate limit issue on GitHub.
Yes. Use DatabaseStorage with a shared database, or FilesystemStorage on a shared volume. File locking is safe across concurrent processes, so two servers racing to issueOrRenew() at the same time will not corrupt anything. They end up holding the same certificate, which is the civilised outcome.
->storage(new DatabaseStorage($sharedPdo))
One account key per CA, shared by however many servers you run.
MIT licensed. Barely any dependencies. Ready whenever your next deploy is.