ToolJet
ToolJet bundles its MCP server into the EE image as AI builder features land in the LTS track
Comparison · Infra & APIs
Certbot vs werf
A side-by-side editorial comparison of Certbot and werf — release velocity, themes, recent moves, and the top alternatives to consider.
Shared themes:devtools
Certbot vs werf: at a glance
What is Certbot?
Certbot is consolidating its plugin architecture and quietly expanding into IP address certificate support.
Certbot is in a steady maintenance and architectural consolidation phase. The nginx and apache plugins have been moved into the core certbot package as private modules (certbot-apache and certbot-nginx now exist primarily to register the plugin), the OCSP module is deprecated, and pyOpenSSL dependencies are being systematically removed in favor of the cryptography library. Version 5.8.0 bumped the cryptography floor to >=47.0.0 and fixed a bug where removed domains were omitted from renewal confirmation prompts — a correctness issue for users who remove SANs from existing certificates.
What is werf?
werf ships weekly across two tracks — v3 dev gets JSON Schemas and Harbor v2 fixes, v2 alpha gets the backports.
werf operates two active release channels in parallel: v3.x ("dev") for new capabilities and v2.x ("alpha") for stabilized backports. The September 2026 sprint covers v3.3–v3.5 and v2.78–v2.79, with several meaningful improvements — JSON Schema publication for werf config files, a netavark networking requirement replacing CNI/slirp4netns, and a Harbor registry fix that clears a real registry-compatibility issue. The dual-track cadence lets teams stay on the stable alpha channel while the dev track absorbs the larger changes.
Certbot vs werf: editorial side-by-side
Certbot
2.5INFRA · APIS
Certbot is consolidating its plugin architecture and quietly expanding into IP address certificate support.
◆ Current state
Certbot is in a steady maintenance and architectural consolidation phase. The nginx and apache plugins have been moved into the core certbot package as private modules (certbot-apache and certbot-nginx now exist primarily to register the plugin), the OCSP module is deprecated, and pyOpenSSL dependencies are being systematically removed in favor of the cryptography library. Version 5.8.0 bumped the cryptography floor to >=47.0.0 and fixed a bug where removed domains were omitted from renewal confirmation prompts — a correctness issue for users who remove SANs from existing certificates.
◆ Where it's heading
The architectural direction is a leaner, more self-contained core with fewer external dependencies. The IP address issuance capability added across the 5.3-5.4 cycle reflects Let's Encrypt's expanding IP certificate program — Certbot is tracking the CA's capabilities rather than driving its own feature agenda. The pyOpenSSL removal, when complete, will eliminate a long-standing external dependency that complicated builds and tested certification paths.
◆ Prediction
pyOpenSSL removal will complete in a future major release. IP address certificate workflows will mature as Let's Encrypt's IP cert program broadens. The certbot-nginx/certbot-apache split (now thin wrappers over the core package) may eventually collapse entirely.
werf
5.0INFRA · APIS
werf ships weekly across two tracks — v3 dev gets JSON Schemas and Harbor v2 fixes, v2 alpha gets the backports.
◆ Current state
werf operates two active release channels in parallel: v3.x ("dev") for new capabilities and v2.x ("alpha") for stabilized backports. The September 2026 sprint covers v3.3–v3.5 and v2.78–v2.79, with several meaningful improvements — JSON Schema publication for werf config files, a netavark networking requirement replacing CNI/slirp4netns, and a Harbor registry fix that clears a real registry-compatibility issue. The dual-track cadence lets teams stay on the stable alpha channel while the dev track absorbs the larger changes.
◆ Where it's heading
werf's dev track is progressively expanding its deploy primitives: renderPatches support, returning rendered resources from ReleaseInstall, and authenticated secret write capability (v3.3.0) all suggest a push toward more programmable, auditable deploy pipelines. The embedded Deno binary in v3.2.0 — bundled behind a feature gate — hints at scripted deployment hooks as a coming capability. JSON Schemas for werf config files make editor tooling a first-class citizen.
◆ Prediction
The Deno embedding will likely surface as a supported scripting API for pre/post-deploy hooks in the next major dev release. A corresponding migration of Helm-centric users toward werf's native deploy primitives appears to be the longer arc.
Alternatives to Certbot and werf
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Certbot or werf.
GitHub
GitHub adds Claude Opus 5.5 and GPT-6 models while shipping sandboxed agent execution
Parse Server
Parse Server patches three security CVEs: GraphQL disclosure and protectedFields bypass
Buildkite
Buildkite ships Agent v4, an MCP server for AI-native CI, and a VS Code extension in a dense September push.
Jackett
Jackett's daily tracker churn adds 11 new APIs and formalizes its security policy in a week
Chromatic
Chromatic ships Vitest Browser Mode and React Native visual testing, moving beyond Storybook
See all Certbot alternatives → · See all werf alternatives →
Recent activity from Certbot and werf
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 15h agowerfwerf v3.5.0: JSON Schema for config files, Harbor v2 fix, build report versioning
- 1d agowerfwerf v2.79.0 alpha: backport build reporting and deploy fixes from v3.5.0
- 13d agowerfwerf v2.78.2 alpha: fix buildah layer re-compression on stage push
- 14d agowerfwerf v3.4.0: netavark replaces CNI/slirp4netns for buildah networking
- 14d agowerfwerf v2.78.1 alpha: fix stapel stage builds tied to image catalog
- 15d agowerfwerf v3.3.1: fix host-cleanup freed space measurement
- 22d agoCertbotCertbot 5.8.0
- 2mo agoCertbotCertbot 5.7.0
- 4mo agoCertbotCertbot 5.6.0
- 5mo agoCertbotCertbot 5.5.0
- 6mo agoCertbotCertbot 5.4.0
- 7mo agoCertbotCertbot 5.3.1
Frequently asked questions
What is the difference between Certbot and werf?
Both compete on the same themes — devtools — within Infra & APIs. werf is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Certbot better than werf?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. werf is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to Certbot?
Top Certbot alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Certbot alternatives" section above for the current picks, or visit /alternatives/certbot for the full list with editorial commentary on each.
What are the best alternatives to werf?
Top werf alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "werf alternatives" section above for the current picks, or visit /alternatives/werf for the full list with editorial commentary on each.