Certificate ManagerCyberSift Certificate Manager
Never let a certificate expire again.
Every TLS certificate issued, renewed and accounted for, on your own infrastructure.
- Runs on your own server
- Set up in under an hour
- Full product in the trial
Inventory
See every certificate, and what needs attention
Certificates you issue here and the ones you buy from vendors live in one list. The dashboard shows the renewal runway for the next 30 days, a roll-up per department, and every certificate with a problem.
- Expired, expiring, self-signed, staging, weak keys and more flagged automatically
- Upload vendor certificates, or watch appliances by their live endpoint
- Tags, departments and owners on every certificate
Issue
A new certificate in under a minute
Type the host names, pick a department and press Issue. The log streams each step live, and the certificate renews itself from then on.
- Single-name, multi-name and wildcard certificates
- ECDSA P-256 / P-384 or RSA 2048 to 4096
- Download as certificate, chain, full chain, key, bundle or PFX
Pick-up tracking
Know when a renewal never reached its server
Renewing a certificate is only half the job. The Certificate Manager records which systems downloaded each certificate and when, so a server still using last quarter's certificate stands out long before it expires.
- Who pulled each certificate, and when
- Live check of what a host is actually serving
- Flags servers that missed a renewal
Alerts
Warnings where your team already works
E-mail, Microsoft Teams or Slack, at the thresholds you choose and on the schedule you set. The Health page catches what automation cannot fix on its own.
- Your thresholds, your schedule
- Health checks for configuration, backups, licence and renewals
- Every action recorded in the audit log
Automation
Built for scripts as much as for people
Servers pull their own certificates through the REST API with scoped keys. Filter with real expressions, pick the fields you need, and stream the progress of long actions.
- API keys with read, write and delete scopes, limited to departments
- Ready-made PowerShell script for IIS
- Optional AI assistant endpoint, scoped by its API key
Security
Your keys stay yours
The Certificate Manager runs inside your network. Private keys and secrets are encrypted with a key only you hold, and backups stay encrypted.
Encrypted at rest
Private keys and secrets encrypted with your own key.
Single sign-on
Microsoft Entra ID, any OpenID Connect provider or LDAP, with adjustable permissions.
Departments
Each team sees and manages only its own certificates.
Full audit trail
Every action logged, exportable, and forwardable to your SIEM.
How it works
Running in under an hour
- DeployOne container on your own server.
- Set upChoose the admin password and enter your licence key.
- Connect DNSThe setup guide checks the connection for you.
- IssueRenewals and alerts run on their own from then on.
$ curl -fsSLO https://certmanager.mt/downloads/docker-compose.yml
$ docker compose up -d
$ docker compose logs cert-manager | grep "FIRST RUN"
FIRST RUN: … enter setup code 7F3K-92QX-M4TBEverything included
One product, no add-ons
Automated issuance and renewal
Single-name, multi-name and wildcard certificates for public and internal hosts, renewed automatically on a schedule you set. Renew any certificate by hand whenever you like.
Your choice of certificate authority
Let's Encrypt staging and production out of the box, or any other compatible authority by its directory address.
Modern keys
ECDSA P-256 and P-384, or RSA 2048, 3072 and 4096. Pick a default and override it per certificate.
Your DNS, your provider
Over 150 DNS providers, chosen by name with guided fields and a built-in test: GoDaddy, Cloudflare, Route 53, Azure DNS, Namecheap and many others, or your own DNS server with a TSIG key. HTTP validation is available when DNS access is not.
Pull, not push
Servers fetch their own certificates through the API or a download link. No agent with credentials sitting on your servers. A ready-made PowerShell script handles IIS.
REST API with real queries
Filter with expressions like daysLeft < 30, choose the fields you need, sort and page. Every long action streams its progress live.
Questions
Good to know
Where does it run?
On a server you control: on-premises or in your cloud. It is a single container with a single data volume.
Which certificate authorities does it work with?
Let's Encrypt out of the box, plus any other compatible authority by its directory address. Certificates from any vendor can be uploaded and tracked.
Which DNS providers are supported?
Over 150, picked by name in the setup guide: GoDaddy, Cloudflare, Route 53, Azure DNS, Google Cloud DNS, Namecheap, DigitalOcean, OVH, Hetzner and more, or your own DNS server with a TSIG key. No DNS access? Validate over HTTP instead, for names that point at the portal.
How is it licensed?
Licensing is tailored to your organisation. Contact us for a quote; a free trial is available to try it first.
What happens if the licence expires?
Nothing breaks: existing certificates stay visible, downloadable and keep renewing. Only new certificates are paused until the licence is renewed.
Try it on your own infrastructure
The trial is the full product, limited to 10 certificates for 30 days.