Certificate ManagerFeatures
Everything a certificate needs, in one place.
Self-hosted, with licensing tailored to your organisation. The trial includes every feature.
01 · Automation
Issue once. Renewal, hand-over and logging happen on their own.
Automated issuance and renewal
Single-name, multi-name and wildcard certificates for public and internal hosts, renewed automatically on a schedule you set. Renew any certificate by hand whenever you like.
Your choice of certificate authority
Let's Encrypt staging and production out of the box, or any other compatible authority by its directory address.
Modern keys
ECDSA P-256 and P-384, or RSA 2048, 3072 and 4096. Pick a default and override it per certificate.
Your DNS, your provider
Over 150 DNS providers, chosen by name with guided fields and a built-in test: GoDaddy, Cloudflare, Route 53, Azure DNS, Namecheap and many others, or your own DNS server with a TSIG key. HTTP validation is available when DNS access is not.
Pull, not push
Servers fetch their own certificates through the API or a download link. No agent with credentials sitting on your servers. A ready-made PowerShell script handles IIS.
REST API with real queries
Filter with expressions like daysLeft < 30, choose the fields you need, sort and page. Every long action streams its progress live.
AI assistant access
An optional assistant endpoint answers questions like "what expires next month?" or "which servers never picked up their renewal?". It only sees the departments its API key covers.
02 · Visibility
Know what you have, what expires next, and whether each renewal reached its server.
One inventory for every certificate
Issued certificates and uploaded vendor certificates side by side, with expiry, issuer, SANs, key strength and chain.
Problems found for you
Expired or expiring, staging or self-signed, weak keys or signatures, missing chain, validity over 398 days, not yet valid: every certificate is checked.
Renewal pick-up tracking
See which systems downloaded each certificate and when, so a renewal that never reached its server is caught before it expires.
Live endpoint check
Ask what a host is actually serving right now and compare it with the certificate on record.
Watch external certificates
Track certificates you do not issue here, from appliances or vendors, by probing the live endpoint or by a known expiry date.
Expiry alerts
E-mail, Microsoft Teams or Slack, at the thresholds you choose and on the schedule you set.
Dashboard
Status counts, the renewal runway for the next 30 days, a roll-up per department, issuers, tags and certificates nobody owns yet.
03 · Control
The right people see the right certificates, and every action is recorded.
Single sign-on and roles
Microsoft Entra ID, any OpenID Connect provider, or LDAP / Active Directory. Read-only, admin and super-admin roles, with every capability adjustable.
Departments and tags
Give each team its own certificates: they see and manage only theirs. Tags add your own labels on top.
Scoped API keys
Read, write and delete scopes, limited to departments if you like. Keys are shown once and stored only as a hash.
Download policy
Decide which formats may be downloaded, separately for people in the browser and for API keys. Private keys only where you allow them.
Audit and SIEM
Every action is recorded, including API and assistant calls. Search it, export it as CSV or JSON, and forward it over syslog, GELF, JSON or HTTPS.
Encrypted at rest
Private keys and secrets are encrypted with a key only you hold. Backups stay encrypted.
Sign-in protection
Lockout after repeated failed sign-ins, adjustable session length, and a sign-in diagnostics page showing each step of the last 50 attempts.
04 · Operations
Small to run, easy to set up and easy to back up.
One container
Portal, API and renewals in a single container with a single data volume, on-premises or in your cloud.
Guided setup
A step-by-step guide takes you from install to your first certificate and checks each setting as you go.
Changes apply instantly
Every setting lives in the web interface and takes effect straight away, with no restart.
Health page
Configuration, encryption, renewal service, backup age, licence expiry, staging certificates and weak crypto in one place.
Backup in one click
Download an encrypted backup from the settings page. Restore by putting it back and starting with the same key.
Every download format
Certificate, full chain, chain, private key, combined bundle or password-protected PFX.
See it with your own certificates
The 30-day trial includes every feature on this page, up to 10 certificates.