Renew, deploy and check TLS certificates across Windows and Linux. Built for DevOps and infrastructure teams.
There is no charge to get started with hosted CertLocker. We agree the scope, capacity, support and commercial terms with you before any paid service begins. See the services and access page for the available paths.
Product overview
Certificates, secrets, scoped access, probes, and audit in one workflow.
A quick walkthrough for first-time visitors who need to see how the pieces fit together.
Get startedCertLocker brings certificate lifecycle management, secrets, host access and endpoint verification into one operational workflow. Teams can issue and renew through ACME, use Automations to deliver certificate material and run deployment commands over standard SSH/SFTP without a CertLocker target agent, check what production serves, and review access and audit history. It works across Windows, Linux and mixed infrastructure, with scoped access for operators, automation and AI agents.
Architecture
Delivery needs credentials, a route to the host and permission to make the change. Explore how ACME, tokens, hosts and MCP agents connect to the same records and access controls.
Your team, services and AI agents
Choose an area to read how it works below.
Why it matters
The business risk is fragmented trust: cryptographic material, admin paths, machine tokens, and agent credentials living in different tools until something breaks or someone asks for proof.
Teams spend the first part of an incident finding owners, files, endpoints, keys, and old deployment scripts.
SSH keys, RDP paths, supplier access, and machine tokens keep working long after the original task is finished.
When asked what changed, who had access, or what production served, the answer often requires manual archaeology.
CertLocker keeps the detail engineers expect: artefact custody, scoped credentials, real endpoint checks, RBAC, version history, and audit events.
What changed
The deeper problem is a missing control plane: certs in one tool, keys and PEMs in another, SSH keys on laptops, RDP handled separately, secrets in scattered stores, AI agents asking for credentials, and audit evidence stitched together after the fact.
Inventory is not enough. CertLocker checks what endpoints actually serve, which tokens exist, and which hosts are in scope.
Machines, users, and sessions should only get the artefact, secret, or host access they need.
CertLocker is not an SSL dashboard. It is the unified control plane for cryptographic artefacts, access, probes, and audit evidence.
Every artefact change, token, bastion session, and access event belongs in one reviewable trail.
Review SOC 2 evidence → ISO 27001 → Operator Trust →Control plane
Start with the gateway causing pain: ACME and certificate lifecycle, secrets, SSH/RDP access, endpoint verification, scoped tokens, or AI-agent credentials. Use the same RBAC, audit, and scoping model across them.
Issue, renew, rotate, deliver, and verify TLS certificates and related cryptographic material across HAProxy, Nginx, IIS, OpenVPN, MT4/MT5, internal services, and ACME clients — including short-lived and PQ-ready profile paths.
Keep PEM material, private keys, credentials, configs, and operational secrets under the same control model as certificates - not a separate vault workflow.
Replace long-lived shared SSH keys with token-scoped host access, and let MCP agents request artefacts through the plane instead of env files.
Integrations through Automations
Automations are saved deployment procedures. They deliver the certificate and run your service’s installation and reload commands over standard SSH/SFTP. Your team controls the steps, with scoped access and execution results in CertLocker.
There is no CertLocker deployment agent to roll out on the target. Linux uses its normal SSH service; IIS uses Windows OpenSSH Server and PowerShell. Configure the access route and permissions, then verify what the live endpoint serves.
No CertLocker deployment agents to install on your servers. → Explore integrations and Automations →How CertLocker works
CertLocker gives teams a practical trust operating model without forcing every server, load balancer, Windows box, vendor workflow, or admin path into a new custom agent.
View All FeaturesCertificates, keys, PEMs, secrets, hosts, tokens, channels, and teams live in one governed product surface.
Machine tokens, ACME clients, host sessions, and agents get narrow permissions that can be rotated or revoked.
Servers keep using familiar ACME and SSH paths while CertLocker records delivery, endpoint checks, and access events.
Audit evidence
When something changes, CertLocker records the event close to the workflow: artefact issuance, token updates, ACME activity, secret access, host import, bastion access, and endpoint verification.
Review user, token, role, and group activity from one place.
Probe production endpoints and compare live TLS against intended state.
Trace artefact, secret, token, and host workflow changes over time.
Remove token or session access without chasing keys across machines.
Where it fits
CertLocker is built around infrastructure buyers who need a unified trust control plane - reliability, access control, and evidence - before compliance or outages force the issue.
Stop spreading artefact, secret, and access work across shell scripts, spreadsheets, cloud consoles, and chat messages.
Read use case →Run trust workflows for trading systems, portals, and regulated infrastructure with clear evidence.
Read use case →Give operators fast access without leaving long-lived keys scattered across laptops and servers.
Read use case →Meet the people building it
We are Sean Monaghan and Darren Hudson. Tell us what you run, where certificates get awkward, and what you need to see before trusting a new tool. You can speak directly with Sean on a video call.
More about us →
Infrastructure and DevOps. Working in corporate technology since at least 2011, with hands-on tech experience going back before 2007.
Sean on LinkedIn ↗Based in Wales, with a background in platform engineering, software architecture, exchange systems and payment technology.
Darren on LinkedIn ↗Create your account and start with your certificate inventory. If you need help with a spreadsheet, export or the next operational step, book a walkthrough with our engineers.
