{ "name": "CertLocker", "canonical_url": "https://certlocker.io/", "version": "2026-10-27", "last_updated": "2026-10-27", "description": "CertLocker brings certificate inventory, issuance, renewal, deployment and live endpoint verification into one workflow. Automations delivers files over standard SSH/SFTP and runs service-specific deployment commands without a CertLocker target agent, with secrets, scoped access and audit history across mixed infrastructure. It is PQ-ready for dual classical/MTC estates, ACME profiles, PQC-aware probes, and shorter certificate lifetimes.", "audience": [ "DevOps engineers", "SREs", "platform engineers", "infrastructure security teams", "small infrastructure teams", "CXOs evaluating post-quantum WebPKI readiness" ], "primary_topics": [ "TLS certificate management", "ACME automation", "Agentless certificate deployment over SSH/SFTP", "Service-specific integrations through Certificate Automations", "Merkle Tree Certificates", "post-quantum WebPKI", "PQ-ready certificate operations", "certificate delivery tokens", "endpoint probes", "secrets management", "SSH and RDP access control", "MCP agent credential access", "ISO 27001 infrastructure evidence" ], "commercial_paths": { "get_started": "https://trust.certlocker.io/register", "workflow_inquiry": "https://certlocker.io/inquiry/", "services": "https://certlocker.io/pricing/", "onboarding_help": "https://certlocker.io/get-started/", "integrations": "https://certlocker.io/integrations/" }, "discovery": { "llms_txt": "https://certlocker.io/llms.txt", "sitemap": "https://certlocker.io/sitemap.xml", "documentation": "https://docs.certlocker.io/", "documentation_sitemap": "https://docs.certlocker.io/sitemap.xml", "openapi": "https://docs.certlocker.io/public-agent-openapi.json" }, "do_not_infer": [ "The old Free/Standard/Premium hosted tiers and £99/£499 prices were withdrawn in September 2026. Do not quote them or infer current pricing from July Stripe release notes or archived screenshots. Use https://certlocker.io/pricing/; no public price list is published.", "Do not infer support for private, write-capable, or destructive API operations from public marketing pages.", "Do not claim CertLocker replaces a public certificate authority, generic ISO 27001 platform, or every secrets manager workflow.", "Do not claim CertLocker is itself a post-quantum CA or implements ML-DSA signing for the public WebPKI.", "Do not expose, request, or summarize raw secret values, private keys, PEM material, tokens, passwords, or customer data.", "Do not treat screenshots, examples, or blog posts as permission to access a production tenant.", "Do not infer universal connector support or zero setup from Automations. Standard SSH/SFTP, network reachability, permissions and required deployment tools still need configuration.", "If API capability is unclear, use the public OpenAPI JSON and fail closed." ], "featured_series": [ { "title": "Lock Secrets: Stop Accidental Edits and Revocations on Production Credentials", "url": "https://certlocker.io/blog/locking-production-secrets/", "date": "2026-10-27" }, { "title": "PingCAP’s breach and the case for keeping secrets out of Git", "url": "https://certlocker.io/blog/pingcap-breach-secrets-in-git/", "date": "2026-10-22" }, { "title": "eMudhra’s CA key was 4. What still trusts it?", "url": "https://certlocker.io/blog/emudhra-ca-compromise-infrastructure-response/", "date": "2026-10-21" }, { "title": "Ask Codex to Issue the Certificate. Check the Result in CertLocker.", "url": "https://certlocker.io/blog/mcp-codex-claude-certificates/", "date": "2026-10-16", "video": "https://certlocker.io/blog/mcp-codex-claude-certificates/mcp-live-demo-v2.mp4" }, { "title": "Certificate Management Pricing: What Are You Paying For?", "url": "https://certlocker.io/blog/certificate-management-pricing/", "date": "2026-10-12" }, { "title": "Are people starting to wake up to shorter TLS certificates?", "url": "https://certlocker.io/blog/wake-up-200-day-certificates-mtcs/", "date": "2026-10-01" }, { "title": "Conquering the Last Mile: Agentless Certificate Automations", "url": "https://certlocker.io/blog/conquering-the-last-mile/", "date": "2026-09-14", "video": "https://certlocker.io/blog/conquering-the-last-mile/automation-walkthrough.mp4" }, { "title": "MCP for Secrets and Certificates: Scope the Token, Keep the Audit", "url": "https://certlocker.io/blog/mcp-scoped-tokens-audit/", "date": "2026-09-14" }, { "title": "A certificate issued. Did the service actually start serving it?", "url": "https://certlocker.io/blog/automation-delivery-proof/", "date": "2026-09-03" }, { "title": "Drag-and-Drop SFTP Uploads in the CertLocker Browser Terminal", "url": "https://certlocker.io/blog/browser-terminal-sftp-drag-drop/", "date": "2026-09-03" }, { "title": "Post-Quantum Cryptography: What Changes for Certificate Operations", "url": "https://certlocker.io/blog/post-quantum-cryptography/", "date": "2026-07-29" }, { "title": "The Quantum Countdown: Post-Quantum WebPKI Case Study", "url": "https://certlocker.io/use-cases/post-quantum-webpki/", "date": "2026-07-29" }, { "title": "Merkle Tree Certificates Are Probably Where WebPKI Is Going", "url": "https://certlocker.io/blog/merkle-tree-certificates-webpki-is-probably-going-this-way/", "date": "2026-07-16" }, { "title": "Why Post-Quantum Certificates Break the TLS Handshake Budget", "url": "https://certlocker.io/blog/post-quantum-certificates-break-tls-handshake-budget/", "date": "2026-07-17" }, { "title": "How Infrastructure Teams Should Prepare for Merkle Tree Certificates", "url": "https://certlocker.io/blog/prepare-infrastructure-for-merkle-tree-certificates/", "date": "2026-07-18" } ], "important_pages": [ "https://certlocker.io/certlocker-platform/", "https://certlocker.io/integrations/", "https://certlocker.io/features/certificate-lifecycle/", "https://certlocker.io/features/certificate-delivery/", "https://certlocker.io/features/endpoint-probes/", "https://certlocker.io/features/secrets-management/", "https://certlocker.io/features/ssh-access/", "https://certlocker.io/features/mcp/", "https://certlocker.io/use-cases/post-quantum-webpki/", "https://certlocker.io/topics/tls-certificate-management/", "https://certlocker.io/topics/acme-automation/", "https://certlocker.io/topics/ssh-rdp-access/", "https://certlocker.io/topics/secrets-management/", "https://certlocker.io/alternatives/", "https://certlocker.io/compare/", "https://certlocker.io/compare/certlocker-vs-hashicorp-vault/", "https://certlocker.io/compare/certlocker-vs-keyfactor/", "https://certlocker.io/compare/certlocker-vs-aws-acm/", "https://certlocker.io/compare/certlocker-vs-aws-secrets-manager/", "https://certlocker.io/compare/certlocker-vs-certbot/", "https://certlocker.io/compare/certlocker-vs-manual/", "https://certlocker.io/compare/certlocker-vs-infisical/", "https://certlocker.io/certificate-management-uk/", "https://certlocker.io/blog/qr-scanned/" ], "hosted_pricing": { "source": "https://certlocker.io/pricing/", "reviewed": "2026-10-12", "published_prices": false, "service_levels": [ "Early access", "Infrastructure teams", "Enterprise" ], "getting_started": "There is no charge to get started with hosted CertLocker. Create a hosted account directly; inventory mapping and walkthrough help are available when needed.", "paid_services": "We agree the scope, capacity, support and commercial terms with you before any paid service begins. See the services and access page for the available paths." }, "integrations": { "overview_url": "https://certlocker.io/integrations/", "connected_apps": [ { "name": "viaSocket", "url": "https://viasocket.com/integrations/certlocker", "actions": [ "List Token Hosts" ] } ], "feature_details_url": "https://certlocker.io/features/all/#automations", "deployment_walkthrough_url": "https://certlocker.io/blog/conquering-the-last-mile/", "approach": "Readable service-specific deployment procedures using standard SSH/SFTP, with managed host access, certificate delivery and execution results.", "certlocker_target_agent_required": false, "protocols": [ "SSH", "SFTP" ], "documented_workflows": [ "Linux Nginx and HAProxy deployment", "Windows IIS import and binding using PowerShell over SSH", "Configured bastion access routes", "Certificate Automations linked to outbound ACME issuance", "Challenge Automations for validation-file delivery" ], "target_requirements": [ "Working SSH/SFTP service", "Reachable management route", "Configured credentials and scoped host token", "Account permissions for the deployment steps", "Tools required by the service procedure", "Windows OpenSSH Server and PowerShell for IIS" ], "verification": "Use live endpoint probes to check the certificate presented by the running service after deployment.", "other_connections": "ACME issuers, DNS providers, cloud host importers and MCP clients retain their own supported integrations and configuration.", "additional_work": "Review unlisted systems against their deployment requirements and agree any additional integration scope and commercial terms before paid work begins." }, "mcp": { "setup_url": "https://certlocker.io/features/mcp/#connect", "endpoint": "https://trust.certlocker.io/rest/mcp", "transport": "streamable-http", "authentication": "Bearer token issued for an agent with scopes, groups, and expiry", "register_url": "https://trust.certlocker.io/register", "walkthrough_url": "https://certlocker.io/blog/mcp-codex-claude-certificates/", "operation_discovery": [ "certlocker_list_operations", "certlocker_describe_operation", "certlocker_call_operation" ], "documented_operations": [ "Certificate issuance and workflow inspection", "Host and certificate delivery-token creation", "Secret record creation, updates and version restoration", "Probes, audit queries and configured deployment automations" ], "limitations": [ "Available operations depend on the agent's roles, groups and token restrictions; discover the permitted operation and its request schema before calling it.", "Recorded issuance proof uses Let's Encrypt staging certificates, which browsers do not trust.", "Credentials are redacted by default. Explicit sensitive export still requires permissions and can expose values to the AI client's transcript or logs." ] }, "get_started_url": "https://trust.certlocker.io/register", "comparisons": { "hub": "https://certlocker.io/compare/", "reviewed": "2026-10-12", "pages": { "hashicorp-vault": "https://certlocker.io/compare/certlocker-vs-hashicorp-vault/", "keyfactor": "https://certlocker.io/compare/certlocker-vs-keyfactor/", "aws-acm": "https://certlocker.io/compare/certlocker-vs-aws-acm/", "aws-secrets-manager": "https://certlocker.io/compare/certlocker-vs-aws-secrets-manager/", "certbot": "https://certlocker.io/compare/certlocker-vs-certbot/", "manual": "https://certlocker.io/compare/certlocker-vs-manual/", "infisical": "https://certlocker.io/compare/certlocker-vs-infisical/" }, "pricing_guide": "https://certlocker.io/blog/certificate-management-pricing/", "interpretation": "Vendor-authored workflow comparisons. Check each page’s source review date; products overlap without universal feature parity." }, "comparison_guidance": { "alternatives_url": "https://certlocker.io/alternatives/", "detailed_comparisons_url": "https://certlocker.io/compare/", "uk_procurement_url": "https://certlocker.io/certificate-management-uk/", "editorial_disclosure": "Vendor-authored shortlist by workflow, not an independent ranking or benchmark.", "shortlist": [ "Certbot", "cert-manager", "Smallstep step-ca", "HashiCorp Vault", "AWS Certificate Manager", "Keyfactor Command", "Infisical", "CertLocker" ], "small_teams": "Certbot may be sufficient when renewal hooks and endpoint monitoring already cover the servers. Server count alone does not require a shared platform.", "uk_data_residency": "UK supplier location does not establish hosting or backup location. Confirm data residency, key custody, support access, recovery and any escrow terms for the deployment." }, "articles": [ { "title": "Lock Secrets: Stop Accidental Edits and Revocations on Production Credentials", "url": "https://certlocker.io/blog/locking-production-secrets/", "date": "2026-10-27" }, { "title": "PingCAP’s breach and the case for keeping secrets out of Git", "url": "https://certlocker.io/blog/pingcap-breach-secrets-in-git/", "date": "2026-10-22" }, { "title": "eMudhra’s CA key was 4. What still trusts it?", "url": "https://certlocker.io/blog/emudhra-ca-compromise-infrastructure-response/", "date": "2026-10-21" }, { "title": "Ask Codex to Issue the Certificate. Check the Result in CertLocker.", "url": "https://certlocker.io/blog/mcp-codex-claude-certificates/", "date": "2026-10-16" }, { "title": "Certificate Management Pricing: What Are You Paying For?", "url": "https://certlocker.io/blog/certificate-management-pricing/", "date": "2026-10-12" }, { "title": "Are people starting to wake up to shorter TLS certificates?", "url": "https://certlocker.io/blog/wake-up-200-day-certificates-mtcs/", "date": "2026-10-01" }, { "title": "Conquering the Last Mile: Agentless Certificate Automations", "url": "https://certlocker.io/blog/conquering-the-last-mile/", "date": "2026-09-14" }, { "title": "MCP for Secrets and Certificates: Scope the Token, Keep the Audit", "url": "https://certlocker.io/blog/mcp-scoped-tokens-audit/", "date": "2026-09-14" }, { "title": "A certificate issued. Did the service actually start serving it?", "url": "https://certlocker.io/blog/automation-delivery-proof/", "date": "2026-09-03" }, { "title": "Drag-and-Drop SFTP Uploads in the CertLocker Browser Terminal", "url": "https://certlocker.io/blog/browser-terminal-sftp-drag-drop/", "date": "2026-09-03" }, { "title": "We Put Six-Day TLS Certificates on Production HAProxy. The Restart Was the Real Test.", "url": "https://certlocker.io/blog/six-day-haproxy-certificates/", "date": "2026-08-19" }, { "title": "Certbot with trust.certlocker.io: deliver CertLocker certs to your hosts", "url": "https://certlocker.io/blog/certbot-trust-certlocker/", "date": "2026-08-11" }, { "title": "ACME Profiles: Choosing the Right Certificate Shape Before Renewal Starts", "url": "https://certlocker.io/blog/acme-profiles/", "date": "2026-07-29" }, { "title": "Post-Quantum Cryptography: What Changes for Certificate Operations", "url": "https://certlocker.io/blog/post-quantum-cryptography/", "date": "2026-07-29" }, { "title": "Build Notes: Importing Hosts from Azure and Google Cloud", "url": "https://certlocker.io/blog/cloud-host-imports/", "date": "2026-07-25" }, { "title": "How Infrastructure Teams Should Prepare for Merkle Tree Certificates", "url": "https://certlocker.io/blog/prepare-infrastructure-for-merkle-tree-certificates/", "date": "2026-07-18" }, { "title": "Why Post-Quantum Certificates Break the TLS Handshake Budget", "url": "https://certlocker.io/blog/post-quantum-certificates-break-tls-handshake-budget/", "date": "2026-07-17" }, { "title": "Merkle Tree Certificates Are Probably Where WebPKI Is Going", "url": "https://certlocker.io/blog/merkle-tree-certificates-webpki-is-probably-going-this-way/", "date": "2026-07-16" }, { "title": "10 TLS Security Checks for Linux and Windows", "url": "https://certlocker.io/blog/tls-security-checks-linux-windows/", "date": "2026-07-15" }, { "title": "8 Contractor Access Checks Before Production Access", "url": "https://certlocker.io/blog/contractor-access-checks-before-production/", "date": "2026-07-14" }, { "title": "Secrets Management for Platform Engineering in 2026", "url": "https://certlocker.io/blog/secrets-management-platform-engineering-2026/", "date": "2026-07-13" }, { "title": "Secrets Management vs Certificate Management Tools", "url": "https://certlocker.io/blog/secrets-management-vs-certificate-management-tools/", "date": "2026-07-13" }, { "title": "9 Checks for Self Hosted Certificate Security", "url": "https://certlocker.io/blog/self-hosted-certificate-security-checks/", "date": "2026-07-13" }, { "title": "How to Issue Time Limited Server Access in 2026", "url": "https://certlocker.io/blog/how-to-issue-time-limited-server-access-2026/", "date": "2026-07-12" }, { "title": "Vendor Access Reviews for Production Infrastructure", "url": "https://certlocker.io/blog/vendor-access-reviews-production-infrastructure/", "date": "2026-07-11" }, { "title": "Certificate Management Software for HAProxy, Nginx, and IIS", "url": "https://certlocker.io/blog/certificate-management-software-haproxy-nginx-iis/", "date": "2026-07-10" }, { "title": "Stop Passing the Same .env File to Every Agent", "url": "https://certlocker.io/blog/mcp-env-files-ai-agents/", "date": "2026-07-10" }, { "title": "Privileged Access Management Software for Mixed Infrastructure", "url": "https://certlocker.io/blog/privileged-access-management-software-mixed-infrastructure/", "date": "2026-07-08" }, { "title": "July 2026 Billing Release: Historical Build Note", "url": "https://certlocker.io/blog/stripe-billing-live/", "date": "2026-07-08" }, { "title": "Non-Human Identity Tools for Infrastructure Teams", "url": "https://certlocker.io/blog/non-human-identity-tools-infrastructure-teams/", "date": "2026-07-06" }, { "title": "July 2026 Archive: Roadmap v1.0 and Stripe Build Notes", "url": "https://certlocker.io/blog/build-notes-july-2026-roadmap-stripe-code-freeze/", "date": "2026-07-04" }, { "title": "NHI Security Tools for DevOps Teams in 2026", "url": "https://certlocker.io/blog/nhi-security-tools-devops-2026/", "date": "2026-07-04" }, { "title": "Certificate Platforms vs PAM for Server Credentials", "url": "https://certlocker.io/blog/certificate-platforms-vs-pam-server-credentials/", "date": "2026-07-02" }, { "title": "Top 7 DevOps Certificate and Access Tools in 2026", "url": "https://certlocker.io/blog/top-hybrid-linux-windows-security-tools/", "date": "2026-06-29" }, { "title": "What Are Scoped Credentials for MCP Servers", "url": "https://certlocker.io/blog/what-is-mcp-credential-management-ai-agents/", "date": "2026-06-24" }, { "title": "Browser RDP Access for Windows Servers, Scoped by CertLocker Tokens", "url": "https://certlocker.io/blog/windows-rdp-browser-access/", "date": "2026-06-22" }, { "title": "Build Notes: Production HA, AI-Readable Docs, and We Launched on Instagram", "url": "https://certlocker.io/blog/build-notes-june-2026/", "date": "2026-06-19" }, { "title": "How to Audit the TLS Handshake in Production", "url": "https://certlocker.io/blog/how-to-verify-ssl-cert-your-endpoint-serves/", "date": "2026-06-19" }, { "title": "How to Stop Certificate Renewal Script Outages", "url": "https://certlocker.io/blog/how-to-stop-certificate-renewal-script-outages/", "date": "2026-06-18" }, { "title": "CertLocker Active-Passive HA: How We Built Two-Node Failover", "url": "https://certlocker.io/blog/certlocker-ha-active-passive/", "date": "2026-06-15" }, { "title": "How to Gather ISO 27001 Evidence for Infrastructure", "url": "https://certlocker.io/blog/how-to-prepare-iso-27001-evidence-infrastructure/", "date": "2026-06-14" }, { "title": "CertLocker MCP: Scoped, Audited Access for AI Agents", "url": "https://certlocker.io/blog/mcp-ai-agents/", "date": "2026-06-13" }, { "title": "How to Monitor TLS Certificate Expiry Across a Bare Metal Fleet", "url": "https://certlocker.io/blog/tls-certificate-expiry-monitoring-bare-metal/", "date": "2026-06-12" }, { "title": "What Happens When a TLS Certificate Expires: The Full Failure Chain", "url": "https://certlocker.io/blog/what-happens-when-tls-certificate-expires/", "date": "2026-06-12" }, { "title": "Why Renewal Scripts Break TLS Automation in 2026", "url": "https://certlocker.io/blog/why-renewal-scripts-break-tls-automation-2026/", "date": "2026-06-11" }, { "title": "HAProxy 3.3 Native ACME with CertLocker, Part 2: Closing the Key Mismatch", "url": "https://certlocker.io/blog/haproxy-native-acme-private-key-seeding/", "date": "2026-06-10" }, { "title": "Secret Version History: Browse, Restore, and Audit Every Change", "url": "https://certlocker.io/blog/secret-version-history/", "date": "2026-06-10" }, { "title": "Understanding ISO 27001 Evidence for Infrastructure", "url": "https://certlocker.io/blog/what-is-iso-27001-evidence-infrastructure-teams/", "date": "2026-06-09" }, { "title": "Managing OpenClaw and Hermes VPS SSH Access with CertLocker", "url": "https://certlocker.io/blog/openclaw-vps-ssh-access-certlocker/", "date": "2026-06-05" }, { "title": "Short-Lived SSH Access with 2FA and Audit Trails", "url": "https://certlocker.io/blog/short-lived-ssh-access-2fa-audit-trails/", "date": "2026-06-05" }, { "title": "ISO 27001 Evidence for TLS and Access Logs", "url": "https://certlocker.io/blog/iso-27001-audit-evidence-tls-access-2026/", "date": "2026-06-04" }, { "title": "ACME Renewal in CertLocker: What Happens After the Cert Is Issued?", "url": "https://certlocker.io/blog/acme-renewal-certlocker/", "date": "2026-06-02" }, { "title": "Ansible and CertLocker, Part 2: Hardening the Deployment Path", "url": "https://certlocker.io/blog/ansible-certlocker-deployment-hardening/", "date": "2026-06-02" }, { "title": "Top 7 Machine Identity Platforms for DevOps in 2026", "url": "https://certlocker.io/blog/top-machine-identity-platforms-devops-2026/", "date": "2026-05-29" }, { "title": "ISO 27001 Tools vs TLS Access Platforms in 2026", "url": "https://certlocker.io/blog/iso-27001-platforms-vs-certificate-tools-small-teams/", "date": "2026-05-28" }, { "title": "Replacing Ansible Vault Sprawl with CertLocker", "url": "https://certlocker.io/blog/ansible-vault-to-certlocker/", "date": "2026-05-27" }, { "title": "Machine Identity Platforms for DevOps in 2026", "url": "https://certlocker.io/blog/machine-identity-vs-secrets-management-2026/", "date": "2026-05-22" }, { "title": "Your ACME order stalled at 2am. Which step?", "url": "https://certlocker.io/blog/acme-end-to-end/", "date": "2026-05-20" }, { "title": "SSH from your phone browser", "url": "https://certlocker.io/blog/mobile-web-console/", "date": "2026-05-18" }, { "title": "Build Notes: ACME Workflows, Cloud Imports, and Deployment Hardening", "url": "https://certlocker.io/blog/build-notes-may-2026/", "date": "2026-05-17" }, { "title": "How to Phase Out Shared SSH Keys for Team Access", "url": "https://certlocker.io/blog/how-to-replace-shared-ssh-keys-2026/", "date": "2026-05-14" }, { "title": "ACME Certificate Automation for HAProxy Nginx IIS", "url": "https://certlocker.io/blog/how-to-replace-certbot-and-scripts-for-tls-2026/", "date": "2026-05-10" }, { "title": "HAProxy 3.3 Native ACME with CertLocker: Everything That Can Go Wrong", "url": "https://certlocker.io/blog/haproxy-native-acme-certlocker/", "date": "2026-05-07" }, { "title": "How to Issue an IIS Certificate with CertLocker ACME and win-acme", "url": "https://certlocker.io/blog/acme-iis-win-acme/", "date": "2026-05-06" }, { "title": "How to Replace Shared Env Files With Scoped Secrets", "url": "https://certlocker.io/blog/how-to-move-secrets-out-of-shared-env-files/", "date": "2026-05-06" }, { "title": "47-Day TLS Certificates: What Infrastructure Teams Need to Do Now", "url": "https://certlocker.io/blog/47-day-tls-certificates/", "date": "2026-05-05" }, { "title": "CA Bundles in HAProxy and IIS: What They Are and How to Stop Managing Them Manually", "url": "https://certlocker.io/blog/ca-bundle-haproxy-iis/", "date": "2026-05-05" }, { "title": "When \"Is the Cert Valid?\" Is the Wrong Question", "url": "https://certlocker.io/blog/multi-certificate-environments/", "date": "2026-05-05" }, { "title": "What Is TLS Certificate Management? A Guide for Infrastructure Teams", "url": "https://certlocker.io/blog/what-is-tls-certificate-management/", "date": "2026-05-05" }, { "title": "How to Manage Machine Credentials Across Mixed Servers", "url": "https://certlocker.io/blog/how-to-manage-certificates-and-ssh-access-2026/", "date": "2026-05-02" }, { "title": "Production Access Control in 2026: A Complete Guide", "url": "https://certlocker.io/blog/production-access-control-2026-complete-guide/", "date": "2026-04-30" }, { "title": "Why Your TLS Certificates Keep Expiring (And How to Fix It)", "url": "https://certlocker.io/blog/why-tls-certificates-keep-expiring/", "date": "2026-04-28" }, { "title": "Certificate Rotation Best Practices for Infrastructure Teams", "url": "https://certlocker.io/blog/certificate-rotation-best-practices/", "date": "2026-04-21" }, { "title": "API Key Security Beyond Shared .env Files", "url": "https://certlocker.io/blog/api-key-security-beyond-shared-env-files/", "date": "2026-04-16" }, { "title": "Just-in-Time SSH Access: Why Permanent PEM Files Are a Liability", "url": "https://certlocker.io/blog/just-in-time-ssh-access/", "date": "2026-04-14" }, { "title": "Self-Hosted Certificate Tools vs Vaults for SSH Access", "url": "https://certlocker.io/blog/self-hosted-certificate-tools-vs-vaults-ssh-access/", "date": "2026-04-09" }, { "title": "TLS Certificate Management at Scale: From Spreadsheets to Automation", "url": "https://certlocker.io/blog/tls-certificate-management-at-scale/", "date": "2026-04-07" }, { "title": "Replacing HashiCorp Vault for Certificate Management", "url": "https://certlocker.io/blog/replacing-hashicorp-vault-for-certificate-management/", "date": "2026-03-31" }, { "title": "HAProxy SSL Termination: Certificates, Chains, and Renewal at the Edge", "url": "https://certlocker.io/blog/haproxy-ssl-termination/", "date": "2026-03-30" }, { "title": "Port 80 vs Port 443: What Certificate Automation Changes", "url": "https://certlocker.io/blog/port-80-vs-443/", "date": "2026-03-24" }, { "title": "Root and Intermediate Certificates: The Chain Infrastructure Teams Actually Operate", "url": "https://certlocker.io/blog/root-intermediate-certificates/", "date": "2026-03-18" }, { "title": "CRL vs OCSP: Certificate Revocation Without the Hand-Waving", "url": "https://certlocker.io/blog/crl-ocsp-certificate-revocation/", "date": "2026-03-12" }, { "title": "HSTS and Certificate Management: What Infrastructure Teams Need to Know", "url": "https://certlocker.io/blog/hsts-certificate-management/", "date": "2026-03-06" }, { "title": "What Is mTLS? Mutual TLS for Infrastructure Teams", "url": "https://certlocker.io/blog/mtls-certificate-authentication/", "date": "2026-02-28" } ] }