ACMEv2 automation for real infrastructure

ACME certificate automation you can actually prove.

Issue and renew certificates, deliver them to your services and check what is running. Built for infrastructure teams managing TLS across Windows, Linux and mixed estates.

Get started Book a walkthrough

Works with Let's Encrypt and other ACME-compatible certificate authorities. CertLocker keeps renewal, deployment, verification, and audit evidence in one workflow.

Issue and renew ACMEv2 workflows without browser-based manual renewal.

Deploy and verify Tie certificates to hosts, services, and live endpoint probes.

Prove the history RBAC, audit logs, Merkle proofs, and post-quantum readiness.

CertLocker ACME automation workflow showing certificate issuance and renewal progress

Open full size screenshot

Why ACME alone is not enough

The script renewed. Production may still be serving the old chain.

Certbot, acme.sh, Caddy, Traefik, and win-acme all solve useful parts of the problem. The awkward bit starts when certificates spread across HAProxy, Nginx, IIS, VPNs, supplier portals, Java keystores, appliances, and old deployment jobs.

No owner

The first hour of an incident is spent finding who owns the hostname, the server, the PEM file, and the restart path.

No proof

The renewal log says success, but nobody can quickly prove which endpoint is serving the new certificate.

Too much access

DNS credentials, private keys, and shell access often end up wider than the certificate job actually needs.

Audit later

Approval, deployment, probe result, and access history get reconstructed after someone asks the question.

CertLocker ACME workflow

Issue, renew, deliver, verify, and record the evidence.

The page Let's Encrypt sends people to should show the operational workflow clearly. CertLocker is not a browser-based certificate generator. It is an infrastructure control plane for automated ACME renewal and the work that comes after renewal.

Request

Create or import a certificate workflow and choose the ACME-compatible authority.

Challenge

Run HTTP-01 or DNS-01 validation through a controlled workflow instead of handing broad credentials around.

Renew

Use automatic renewal windows so certificate jobs run before expiry without manual browser steps.

Deploy

Deliver certificates to the systems that terminate TLS: HAProxy, Nginx, IIS, internal services, or edge nodes.

Verify

Probe the real endpoint and record what production is actually serving.

Product proof

ACME UI with the operational detail engineers need.

The ACME screens are useful because they stay connected to the rest of the platform: certificate inventory, scoped tokens, workflow progress, endpoint checks, and audit history.

CertLocker ACME workflows overview with HTTP-01 and DNS-01 certificate automation

Open full size screenshot

ACME workflows in one place

Track certificate requests, challenges, renewal state, owners, and workflow status without jumping between cron output and CA dashboards.

CertLocker certificate detail page for a Let's Encrypt staging certificate

Open full size screenshot

Certificate detail with renewal context

See the certificate, issuer, expiry, chain, ownership, and related operations from the same screen the team uses to manage it.

CertLocker ACME workflow progress timeline with completed certificate challenge and issuance steps

Open full size screenshot

Progress timeline for renewal evidence

A renewal should leave a readable trail: requested, challenged, issued, delivered, verified, and recorded.

Open full size screenshot

Scoped certificate tokens

Give machines narrow access to the certificate material they need, with expiry, scope, and activity visible to the team.

Tamper-evident evidence

Merkle proofs for certificate operations.

Certificate operations create evidence: issue, renew, deploy, verify, approve, revoke, and access. CertLocker can record those events into a tamper-evident audit structure using Merkle trees, so the team can prove the timeline later instead of trusting that nobody edited a log file after the fact.

Operational proof

Show what happened to a certificate from request to live endpoint verification.

Audit confidence

Make post-incident and compliance review less dependent on scattered logs.

CertLocker audit log showing certificate, token, host, secret, and probe events

Open full size screenshot

Post-quantum planning

Merkle tree certificates belong in the operational plan, not a research note.

Post-quantum certificate work changes more than the signature algorithm. It changes certificate size, handshake cost, profile choices, rollout timing, and what each endpoint can actually serve. CertLocker gives teams a place to track those decisions against real hosts, probes, and certificate workflows.

Read the Merkle certificate notes

Profile-aware rollout

Track which certificate profiles are intended for public TLS, internal services, short-lived workload certs, or a limited post-quantum pilot.

Handshake budget

Post-quantum material can make TLS handshakes heavier. Endpoint probes help teams test the effect where the traffic actually terminates.

Merkle evidence

Use tamper-evident event history for issuance, renewal, deployment, verification, and profile changes.

Migration control

Keep the pilot tied to hosts, groups, tokens, and approvals instead of a one-off script that nobody owns six months later.

Where it fits

Built for the messy places certificates actually live.

The target is not just a public website certificate. It is the awkward estate: load balancers, Windows services, private apps, VPNs, store systems, supplier portals, internal dashboards, and old servers that still matter.

HAProxy and Nginx

Renew, deploy, reload, and probe the endpoint that customers or internal teams actually hit.

Windows and IIS

Bring win-acme style renewal paths into the same certificate inventory and audit model.

DNS-01 and HTTP-01

Use ACME challenge workflows with ownership, logs, and renewal state visible.

Private and mixed estates

Handle OpenStack, VMs, bare metal, and old deployment jobs where cloud-native certificate managers do not reach.

Scoped machine access

Use narrow certificate tokens instead of broad credentials copied into scripts.

Compliance evidence

Tie renewal, deployment, verification, and access records to the audit trail.

Common questions

Is CertLocker an ACMEv2 client?

CertLocker integrates with ACMEv2 certificate workflows and is designed for automatic certificate issuance, renewal, delivery, and verification across infrastructure. It works with Let's Encrypt and other ACME-compatible certificate authorities.

Does CertLocker replace Certbot?

CertLocker is not just a single-server renewal client. Certbot is a good fit when one machine needs one certificate. CertLocker is for teams that need central certificate inventory, ACME automation, scoped access, deployment targets, endpoint probes, RBAC, and audit evidence across mixed infrastructure.

Does CertLocker support automatic renewals?

Yes. CertLocker is built around automatic renewal workflows. Renewals can run without a browser or manual copy-paste process, and routine renewal timing should be scheduled with randomized windows to avoid synchronized renewal spikes.

What does the Merkle tree audit trail prove?

Certificate events such as issue, renew, deploy, verify, approve, revoke, and access can be recorded into a tamper-evident audit structure. Merkle proofs help show that the operational history has not been quietly rewritten after the fact.

Does CertLocker support post-quantum certificate planning?

Yes. CertLocker is built to track certificate policy, profiles, endpoint behaviour, and evidence as certificate formats change. For post-quantum planning, that means teams can pilot Merkle tree certificate workflows, monitor TLS handshake impact, and keep the migration tied to real hosts instead of a spreadsheet.

Trademark note: Let's Encrypt is a trademark of Internet Security Research Group. Let's Encrypt certificates are available for free from letsencrypt.org. CertLocker is an independent product and is not affiliated with, sponsored by, or endorsed by ISRG or Let's Encrypt.

Test ACME automation before you trust it with production.

Bring your certificate inventory to a hosted walkthrough. We will review renewal, delivery, endpoint checks and audit needs with your team.

Get started Services & access Discuss your workflow Book a demo