ACME Certificate Automation for HAProxy Nginx IIS
Certbot is good at getting a certificate. The scripts around it are usually where the estate gets interesting.
One host uses Certbot hooks. Another copies PEMs to HAProxy. Windows has win-acme. A Java service needs a keystore. Someone added a reload script nobody wants to touch.
From local renewal to controlled TLS workflow
Certbot script failure points
Scripts differ across hosts.
New PEM exists, old process still serves.
Renewal works until the host changes.
Success logs do not prove client-visible TLS.
Do not replace the ACME protocol
ACME works. Let us be clear about that. The problem is not the protocol. The problem is operating certificate lifecycle as a pile of local scripts with no central state.
CertLocker keeps ACME in the workflow while adding inventory, delivery tokens, group ownership, and endpoint probes.
Move delivery out of broad host scripts
Instead of a root-owned script copying everything everywhere, give each client a scoped way to fetch the certificate it needs.
That pattern works for HAProxy, Nginx, IIS, win-acme, RFC 8555 clients, and deployment jobs that should not see unrelated certificate material.
Keep Certbot where it still makes sense
You do not have to rip out every working Certbot install on day one. Start with the failure-prone certificates: customer-facing endpoints, HAProxy edges, Windows services, and systems with unclear owners.
The useful migration is from local hope to central proof.
Replacement plan
- ✓ Inventory every Certbot renewal and deploy hook.
- ✓ Identify which services consume each PEM, chain, or keystore.
- ✓ Create certificate records and scoped delivery tokens.
- ✓ Replace custom copy scripts with controlled delivery where possible.
- ✓ Probe endpoints after renewal and reload.
Related reading and workflows
CertLocker vs Certbot
Where Certbot stops and lifecycle control begins.
ACME end to end
How CertLocker runs ACME workflows across issuers.
Certificate lifecycle management
Inventory, renewal, delivery, ownership, and audit for TLS certificates.
Certificate delivery tokens
Scoped certificate access for HAProxy, IIS, Nginx, scripts, and automation.
Endpoint probes
Check what production endpoints actually serve after renewal.
Help with onboarding
Bring your existing inventory to a hosted walkthrough with the CertLocker engineers.
CertLocker for DevOps teams
The broader trust-control workflow for platform and infrastructure teams.
Compare CertLocker with scripts
Where spreadsheets, cron jobs, and shared files stop being enough.
Try the workflow against real infrastructure
Use the hosted evaluation at trust.certlocker.io for a walkthrough, or run a one-month onsite evaluation against your own certificates, hosts, secrets, and access paths.