9 Checks for Self Hosted Certificate Security
Self-hosted certificate security is not just choosing a certificate authority. It is the day-to-day work of keeping private keys controlled, renewals boring, services reloaded, and endpoints verified.
These checks are written for teams with mixed infrastructure, not a perfect greenfield cloud environment.
Self-hosted certificate control path
Self-hosted certificate risk areas
Keys copied through scripts and hosts.
Different hosts renew differently.
Services keep old material.
Logs do not connect the full workflow.
The nine checks
Check ownership, expiry, SANs, private key location, ACME account access, delivery token scope, service reload behavior, live endpoint result, and audit record.
If one of those checks lives only in someone head, it is not a reliable control.
Pay attention to private keys
A certificate without its private key is public information. The private key is the sensitive part, and self-hosted estates often copy it into more places than expected.
CertLocker uses scoped delivery so clients receive the certificate material they need without broad vault access.
Verify from the outside
The most useful certificate check is what the endpoint actually serves. Inventory can be correct while HAProxy, Nginx, IIS, or a Java service still serves stale material.
Endpoint probes should be part of the renewal path, not a separate emergency command.
The 9 checks
- ✓ Owner and group are assigned.
- ✓ Expiry and renewal path are known.
- ✓ SANs match the real service names.
- ✓ Private key location is controlled.
- ✓ ACME account and DNS tokens are scoped.
- ✓ Delivery tokens are narrow.
- ✓ Service reload is verified.
- ✓ Endpoint probe confirms served certificate.
- ✓ Audit trail links the full workflow.
Related reading and workflows
Certificate lifecycle management
Inventory, renewal, delivery, ownership, and audit for TLS certificates.
Certificate delivery tokens
Scoped certificate access for HAProxy, IIS, Nginx, scripts, and automation.
Endpoint probes
Check what production endpoints actually serve after renewal.
Help with onboarding
Bring your existing inventory to a hosted walkthrough with the CertLocker engineers.
CertLocker for DevOps teams
The broader trust-control workflow for platform and infrastructure teams.
Compare CertLocker with scripts
Where spreadsheets, cron jobs, and shared files stop being enough.
Try the workflow against real infrastructure
Use the hosted evaluation at trust.certlocker.io for a walkthrough, or run a one-month onsite evaluation against your own certificates, hosts, secrets, and access paths.