Certificate lifecycle management for UK infrastructure teams

Built for mixed infrastructure

A UK team may run public services on a cloud load balancer, internal applications on IIS, and HAProxy or Nginx on its own hosts. Each certificate needs a delivery path, service reload, and a way to prove what changed. Evaluate CertLocker against one of those real paths, including the private network boundaries.

Start with the IIS and win-acme guide, the HAProxy native ACME guide, or the delivery and live verification build note. The TLS certificate management hub covers inventory and expiry monitoring in more detail.

Start with your existing inventory

Bring a redacted certificate spreadsheet or export to a hosted walkthrough. We will help map the inventory and review the operational steps with you. There is no charge to get started. Explore services and access for infrastructure teams and enterprise estates; paid services are scoped with you before work begins.

Questions for your UK supplier evaluation

CertLocker is operated by CertLocker UK Ltd. For procurement, establish the requirements for your deployment before choosing hosted SaaS or an on-prem install:

• Data location: confirm hosting and backup regions, subprocessors, and support access.
• Private-key custody: identify which keys leave a host, who can retrieve them, and how access is revoked.
• Operations: check your CA, DNS provider, delivery clients, network routes, and rollback procedure.
• Evidence: agree the audit events, retention, and export process your reviewers need.
• Commercial fit: confirm support terms and any procurement framework requirements with the supplier.

Use a call with Sean to confirm those details. If your policy requires operation inside your own environment, discuss On-Prem Install. For tool selection, read CertLocker vs Infisical and the comparison hub.

UK data residency: follow the certificate material

A UK supplier address does not tell you where a hosted service stores data. Map the inventory, private keys, operational secrets, audit records and backups separately. Ask which regions hold each, which subprocessors handle them, and how support access is controlled. Confirm the answers for the deployment you are buying.

Keep the first discussion simple. A redacted inventory can show host types, expiry dates, ownership gaps and deployment routes without sending private keys or production passwords. We can walk through hosted CertLocker on a video call or face to face, then agree what needs a closer technical review.

Private-key custody and access boundaries

Decide where each private key is generated and where it must be stored. An inventory record, an ACME renewal and delivery of certificate material are different operations. Document which users or automation can retrieve keys, which tokens permit delivery, and how those permissions are removed when the job ends.

CertLocker uses groups, scoped tokens and audit history around certificate and secret operations. Check the exact workflow against your requirements: who approves access, which host can receive material, how a token expires or is revoked, and what the audit record shows. The certificate delivery guide and secrets management overview explain the controls to review.

When your environment requires self-hosting

Start with a hosted walkthrough to understand the workflow. If policy requires the service to run inside your environment, discuss an on-prem installation and its requirements separately. Establish who operates the application and database, manages updates, monitors availability and tests recovery. Hosting location alone does not answer those operational questions.

Private networks also need a delivery route. For Automations, confirm SSH/SFTP reachability, suitable permissions and the service commands used to install and activate a certificate. Windows IIS needs Windows OpenSSH Server and PowerShell. Review the integration requirements before assuming that an existing service is ready for automated deployment.

Recovery, export and escrow questions

Agree how your team can recover its inventory, certificate material and audit evidence if a service becomes unavailable or the contract ends. Ask about backup ownership, restore testing, export formats, retention and deletion. Include access to the credentials needed for recovery; a backup that nobody can decrypt does not resolve the problem.

If procurement requires software or key escrow, raise the exact requirement during scoping and have any agreed arrangement recorded in the contract. Do not assume escrow is included with hosted access or an on-prem installation. The same applies to recovery targets, dedicated support and data-location commitments.

Certificate evidence for ISO 27001 and SOC 2 reviews

Prepare the operational answers your reviewer asks for: the certificate owner, renewal event, delivery permissions, activation result and the certificate observed at the live endpoint. Keep secret and access events with the workflow so a review can follow what changed and who was involved.

CertLocker can support that evidence collection; it does not make an organisation compliant on its own. Agree the scope, retention and export process with your reviewers. See the ISO 27001 evidence workflow and SOC 2 evidence workflow. For tool selection, the certificate management alternatives guide sets out when existing ACME clients, private PKI or a shared platform fit.