What does a certificate management platform give you that scripts cannot?

Scripts automate individual tasks - renewal, deployment - but they do not provide inventory, ownership tracking, cross-service delivery, endpoint verification, audit trails, or correlation with secrets and SSH access. A platform provides the operational view that connects all of these: who owns what, what is expiring, what is actually being served, and who changed what.

Is CertLocker worth the cost compared to free tools?

The calculation depends on how many engineers are involved in certificate operations, how much time is spent on manual renewal and incident response, and what a certificate expiry incident costs in downtime and remediation. For teams spending more than a few hours per month on certificate operations, the operational value typically exceeds the platform cost.

Comparison

Replacing the certificate spreadsheet: what changes

Q: When should I stop managing certificates with spreadsheets?

The signs that manual certificate management is breaking down: you have experienced a certificate expiry incident in the past 12 months; you are tracking more than 20 certificates; you cannot quickly answer "who owns this certificate" or "what will expire in the next 30 days"; certificate renewal requires a human to remember to do it; you have no automated alerting when a certificate is within 30 days of expiry.

Most infrastructure teams start with a spreadsheet and a cron job. That works until it doesn't. This page is honest about when manual management is fine and when it stops being fine.

Manual certificate management using spreadsheets, calendar reminders, Certbot cron jobs, and custom scripts is a reasonable starting point for teams with fewer than 20 certificates and no compliance requirements. It breaks down at scale because it has no inventory visibility, no cross-service delivery, no ownership model, no endpoint verification, and no audit trail. CertLocker replaces the manual layer with automated ACME renewal, endpoint probes, ownership tracking, secrets versioning, and SSH access management - providing the operational visibility that scripts cannot.

When manual management is genuinely fine

✓ Fewer than 10 certificates, all Let's Encrypt, all on servers where Certbot runs natively
✓ No compliance requirements around certificate inventory or audit trails
✓ One or two people who know every certificate and where it lives
✓ No multi-service certificate delivery (same cert does not need to go to HAProxy, IIS, and an application server)
✓ No on-call requirement for certificate incidents

The signs that manual management is breaking down

⚠ You have had at least one certificate expiry incident in the past 12 months
⚠ You have more than 20 certificates across more than 3 services or environments
⚠ You cannot quickly answer "who owns this certificate" or "what expires in the next 30 days"
⚠ Certificate renewal requires someone to remember it, do it manually, and then copy material to multiple places
⚠ You have no automated alerting before a certificate expires
⚠ Certificates, SSH keys, and secrets are tracked in different places with no common ownership model
⚠ A compliance audit would reveal gaps in who accessed what and when

What you get and what you give up

Capability	CertLocker	Spreadsheet + Certbot + cron
Certificate inventory with ownership	✓ Built-in	⚠ Manual — usually incomplete
ACME issuance across multiple public CAs	✓ Issuer catalogue	⚠ Per-server Certbot / scripts
Multi-service certificate delivery	✓ ACME Gateway	✗ Copy manually to each service
Endpoint TLS probes	✓ Continuous	⚠ Ad-hoc openssl / cron if maintained
Secrets with version history and restore	✓	✗ Separate tool or plaintext
One-time secret sharing	✓	✗
Just-in-time SSH / bastion access	✓ Token-scoped	✗ Permanent PEM files
Browser RDP / VNC	✓	✗
Cloud host import	✓ AWS, Azure, GCP, OpenStack	✗ Custom scripts
RBAC, SSO, and channels	✓	✗
AI agents / MCP scoped tokens	✓	✗
Audit trail (who changed what)	✓ CSV / JSONL export	✗
Cost	Hosted onboarding; services scoped by agreement	Free tools (ops time is not free)
Setup time	Hours	Months to build equivalent coverage

Why scripts solve the wrong problem

Certbot and acme.sh are excellent tools. They reliably automate certificate renewal on the servers where they run. The problem is not the tool - it is the scope of the problem they solve.

Scripts automate renewal. They do not provide inventory. They do not track ownership. They do not deliver renewed certificates to HAProxy, IIS, or application servers on other hosts. They do not verify that the endpoint is actually serving the right certificate. They do not correlate certificates with secrets, SSH keys, or access events. And they do not produce an audit trail that answers "who changed this certificate and when."

The gaps are not failures of the tools - they are gaps in the problem the tools were designed to solve. A platform addresses the full lifecycle, not just the renewal step.

Frequently asked questions

When should I stop managing certificates with spreadsheets?

When you have had a certificate expiry incident, when you cannot quickly answer who owns a certificate or what expires next month, when renewal requires manual copying to multiple services, or when a compliance audit would reveal gaps in your certificate records.

What does CertLocker do that Certbot cannot?

Certbot automates renewal on a single server. CertLocker manages the full lifecycle: inventory, ownership, multi-service delivery via ACME Gateway, endpoint verification, secrets, SSH access, and audit trails. Certbot and CertLocker can coexist - CertLocker can manage the delivery layer while Certbot handles per-server renewal on servers that already run it.

Is the migration from spreadsheets to CertLocker disruptive?

No. CertLocker can import existing certificates and run alongside existing renewal scripts. Migration typically starts with importing the inventory for visibility, then progressively moving renewal and delivery to CertLocker as trust is established.