Platform Features

Certificates, secrets and access, together.

Renew certificates, manage secrets and give people or services the access they need. Built for infrastructure teams that need to check the result and review what changed.

Services & access Complete feature list
🔒 Certificate Lifecycle

Automated from issuance to expiry

Stop treating certificate renewal as a manual task. CertLocker watches every certificate in your infrastructure, renews them automatically before they expire, and keeps a complete audit trail of every change.

  • ✓
    Automated renewal - certificates renew at 25% remaining, with no human in the loop
  • ✓
    Certificate-scoped access keys - each machine gets a token scoped to exactly the cert it needs
  • ✓
    Full audit trail - every issuance, renewal, and revocation is logged with timestamp and actor
  • ✓
    Expiry alerting - know about expiring certs weeks before they become incidents
Certificate Lifecycle Details →
CertLocker certificate inventory - status and expiry in one view

Open full size screenshot

⚙ ACME Order Lifecycle

Every ACME step, visible end to end

Outbound ACME orders track the full path from pending to issued — challenges, verification, finalize, and certificate handoff — so you can see exactly where an order is and what happened.

  • ✓
    Workflow progress history - order pending through certificate issued, with timestamps
  • ✓
    Multi-issuer catalogue - Let's Encrypt, ZeroSSL, Sectigo, Google, and more
  • ✓
    ACME profiles - select directory profiles such as short-lived MTC paths when the issuer advertises them
ACME automation details →
CertLocker ACME workflow progress from order pending to certificate issued

Open full size screenshot

ACME order lifecycle — pending, challenges, finalize, and certificate issued in one workflow view.

🚀 Certificate Delivery

Certs that actually arrive where needed

Issuing a certificate is only half the job. CertLocker delivers renewed certs to the right machines automatically - no manual SCP, no Ansible playbooks that only run when someone remembers.

  • ✓
    Pull-based delivery - machines fetch their own cert using scoped tokens, no push required
  • ✓
    Format-aware - delivers PEM, PKCS#12, or DER depending on what each target needs
  • ✓
    Reload hooks - trigger service reloads automatically after cert delivery
Certificate Delivery Details →
CertLocker access tokens for scoped certificate retrieval

Open full size screenshot

🔑 Just-in-Time SSH

Access that expires. Trust that stays.

Permanent SSH keys are a liability. Every PEM file on a laptop is a credential waiting to be stolen. CertLocker's JIT SSH model means access is issued for a session, scoped to a target, and automatically revoked when done.

  • ✓
    Token-based access - issue SSH tokens per session, not per user permanently
  • ✓
    Instant revocation - kill access in seconds when a laptop is lost or an employee leaves
  • ✓
    Works with legacy infra - no agent required on target hosts, works with standard SSH
  • ✓
    Full access log - who connected, from where, to what, and when
JIT SSH Details →
CertLocker bastion environments and SSH access overview

Open full size screenshot

More of the control plane

Certificates are only one surface. Secrets, probes, agents, RBAC, and audit sit under the same ownership and evidence model.

Integrations and Automations

Deliver certificates and run your service’s deployment steps over SSH/SFTP without a CertLocker target agent.

Secrets management

System and private secrets with version history, restore, and one-time sharing.

Endpoint probes

Verify the certificate actually served, including PQ Ready classification.

AI agents and MCP

Join CertLocker MCP and connect Claude, Codex, Gemini, or Cursor with scoped tokens.

Cloud host import

Working importers for OpenStack, AWS EC2, Azure, and Google Cloud.

ACME automation

Multi-issuer ACME client, DNS-01, profiles, and Gateway delivery.

Complete feature list

Every working capability from inventory through billing and E2E validation.

Built on least-privilege

Every CertLocker token is scoped to exactly what it needs. Machines get access to one certificate. SSH sessions get access to one host. Nothing more, ever.

Certificate-scoped tokens

One token. One cert. Compromise one machine, lose nothing else.

Time-limited credentials

SSH tokens expire. Certs rotate. Nothing stale accumulates.

Complete audit trail

Every access event logged. Compliance-ready from day one.

Ready to automate your cert infrastructure?

Join infrastructure teams using CertLocker as the unified trust control plane for cryptographic artefacts, access, probes, and audit evidence.

Services & access