CertLocker Complete Feature List - Platform Capabilities

Certificate inventory and generation

Searchable custody for every certificate, with status, validation class, and PQ-aware metadata.

✓ Certificate list, search, paging, sorting, and group filtering
✓ Detail drawer with subject, SANs, issuer, validity, fingerprints, and expiry
✓ Active, expired, revoked, and self-signed status rendering
✓ DV, OV, EV, self-signed, and unknown validation classifications
✓ Certificate upload with optional private key
✓ Self-signed generation with RSA, ECDSA, and ML-DSA keys
✓ ML-DSA-44, ML-DSA-65, and ML-DSA-87 parameter sets
✓ Public certificate download and CERT_UPDATE modification
✓ Group ownership, scoped visibility, and renewable-asset tracking
✓ PQ Ready inventory for ML-DSA and Merkle Tree Certificates

Private-key management

Generate, import, and present key material with permission-controlled download paths.

✓ Dedicated PRIVATE_KEY system and private secret type
✓ Backend generation for Ed25519, RSA (2048/3072/4096), and ECDSA (P-256/P-384)
✓ Generated SSH PEM secrets with username
✓ Import of OpenSSH (including encrypted), OpenSSL, and PKCS#8 private keys
✓ Public-key derivation in OpenSSH authorized_keys and PEM formats
✓ Copy and download public keys; permission-controlled private-key download
✓ Algorithm, key-size, and key-strength metadata with automatic backfill

ACME automation and profiles

Full ACME client workflows plus optional profiles advertised by the directory.

✓ Reusable ACME clients, orders, workflows, and directory support
✓ RFC 8555 signed JWS handling and account key rollover
✓ RSA, P-256, and P-384 certificate requests with wildcard domains
✓ HTTP-01, DNS-01, and persistent DNS-01 workflow models
✓ Automatic renewal, failed-workflow retry, cancellation, and deletion
✓ External Account Binding for issuers that require it
✓ Issuer catalogue: Let’s Encrypt, ZeroSSL, Sectigo, Buypass, Google, Actalis, SSL.com, CertLocker, and custom issuers
✓ HAProxy and win-acme compatibility work
✓ ACME profile discovery, refresh, selection, and carry-through to orders
✓ CertLocker directory profiles including mtc7d and mtc47d

Profile availability depends on the selected ACME server.

Certificate Automations and integrations

Readable certificate deployment procedures over standard SSH/SFTP. See the workflow at /integrations/.

✓ Certificate delivery and deployment commands without a CertLocker target agent
✓ Install, execute and audit commands controlled by your team
✓ Host selection constrained by the scoped SSH/SFTP access token
✓ Configured bastion routes for private targets
✓ Linux installation and activation steps; Windows IIS deployment using PowerShell over SSH
✓ Certificate automation linked to an outbound ACME order or run against an existing certificate
✓ Separate Challenge automations for validation-file delivery
✓ Execution results and live endpoint verification

Targets need standard SSH/SFTP, a reachable route, suitable permissions and any tools the deployment procedure uses. Windows requires OpenSSH Server. Additional systems may need integration work.

DNS provider integrations

DNS-01 clients for Cloudflare, Route 53, Google Cloud DNS, Azure DNS, and OpenStack DNS.

✓ Working DNS-01: Cloudflare, AWS Route 53, Google Cloud DNS, Azure DNS, and OpenStack DNS
✓ Structured and masked credential entry
✓ DNS client create, edit, detail, delete, and group scoping
✓ DNS client lookup from ACME workflows
✓ Cloudflare token, account, and zone configuration
✓ Route 53 access key, secret key, and hosted-zone configuration

Secrets, private secrets, and one-time sharing

System and user-private secret inventories with version history and expiring share links.

✓ Secret types: PRIVATE_KEY, PEM, PASSWORD, CREDENTIALS, and CONFIGURATION
✓ Create, edit, suspend, resume, revoke, reveal/hide, and copy-to-clipboard
✓ PEM paste/upload plus text, JSON, YAML, and configuration-file editing
✓ Version history with view, restore, and delete of historical versions
✓ Secret usage visibility for linked hosts and tokens
✓ Separate user-private inventory with ownership enforcement
✓ Delegated private-secret creation for a team member
✓ One-time email share with expiry, reveal page, and curl handoff
✓ Audit events for create, edit, reveal, fetch, restore, download, and share

Hosts and cloud importers

Host inventory with bastion linkage and working importers for the major clouds.

✓ Host inventory, detail, search, group filtering, suspend, resume, and revoke
✓ IP, mapped ports, OS, SSH port, linked secret, and bastion relationships
✓ Host wizard that creates PEM secret, host, and matching access token together
✓ Working importers: OpenStack, AWS EC2, Microsoft Azure, and Google Cloud
✓ Discover instances, select systems, preview duplicates, and map groups from tags/metadata
✓ PEM upload or generated-key handling with individual or shared multi-host tokens
✓ Azure service-principal secret or RSA certificate authentication
✓ GCP service-account JSON with single-zone or all-zone discovery
✓ Probe discovery begins after import

Azure Key Vault certificate import is not implemented.

Tokens and access grants

Scoped, time-bound access across hosts, certificates, secrets, bastions, and agents.

✓ Token types: HOST, CERTIFICATE, SECRET, BASTION, MCP, ROOT, and WILDCARD
✓ Fixed expiry or duration, CIDR restriction with “Use my IP”, and single-use tokens
✓ Automatic rotation, renew, suspend, resume, revoke, and bulk revoke-expired
✓ Protocols: SSH, SFTP, SCP, HTTPS, ACME, MCP, RDP, and VNC
✓ Asset groups and separate group-access scope
✓ One-time external access URL and certificate/host token wizards

SSH, bastion, and browser remote desktop

Just-in-time host access in the browser with auditable session controls.

✓ Host- and group-scoped access tokens with a just-in-time access model
✓ PEM and credentials-based authentication
✓ Browser terminal (xterm.js) with multi-host picker, pop-out, fullscreen, and reconnect
✓ Keyboard-interactive / 2FA bridge through the terminal WebSocket
✓ Bastion setup wizard with automatic BASTION token creation
✓ RDP and VNC browser desktops over Guacamole-backed WebSockets
✓ RDP pre-authentication plus access-code and authenticator challenges
✓ Minimise/restore desktop windows and dedicated desktop permissions

Probes and endpoint verification

Confirm what endpoints actually serve, including PQ-ready classification.

✓ TCP and UDP probes with optional certificate and host linkage
✓ Frequency configuration with suspend, resume, and revoke
✓ Last-result status, issuer/subject visibility, and TLS SNI when hostname is available
✓ Inspection of the certificate actually served by the endpoint
✓ PQ-ready endpoint classification for Merkle Tree Certificates and ML-DSA leaf keys
✓ Cloud-import probe discovery and duplicate-probe prevention

PQ Ready is an inventory and endpoint classification, not a claim that the complete TLS connection is quantum-safe.

AI agents, MCP, and public automation API

Scoped machine access for agents, with OpenAPI docs and llms.txt discovery. Setup guide: /features/mcp/

✓ AI-agent inventory with owner, risk level, groups, scopes, and lifecycle
✓ Streamable HTTP MCP endpoint at /rest/mcp with one active MCP token per agent
✓ Required expiry with a maximum 90-day TTL; bearer token shown only once
✓ Scopes for secrets, certificates, hosts, SSH, probes, approvals, and audit write
✓ Dry-run support for SSH and probe operations
✓ Client examples for Claude Code, OpenAI Codex, Gemini CLI, and Cursor
✓ HTTPS agent API using x-api-token for secrets, certificates, hosts, SSH, probes, and approvals
✓ Generated OpenAPI 3.1 specification, interactive docs, and /llms.txt

Channels and notifications

Route selected audit actions to the chat tools your team already uses.

✓ Slack, Microsoft Teams, and Google Chat channels
✓ Masked webhook URLs and group scoping
✓ Dual-list audit-action selection and group-aware delivery
✓ Test send, last-sent timestamp, and audit-delivery coverage

RBAC, authentication, and SSO

Permission-gated operations with email/password, 2FA, and Google/Microsoft SSO.

✓ Permission-gated navigation and API operations with superuser override
✓ Group-scoped list/mutation enforcement and group filters across inventories
✓ System and custom roles with per-group custom-role assignment
✓ User invitations with role/group assignment, resend, cancel, and copy-link
✓ Email/password login, registration, email verification, and password reset
✓ Email-code or TOTP two-factor authentication; TOTP first-login QR setup
✓ Google SSO and Microsoft SSO with invite identity matching
✓ SSO replaces the password step but retains CertLocker 2FA
✓ Session idle timeout warning, multi-tab behaviour, and protected routes

Audit, dashboard, and back office

Append-only evidence, operational widgets, and commercial administration.

✓ Append-only audit events for user, system, service, and AI-agent actors
✓ Filters by date, category, action, outcome, severity, actor, asset, and free text
✓ CSV and JSONL export with export permission separate from view
✓ Per-tier retention settings and daily purge model
✓ Dashboard health widgets for certificates, secrets, hosts, tokens, and probes
✓ PQ Ready widget and renewable-assets table
✓ Back-office accounts, users, tiers, system settings, UTM, and registration journey
✓ Stripe-backed billing with plan change, cancel-at-period-end, and tier limits

Shared UI, architecture, and validation

Customer and back-office SPAs, gateway paths, and broad E2E coverage.

✓ Responsive tables, mobile layouts, light/dark themes, and route-aware guides
✓ Guided setup for certificates, secrets, ACME, cloud imports, billing, and desktop access
✓ React 19 customer SPA, React back-office SPA, Edge API, REST API, and Gateway
✓ WebSocket SSH terminal and Guacamole-backed RDP/VNC path
✓ PostgreSQL 17, Docker Compose, GHCR images, and Ansible production layout
✓ Hosted and in-house deployment options with Prometheus/Grafana support
✓ E2E coverage across registration, RBAC, secrets, tokens, ACME, cloud imports, MCP, RDP, tiers, and PQ paths

Everything CertLocker does today