For the Reddit thread
Renewal scripts can say success while production still serves the old cert.
That is the kind of mess CertLocker is built for: certificates, secrets, SSH/RDP access, probes, and audit evidence across mixed infrastructure.
The usual mess
The script is only one part of the story.
The awkward failures happen in the gap between "the cert was issued" and "the real service is actually serving it".
HAProxy renewed, old cert served
ACME can work perfectly while a reload path, backend, or bundled PEM still serves yesterday's certificate.
Scripts hold private keys
PEM material ends up in shell scripts, deployment folders, laptops, or old automation nobody wants to touch.
Shared RDP and SSH access
Server access often depends on shared credentials, permanent keys, and scattered evidence after the fact.
Auditors ask who owns what
Ownership, expiry, delivery, endpoint state, and access history all live in different places.
What to check first
Follow one certificate all the way to production evidence.
Inventory
Know which certificates exist, what they protect, when they expire, and who owns them.
Renewal state
Track ACME clients, orders, renewals, and operational steps instead of trusting cron output.
Deployed probe result
Probe the live endpoint and check the served certificate, chain, and expiry.
Access and audit trail
Keep certificate, secret, SSH/RDP, token, host, and probe evidence in one reviewable trail.
Where this usually fits
Built for estates that are not clean Kubernetes.
Test whether CertLocker fits your actual mess.
Start with a hosted walkthrough of the workflow your team wants to fix. We can review HAProxy, IIS, VM, OpenStack or bare-metal requirements and discuss deployment boundaries with you.