Quick answer
Bare metal and mixed infrastructure need certificate and access workflows that work outside one cloud provider. Teams need inventory, renewal, delivery, endpoint probes, secrets, SSH or RDP access, and audit trails across physical servers, VMs, Windows hosts, Linux hosts, load balancers, and internal services.
Questions this hub answers
how do I manage certificates on bare metal infrastructure
how do I manage TLS certificates on bare metal
how do I handle certificates across HAProxy and IIS
how should retail IT manage server access
how do I audit infrastructure across mixed estates
What this topic covers
Mixed estates are operationally awkward because no single cloud certificate product reaches everything. The same team may own HAProxy, IIS, old Windows boxes, Linux hosts, payment-adjacent systems, supplier portals, and internal VPN services.
Where CertLocker fits
CertLocker is built for teams that need certificate, secret, access, probe, and audit workflows across infrastructure that does not fit neatly inside AWS ACM or GCP-managed certificates.
Start with these pages
ISO 27001 Evidence for TLS and Access Logs
What infrastructure teams should keep for ISO 27001 evidence around TLS certificates, secrets, SSH/RDP access, and production changes.
How to Audit the TLS Handshake in Production
How to check the certificate a live endpoint actually serves, and why inventory or renewal logs are not enough.
Top 7 DevOps Certificate and Access Tools in 2026
A practical list for teams running mixed Linux and Windows estates across SSH, RDP, TLS, secrets, certificates, access, and monitoring.
10 TLS Security Checks for Linux and Windows
Ten practical TLS checks for teams running Linux and Windows services across HAProxy, Nginx, IIS, private networks, and public endpoints.
Merkle Tree Certificates Are Probably Where WebPKI Is Going
Part 1 of a practical series on Merkle Tree Certificates, post-quantum TLS authentication, and what infrastructure teams should do before the WebPKI changes shape.
How to Monitor TLS Certificate Expiry Across a Bare Metal Fleet
Endpoint probing for physical and self-managed hosts.
CA Bundles in HAProxy and IIS
Chain handling across Linux load balancers and Windows IIS.
CertLocker Active-Passive HA
How CertLocker itself runs in a two-node HA shape.
Browser RDP Access for Windows Servers
RDP access for Windows servers in mixed estates.
Endpoint probes
Live certificate checks across endpoints.
Certificate delivery
Moving certificates into the systems that serve traffic.
Integrations through Automations
Linux, Windows IIS and configured bastion routes using standard SSH/SFTP.
CertLocker vs AWS ACM
Managed cloud certificates compared with mixed estates.
CertLocker vs spreadsheets and scripts
Why manual tracking fails when infrastructure is scattered.
Frequently asked questions
Why is certificate management harder on bare metal?
Bare metal lacks the uniform managed certificate layer available inside one cloud provider. Teams must handle discovery, renewal, delivery, service reloads, endpoint checks, and ownership across many host types themselves.
What should a mixed-infrastructure evaluation prove?
An evaluation should prove that certificates can be inventoried, renewed, delivered, probed, and audited against real hosts. It should also test access workflows such as scoped SSH, RDP, and secret reads against the systems the team actually runs.
Evaluate this against your environment
Bring your current inventory or operational problem to a hosted walkthrough. We will help map your hosts, certificates, access paths and audit needs.