Quick answer
TLS certificate management is the operating process for finding every certificate, tracking ownership and expiry, renewing certificates before failure, delivering them to the systems that serve traffic, and proving what changed through audit records. For infrastructure teams, the hard part is not issuing one certificate; it is keeping every live endpoint aligned with inventory.
Questions this hub answers
what is TLS certificate management
how do I stop TLS certificates expiring
how should infrastructure teams manage certificate renewal
how do I monitor certificates across bare metal servers
what happens when a TLS certificate expires
What this topic covers
Certificate management spans discovery, ownership, issuance, renewal, delivery, live endpoint verification, alerting, and incident recovery. A spreadsheet can show planned state, but it cannot prove what a browser, API client, load balancer, or backend service is actually serving.
Where CertLocker fits
CertLocker ties inventory, ACME workflows, delivery tokens, endpoint probes, groups, and audit trails together so a team can see planned certificate state and live served certificate state in the same workflow. That same plane is PQ-ready for dual classical/MTC estates, ACME profiles, and probes that recognise ML-DSA material as WebPKI changes shape.
Start with these pages
How to Manage Machine Credentials Across Mixed Servers
A practical guide for teams trying to bring TLS certificates, SSH access, endpoint checks, and audit evidence into one operating model.
How to Stop Certificate Renewal Script Outages
A practical how-to for reducing TLS outages caused by brittle renewal scripts, missed reloads, wrong chains, and unverified endpoints.
ISO 27001 Evidence for TLS and Access Logs
What infrastructure teams should keep for ISO 27001 evidence around TLS certificates, secrets, SSH/RDP access, and production changes.
How to Audit the TLS Handshake in Production
How to check the certificate a live endpoint actually serves, and why inventory or renewal logs are not enough.
Certificate Platforms vs PAM for Server Credentials
A practical comparison of certificate management platforms and privileged access management for Linux and Windows server credentials.
Certificate Management Software for HAProxy, Nginx, and IIS
What to look for in certificate management software when the estate includes HAProxy, Nginx, IIS, Windows, Linux, ACME, and endpoint probes.
Conquering the Last Mile
Host setup, scoped SSH/SFTP access, target selection and deployment to Linux and Windows IIS.
Post-Quantum Cryptography: What Changes for Certificate Operations
NIST timelines, MTC, and CertLocker PQ-ready workflows.
What Is TLS Certificate Management?
Definition and lifecycle model for infrastructure teams.
What Happens When a TLS Certificate Expires
Failure chain from browser errors through incident response.
How to Monitor TLS Certificate Expiry Across a Bare Metal Fleet
Why live endpoint probes matter more than inventory alone.
47-Day TLS Certificates
What shorter public certificate lifetimes change operationally.
Certificate management UK
Hosted onboarding and deployment workflows for UK infrastructure teams.
Integrations through Automations
Service-specific certificate deployment over SSH/SFTP without a CertLocker target agent.
Certificate lifecycle management
Inventory, expiry, ownership, groups, and renewal state.
Endpoint probes
Verify the certificate actually served by production endpoints.
CertLocker vs spreadsheets and scripts
Manual tracking compared with governed certificate operations.
CertLocker vs Keyfactor
A comparison for teams evaluating certificate lifecycle platforms.
Frequently asked questions
What is the difference between certificate inventory and certificate monitoring?
Certificate inventory records what a team believes exists. Certificate monitoring checks what live endpoints are actually serving. Both are needed because a renewed certificate can exist in inventory while production still serves the old chain.
Why do TLS certificates still expire when teams use automation?
Automation often covers issuance but not delivery, service reloads, ownership, alert routing, or endpoint verification. A certificate can renew successfully and still fail in production if the wrong file is served or the service was never reloaded.
Evaluate this against your environment
Bring your current inventory or operational problem to a hosted walkthrough. We will help map your hosts, certificates, access paths and audit needs.