CertLocker wiki

How to use CertLocker without guessing the workflow.

This page is for new users setting up the hosted SaaS product or evaluating CertLocker against real infrastructure. It follows the actual app modules: certificates, probes, secrets, tokens, hosts, bastion, ACME, AI agents, channels, audit, and team access.

Get started Services & access

Quick start

Do not try to model the entire estate on day one. Pick one workflow that is painful now, add a small number of real records, and use probes or audit events to prove the result.

Create the account

Register, verify your email, complete the login code, then open User Details to confirm your roles, groups, permissions, and timezone.

Add one real asset

Start with one certificate, host, secret, token, or probe. CertLocker makes more sense when the records point at something your team actually owns.

Use groups early

Groups control visibility and selection scope across secrets, hosts, tokens, certificates, probes, channels, and team members.

Verify what production serves

Use endpoint probes after certificate upload, renewal, or delivery so you know what the service is actually presenting.

Account setup

  1. Create your hosted account from the Get started button. Our team can help with inventory mapping and a walkthrough when you need it.
  2. Enter display name, account name, email, password, and the preferred two-factor method.
  3. Verify the registration email code.
  4. Login with email and password.
  5. Complete the login verification code. TOTP users may see an authenticator setup step first.
  6. Open User Details from the profile area. Confirm email, timezone, roles, groups, and effective permissions.
  7. Use Change password from User Details when credentials need to be updated. It requires the current password and a second factor.

Recommended first asset paths

  • Certificate-first: upload one certificate, create a probe from it, then run the probe against the live endpoint.
  • SSH-first: use the token Host wizard to create a PEM secret, host, and host token together.
  • Secret-first: create one system secret, check the detail drawer, then rotate the value to create a second version.
  • Team-first: invite one user with a narrow role and group, then use Refresh permissions after acceptance.
  • ACME-first: create an ACME client, create a DNS provider if DNS-01 is needed, then create an ACME workflow order.

Groups and RBAC model

  • Use groups like platform-team, sre-team, retail-stores, warehouse, prod-edge, or vpn depending on how your estate is operated.
  • Apply the same group names to related secrets, hosts, tokens, certificates, probes, channels, and users.
  • Use roles for actions such as view, create, modify, suspend, resume, revoke, export, or connect.
  • Use User Details to inspect the effective permission list for the signed-in user.
  • Use Team to review or edit assigned roles and group scope.

Module how-to guides

These sections match the app sidebar and drawers. Use them as a checklist when training a new operator or reviewing hosted workflows with your team.

Dashboard

Use the dashboard as the operational landing page. It summarizes assets that need attention and links you into the affected module.

How to do it

  1. Open Dashboard after login.
  2. Review certificate, token, host, secret, probe, and renewal widgets.
  3. Use the affected widget or renewables table to jump into the module that needs work.
  4. Use Refresh permissions if your role, group, or module access was just changed.

Operator notes

  • Dashboard access is permission-gated.
  • If a module is missing from the sidebar, check User Details for roles and effective permissions.

Certificates

Store certificate records, inspect parsed metadata, download material when permitted, and create endpoint probes from certificate rows.

How to do it

  1. Open Certificates.
  2. Select Upload certificate.
  3. Enter a short name, description, and groups.
  4. Paste or upload the public certificate. Add a private key only when your operating model requires CertLocker to manage that key material.
  5. Save, then open the row to review issuer, validity, SANs, fingerprints, status, and chain details.
  6. Use Download only when the recipient and transport are appropriate.
  7. Use the probe icon on a certificate row to create a matching endpoint probe.

Operator notes

  • Name and groups matter because certificates are later selected by probes, tokens, and ACME workflows.
  • A certificate record is not proof that production is using that certificate. Use Probes for that.
  • You can generate a self-signed certificate when you need a local or internal trust material without an external CA.

Endpoint Probes

Validate what a live endpoint presents during a TLS handshake, on demand or on a schedule.

How to do it

  1. Open Probes or create a probe directly from a certificate row.
  2. Choose an optional certificate record to compare against.
  3. Set the address, port, frequency, and groups.
  4. Save the probe.
  5. Open the probe drawer to review the last result.
  6. Use Probe to run an immediate check when your role allows it.
  7. Suspend a probe during planned maintenance. Resume it when monitoring should continue. Revoke it only when the endpoint is retired.

Operator notes

  • Use probes after ACME renewal, certificate delivery, HAProxy reload, IIS binding change, Nginx reload, or VPN gateway update.
  • The important question is not just "did the file change?" It is "what certificate is the service serving now?"

System Secrets

Store shared operational secrets such as PEM keys, passwords, username/password credentials, and configuration blobs.

How to do it

  1. Open Secrets.
  2. Select Add secret.
  3. Enter name, description, and groups.
  4. Choose the secret type: PEM, PRIVATE_KEY, PASSWORD, CREDENTIALS, or CONFIGURATION.
  5. Enter the protected value in the type-specific fields.
  6. Save, then open the row to review metadata, current version, payload rendering, and used-by references.
  7. Use Edit to create a new version when the value changes.
  8. Use Versions to review older revisions, restore a prior version when permitted, or delete old versions when your retention model allows it.
  9. Use Share secret only for a one-time handoff by email with a deliberate lifetime and scope.

Operator notes

  • Do not put secret material in names or descriptions.
  • Suspend secrets that should pause temporarily. Revoke secrets when they should not be used again.
  • Used-by references help you understand which hosts, tokens, or workflows depend on the secret before you change it.
  • For PEM and PRIVATE_KEY types, you can generate private keys and PEMs using RSA, ECDSA, or ED25519.

Private Secrets

Store user-only secrets that should not be visible to the wider account team.

How to do it

  1. Open Private Secrets from the Secrets menu.
  2. Select Add secret.
  3. Enter name, description, and an optional URL that points to where the secret is used.
  4. Choose PEM, PRIVATE_KEY, PASSWORD, CREDENTIALS, or CONFIGURATION.
  5. Save the secret.
  6. Open a row to review details, reveal or copy values when needed, edit metadata or payload, and inspect versions.
  7. Delete only when the secret is no longer needed. Deletion is irreversible.

Operator notes

  • Private secrets do not use groups for visibility. They belong to the signed-in user.
  • Use private secrets for personal operational credentials, not shared service credentials.
  • For PEM and PRIVATE_KEY types, you can generate private keys and PEMs using RSA, ECDSA, or ED25519.

Hosts

Represent target systems such as Linux servers, Windows servers, gateways, appliances, VPN endpoints, or internal services.

How to do it

  1. Open Hosts.
  2. Select Create host.
  3. Enter host name, description, address, port, and groups.
  4. Link a secret if the host uses stored credential material.
  5. Link a bastion when access should route through a mediated gateway.
  6. Save, then open the host row to review relationships, status, update history, secret linkage, and bastion linkage.
  7. Suspend during maintenance. Resume after validation. Revoke when the host is retired.

Operator notes

  • Host records make downstream token, bastion, desktop, and probe workflows clearer.
  • Keep host groups aligned with the related secret and token groups so selection scope behaves predictably.
  • You can import hosts from AWS, GCP, Azure, and OpenStack.

Tokens

Create scoped, time-bound access grants for hosts, certificates, secrets, desktop access, ACME, and MCP agent workflows.

How to do it

  1. Open Tokens.
  2. Use Create token for the standard two-step flow.
  3. Set name, description, groups, lifetime or fixed expiry, optional client network CIDR, and token type.
  4. Choose HOST, CERTIFICATE, or SECRET based on the backing asset.
  5. On step two, choose the relevant hosts, certificates, secrets, protocols, group scope, and optional team member binding.
  6. Create the token, then open the row to inspect status, expiry, coverage, linked assets, access code, and ownership.
  7. Use Renew to extend a valid workflow. Use Rotate when the token value should change. Use Suspend for a temporary hold. Use Revoke to end access.
  8. Use Open terminal or Pop out on SSH-capable host tokens when terminal access is enabled.

Operator notes

  • Use the Host wizard when onboarding SSH access because it creates the PEM secret, host, and token together.
  • Use the Certificate wizard when an existing certificate needs a certificate-backed token quickly.
  • CIDR restrictions are useful when the client side should only work from known networks.
  • You can create a personal token, which requires the user to complete 2FA before access is granted.

Bastion

Connect routing, secrets, hosts, and terminal workflows so shell access can be mediated rather than direct and permanent.

How to do it

  1. Open Bastion.
  2. Select Create bastion or use the setup wizard.
  3. Set address, port, supported protocols, groups, and the secret used by the bastion.
  4. Assign hosts explicitly or align host coverage to token coverage where that is the desired model.
  5. Save, then open the drawer to review connected state, linked token, linked secret, host summaries, and client run command.
  6. Use the client handoff command during implementation.
  7. Suspend or resume during maintenance. Revoke when the bastion path should be permanently retired.

Operator notes

  • Bastion records are about mediated access paths, not just host inventory.
  • Keep the linked secret and host groups consistent with the teams allowed to use the path.

Desktop Hosts

Connect to permitted desktop-capable hosts through SSH, RDP, or VNC style workflows when your role allows it.

How to do it

  1. Open Desktop, then Hosts.
  2. Search by desktop host name or group.
  3. Select the host tile.
  4. Choose the token if more than one token is available.
  5. Select Connect.
  6. Use the terminal or desktop window. Windows can be dragged, resized, minimized, restored, or closed.

Operator notes

  • Desktop access is permission-gated separately from ordinary host visibility.
  • Port 3389 normally maps to RDP behavior and port 5900 normally maps to VNC behavior when matching tokens exist.

ACME Automation

Configure ACME issuer clients, create certificate orders, track workflow state, and support HTTP-01 or DNS-01 validation.

How to do it

  1. Open ACME Clients.
  2. Create a reusable client profile. Choose the issuer, server URL, contacts, groups, and External Account Binding details when the CA requires EAB.
  3. Upload or paste an existing ACME account private key if you already have one. Otherwise allow CertLocker to generate account key material during creation.
  4. Open DNS Providers when DNS-01 validation is needed.
  5. Create a DNS provider client for Cloudflare, Route 53, Google Cloud, Azure, OpenStack, or another supported provider. Store provider credentials in the config field or upload where the UI supports it.
  6. Open ACME Workflows.
  7. Create an order from an existing ACME client.
  8. Enter one or more domains and choose HTTP-01 or DNS-01 validation.
  9. Open the workflow row to review state history, messages, errors, problem details, and authorisations.
  10. Open ACME Orders to review issued orders, certificate material, domains, and expiry.

Operator notes

  • Use DNS Providers before ACME Workflows if DNS-01 is the validation method.
  • Use groups consistently across ACME clients, DNS clients, resulting certificates, and delivery tokens.
  • For hosted ACME integrations, the public directory endpoint used in articles is https://trust.certlocker.io/rest/acme/directory.
  • You can select Profiles from the ACME provider when creating an order, allowing different types of certificates.

AI Agents and MCP

Define MCP client identities and scopes so AI tools use governed CertLocker references instead of raw credentials pasted into prompts.

How to do it

  1. Open AI Agents.
  2. Select Create.
  3. Name the agent and choose scopes.
  4. Save the agent.
  5. Open Tokens and create an MCP or agent-appropriate token linked to that agent and the required groups.
  6. Use the agent drawer to review status, scopes, recent sessions, and MCP connection details.
  7. Paste the MCP config into Claude Code, Codex, Gemini CLI, or Cursor — see /features/mcp/ for client examples.
  8. Suspend to pause access. Resume to re-enable. Revoke to permanently disable the agent path.

Operator notes

  • Agents should receive scoped references and time-bound access, not copied production secrets.
  • Review audit events after agent activity so the team can see what was requested and when.
  • Full join guide with Claude, Codex, and Gemini examples: https://certlocker.io/features/mcp/

Channels

Send selected audit events to Slack, Google, or Teams using webhook-based delivery.

How to do it

  1. Open Channels.
  2. Select Create channel.
  3. Choose Slack, Google or Teams.
  4. Enter the webhook URL, groups, and selected audit actions.
  5. Save the channel.
  6. Open the drawer to review webhook masking, action list, groups, and last-sent timestamp.
  7. Use Test before relying on the channel for incident or governance workflows.
  8. Edit or delete channels when ownership, webhook URLs, or action selection changes.

Operator notes

  • Webhook URLs are sensitive. Treat them like secrets.
  • Use channel groups and action selection to avoid sending every event to every team.

Audit

Review and export evidence about users, assets, actions, outcomes, severity, categories, and timestamps.

How to do it

  1. Open Audit.
  2. Select Show filters.
  3. Filter by time range, category, action, outcome, severity, user, asset, group, or free text.
  4. Apply filters.
  5. Open an event row to inspect full context in the detail drawer.
  6. Export CSV for human review or JSONL for evidence pipelines when your role allows export.

Operator notes

  • Use audit filters after secret changes, token rotation, SSH access, failed probes, ACME workflows, team changes, or agent activity.
  • Set your timezone in User Details before reviewing incidents across teams.

Team, Roles, and Groups

Invite users, assign roles, limit group scope, and create customer-specific roles from permission groups.

How to do it

  1. Open Team.
  2. Use Invite user to send an invitation.
  3. Set the email, role selection, and group scope.
  4. Copy or resend acceptance links when needed.
  5. Review pending, accepted, expired, cancelled, and deleted invitations.
  6. Review Team members for current access, assigned roles, group scope, and last sign-in.
  7. Open a member drawer to inspect identity, roles, groups, status, and edit when permitted.
  8. Use Manage roles to create or edit custom roles from permission groups.

Operator notes

  • Roles decide what actions a user can perform.
  • Groups decide which assets a user can see or select.
  • When a user cannot see a module or asset, check both role permissions and group scope.
  • It is possible to use Single Sign-On with either Google or Microsoft.

Suspend, resume, revoke, rotate, and renew

  • Suspend means pause temporarily. Use it during maintenance, investigation, or a planned hold.
  • Resume means return a suspended asset to service.
  • Revoke means retire permanently. Use it for old hosts, dead tokens, compromised credentials, or retired probes.
  • Rotate means replace the value or access code while preserving the operational record.
  • Renew means extend a token or workflow where that is still the correct access model.

Common troubleshooting checks

  • Missing sidebar item: open User Details and check roles, groups, and permissions. Ask an admin to update Team membership if needed.
  • Cannot select an asset in a form: check group alignment between your user, the asset, and the workflow you are creating.
  • Probe fails after renewal: check whether the service reloaded, whether the endpoint serves the expected chain, and whether the probe address and port match the real listener.
  • ACME workflow stalls: open workflow details and review state history, messages, authorisation records, and any ACME problem details.
  • Channel test fails: verify the webhook URL, destination app, selected action list, and group scope.
  • Agent should not have access: suspend or revoke the agent, then inspect tokens and audit events tied to that agent.
  • User cannot connect to desktop or terminal: check token protocol, host linkage, desktop or terminal permission, team member binding, token expiry, and host/bastion status.

Start small, then widen the model.

A good first evaluation is not a perfect inventory. Add a few real hosts, certificates, secrets, tokens, probes, users, and audit channels. Then check whether CertLocker answers the operational questions your team already has.

Get started Discuss your workflow