SSL Certificate Lifecycle Management

When you start an account with CertKit, you create a DNS CNAME record for _acme-challenge that points to us. That gives us the ability to validate certificates for your domain from certificate authorities, without giving us complete access to your DNS.

This is called Delegated DNS Validation. See how the full system works.

No! We think giving systems DNS access is dangerous. One compromised credential and an attacker controls your entire domain. Instead, you manually point a CNAME record at us for _acme-challenge and we handle the validation responses. It's a one-time setup, your DNS credentials stay with you, and the worst we could ever do is mess up your certificate challenges. That's a much smaller blast radius.

Yes. Bring your own CA, we'll manage the lifecycle. Import existing certificates, set renewal schedules, deploy everywhere. Works with any CA that supports ACME.

But with our easy certificate management, you probably don't need to pay for certificates anymore. You can get free, short-lived certificates from Let's Encrypt. Yes, even in your intranet.

You use the CertKit agent, which can be installed on Windows, Linux, and Docker servers. The agent links a certificate in CertKit to software running on your infrastructure. You just specify the format and location you want certificates stored, and the command to refresh the software.

Got vendor appliances? The CertKit agent can push certificates into common platforms like F5, Palo Alto, Citrix, and Cisco.

The agent source is available and extensible for more platforms and software types. See how issuing, deploying, and verifying all fit together.

CertKit stores certificate private keys using AES-256-GCM with Additional Authenticated Data (AAD) encryption on infrastructure hosted in Canada. For organizations that require keys to never leave their network, the CertKit Keystore keeps private keys on your own infrastructure. CertKit manages issuance and renewal as normal, but the keys stay with you. The Keystore is available on Enterprise plans.

Modern TLS also provides a safety net here. With Perfect Forward Secrecy, a compromised private key cannot be used to decrypt past traffic. Every TLS 1.3 connection uses ephemeral session keys that exist only for that connection.

We're working on SOC2 compliance. Get in touch if you have specific compliance requirements.

Certbot is a fantastic Linux tool. And just like most Linux tools, you have to chain it together yourself with custom scripting to make it useful. You have to manage your scripts, your jobs, and ensure the services restart.

Certbot runs on each server independently. When one fails, you might not know until customers complain. Got 50 servers? That's 50 different renewal jobs to babysit. 50 different logs to check. 50 different ways for things to break.

CertKit is centralized management with distributed deployment. One place to see all your certificates. One dashboard showing what's working and what's not. Actual monitoring that tells you about problems before they happen, not after your site goes down. See the architecture.

Most CA management tools are designed to keep you on their certificates. CertKit is vendor agnostic, it works with Let's Encrypt, your existing CA, or any ACME-compatible authority. You're never locked in.

Let's Encrypt now issues more than 60% of public certificates and is no less secure than paid alternatives. If you're still paying per certificate, you probably don't need to be.

CertKit handles the full lifecycle regardless of where your certificates come from.

Yes, absolutely! We'd love to work with you to customize the UI for you. Get in touch with us.

All paid plans include a 90-day free trial, no credit card required. You get full access to most features in your plan from day one.

90 days is long enough to see your certificates renew automatically and know the system works for your infrastructure. At the end of the trial, we'll reach out to help you choose a plan. If you're not ready, your account moves to the Community plan. Get in touch if you need more time or want to talk through your options.