Abstract
There are lots of ways to get a certificate. Getting it onto your Cisco ISE, IBM i, or WatchGuard VPN is the hard part.
We keep making that easier. Since July, CertKit has added 51 new deployment templates, more than doubling the library to 86. Each platform has a built-in deployment template, and most have a deployment guide for the setup details. Setup is just picking a certificate and setting a few variables.
Firewalls and VPN gateways
| Platform | What CertKit updates |
|---|---|
| Cisco Firepower | Remote Access VPN and SAML certificates, on FDM and now FMC (FMC in beta) |
| Juniper SRX | IPsec VPN certificates over the Junos REST API |
| WatchGuard Firebox (beta) | Web Server, Mobile VPN with IKEv2, and inbound HTTPS proxy certificates |
| Ivanti Connect Secure | The device certificate, assigned to VPN and management ports |
| OpenVPN | Community Edition server certificates and the Access Server web UI |
| Palo Alto Panorama | Now also certificates in Panorama and its Templates, with an optional push to managed firewalls |
VPN gateways are where an expired certificate hurts the most, because the people who notice are remote and can’t reach anything to tell you. OpenVPN Community Edition clients trust only the CA in their profile, so the first move to a new CA means updating client profiles once, and pinning the server name if that CA is public. The OpenVPN guide walks through it.
Load balancers and network access control
| Platform | What CertKit updates |
|---|---|
| A10 Thunder | Client SSL templates and the management web UI, over aXAPI |
| Kemp LoadMaster | A named certificate and its intermediates, so Virtual Service bindings keep working |
| F5 BIG-IP | Server SSL profiles, alongside the Client SSL profiles it already handled |
| Cisco ISE | Portal and EAP Authentication certificates on every node |
| Aruba ClearPass | HTTPS (RSA and ECC), RADIUS/EAP, and per-service certificates |
| Aruba Mobility Controller | The admin WebUI and captive portal |
When the EAP certificate on ISE or ClearPass expires, Wi-Fi authentication fails for everyone at once, and the error on the laptop says nothing useful about certificates.
Remote access, identity, and Windows
| Platform | What CertKit updates |
|---|---|
| VMware Horizon (Omnissa) (beta) | Connection Server certificates and Unified Access Gateway certificates |
| Microsoft Entra Application Proxy (beta) | Custom domain certificates on published apps, through Microsoft Graph |
| AD FS Web Application Proxy | Now also the proxy servers in front of your AD FS farm |
| Remote Desktop Services | Now also full deployments on Server 2016 and the HTML5 web client |
| Absolute Secure Access | The console and web API certificate (formerly NetMotion Mobility) |
Every Entra Application Proxy app with a custom domain carries its own copy of the certificate, uploaded by hand as a PFX. CertKit updates every app the certificate covers that its identity owns.
Applications, and an AS/400
| Platform | What CertKit updates |
|---|---|
| IBM i (beta) | Digital Certificate Manager, through the RSE API |
| Oracle WebLogic | The keystore, with SSL settings reloaded without a restart |
| Boomi | Runtime shared web server, API Gateway, and Developer Portal certificates |
| Elasticsearch and Kibana | PEM files and a service restart |
| PM2 | Every PM2 app reloaded, as root by default |
| Sisense (beta) | The Kubernetes TLS secret on Linux installs, kept in step with the installer’s config |
| Intermapper | An all-in-one PEM and a service restart |
| EZproxy | Numbered certificate files and a service restart, now as a built-in Windows template |
Yes, IBM i. If a certificate expires on a midrange system that has been running payroll since 1998, it still breaks payroll. Our first commit note on IBM i ended with “May god have mercy on our souls.”
Beta on any of these means it hasn’t run in enough customer environments for us to drop the label. If you run one of them, we want to hear how it goes.
Issuers, and everything else
Deployment wasn’t the only list that grew. You can now issue from Actalis, GlobalSign, AWS Certificate Manager, and SSL.com, next to the CAs CertKit already supported. Each one plugs into the same renewal and deployment flow.
Every built-in template is included on every plan. If your platform has an API, a CLI, or a config file and a service to restart, a custom deploy template (Business plan and up) can handle it today. The full list lives on the integrations page.
Tell us what’s in your rack, and it might be in the next roundup.
CertKit automates certificate lifecycle management so the appliance nobody wants to log into renews itself.