Certificate lifecycle on autopilot.

CertAutoPilot requires MongoDB 6.0+ as its primary data store. The application runs as a single Go binary that can operate in three modes: API server, worker, and scheduler. For small deployments, run all three modes in a single instance. For high availability, run several replicas against a MongoDB replica set — the scheduler is leader-elected, so only one instance runs the sweeps at a time. Install with the standalone Linux installer (including a one-command multi-node install that builds its own MongoDB replica set), Docker Compose, or the Helm chart.

Yes. CertAutoPilot is fully self-hosted with no external service dependencies. For certificate issuance in air-gapped environments, use Microsoft AD CS (internal CA) instead of public ACME providers. All data stays within your network. SSRF protection prevents unintended outbound connections.

All sensitive data is encrypted using envelope encryption: each field gets a random AES-256-GCM data encryption key (DEK), which is itself encrypted by a key encryption key (KEK). The KEK version is tracked per record for seamless key rotation. Private keys are stored in a separate collection from certificates, and credentials use the same envelope encryption pattern. Alternatively, a distribution credential can reference an external secret store — HashiCorp Vault, OpenBao or ManageEngine PAM360 — in which case CertAutoPilot stores no value at all: the credential is read from your secret manager at the moment it is used, never cached, so a rotation on your side takes effect immediately.

Distribution uses a module system with 17 built-in targets: SSH, Kubernetes, IIS, Windows (WinRM), F5 BIG-IP, Citrix NetScaler, HashiCorp Vault, Huawei Cloud (ELB/CDN/WAF), AWS ACM, Azure Key Vault, Cloudflare, cPanel/WHM, Webhook, Email (SMTP), Microsoft Exchange, MerlinCDN, and Palo Alto PAN-OS. Every module supports Execute, DryRun, and Validate. Rollback is centralized and versioned: all 17 modules can re-deploy any retained previous certificate version through the module's normal deploy path, either from a version picker in the UI or automatically after a failed run (push modules like Webhook and Email re-send the previous version). Large distributions can use fan-out execution — splitting targets into batches with configurable concurrency (enabled via a configurable threshold). Post-distribution validation verifies certificate deployment via TLS fingerprint checks.

The scheduler automatically retries failed renewals on an escalating backoff ladder (15 minutes up to 24 hours), and a safety-net sweep keeps re-driving a failing certificate every couple of days until it renews or actually expires. Notifications are sent via your configured channels (Email, Slack, Microsoft Teams, generic webhooks) when renewals fail or when certificates approach critical expiration windows. The dashboard shows real-time renewal status, and the 47-day readiness score tracks your automation coverage.

Yes. Certificate operations (issue, renew, reissue, revoke, download), configuration changes, and distribution actions can require approval before execution. Operators submit requests with preflight warnings, and designated approvers can approve or reject with comments. Self-approval is blocked. The approval workflow integrates with the notification system so approvers are alerted immediately.

CertAutoPilot exposes 250+ REST API endpoints under /api/v1. Automation authenticates with JWT Bearer tokens — create a dedicated least-privilege service user per pipeline and scope it to a project with the built-in RBAC roles. Go template variables are available for dynamic configuration. All operations available in the UI are also available via API, enabling full CI/CD integration.

Define discovery sources with CIDR ranges, hostnames, and port lists — or let CertAutoPilot find the hostnames for you from Certificate Transparency logs, DNS zone transfers (AXFR), and cloud DNS (Cloudflare and Google Cloud DNS). The scanner connects to each endpoint, performs a TLS handshake, and captures the certificate chain with cipher suite information. Results are stored as an inventory with security findings (weak ciphers, deprecated TLS, self-signed certs, PQC vulnerability). Recurring scans detect drift — certificate replacements, issuer changes, and key rotations — with full change history per endpoint.