Certificate Lifecycle Management,
on Autopilot

CertAutoPilot requires MongoDB 6.0+ as its primary data store. The application runs as a single Go binary that can operate in three modes: API server, worker, and scheduler. For small deployments, run all three modes in a single instance. For high availability, deploy each mode separately with MongoDB replica sets. Docker images and docker-compose configurations are provided.

Yes. CertAutoPilot is fully self-hosted with no external service dependencies. For certificate issuance in air-gapped environments, use Microsoft AD CS (internal CA) instead of public ACME providers. All data stays within your network. SSRF protection prevents unintended outbound connections.

All sensitive data is encrypted using envelope encryption: each field gets a random AES-256-GCM data encryption key (DEK), which is itself encrypted by a key encryption key (KEK). The KEK version is tracked per record for seamless key rotation. Private keys are stored in a separate collection from certificates, and credentials use the same envelope encryption pattern.

Distribution uses a module system with 8 built-in targets: SSH, Kubernetes, IIS (via WinRM), F5 BIG-IP, Citrix NetScaler, HashiCorp Vault, Huawei Cloud (ELB/CDN/WAF), and Webhook. Each module supports Execute, DryRun, Validate, and Rollback operations. Large distributions automatically use fan-out execution — splitting targets into batches with configurable concurrency. Post-distribution validation verifies certificate deployment via TLS fingerprint checks.

The scheduler automatically retries failed renewals with exponential backoff. Notifications are sent via your configured channels (Email, Slack, Microsoft Teams) when renewals fail or when certificates approach critical expiration windows. The dashboard shows real-time renewal status, and the 47-day readiness score tracks your automation coverage.

Yes. Certificate operations can require approval before execution. Operators submit requests with preflight warnings, and designated approvers can approve or reject with comments. Self-approval is blocked. The approval workflow integrates with the notification system so approvers are alerted immediately.

CertAutoPilot exposes 190+ REST API endpoints under /api/v1. API keys can be scoped per project with configurable expiration and rate limiting. Go template variables are available for dynamic configuration. All operations available in the UI are also available via API, enabling full CI/CD integration.

Define discovery sources with CIDR ranges, hostnames, and port lists. The scanner connects to each endpoint, performs a TLS handshake, and captures the certificate chain with cipher suite information. Results are stored as an inventory with security findings (weak ciphers, deprecated TLS, self-signed certs, PQC vulnerability). Recurring scans detect drift — certificate replacements, issuer changes, and key rotations — with full change history per endpoint.