Quickstart
Install CertAutoPilot, create your first admin user, onboard an ACME account and a DNS credential, then issue your first certificate — all on a single host, in under 15 minutes.
Concepts
The handful of nouns CertAutoPilot operates on — organization, project, ACME account, zone, certificate, distribution target — and how they fit together.
Architecture
CertAutoPilot is a single Go binary that runs in three modes — API, worker, scheduler — backed by MongoDB. This page describes process boundaries, the encryption envelope, and the audit chain.
Envelope encryption deep-dive
Every sensitive field in CertAutoPilot's database is protected by a two-level key hierarchy: a per-field Data Encryption Key (DEK) encrypts the payload; a single Key Encryption Key (KEK) wraps the DEK. This page is the cryptographic anatomy — what's in each envelope, how encryption and decryption flow, why the design looks this way.
Three runtime modes
One binary, three roles. certautopilot serve --mode=<x> picks which role this process plays. all is the single-host default; split them across pods when you want to scale each surface independently.
RBAC & tenancy
Organisation is the hard tenancy boundary. Project is the soft scoping inside an org. Roles compose across the two: an org role applies to every project by default; a project role can override that for one project. This page explains the model; the action matrices live in Auth → RBAC.
Frequently asked questions
The questions we answer most often. If yours is not here, check the relevant topic page or see Troubleshooting.