Kryptkeeper
Feature

Automation and enrollment

Speaks the protocols your clients already use.

Servers renew over ACME, devices enroll over SCEP, EST or CMP, and agents or agentless targets install certificates where they are used. Rollouts go to a canary first, and failures wait in one queue.

kryptkeeper.example.com/acme

How it works

  1. Set up ACME for a server

    Create a provisioner and EAB key, then point an ACME client at it.

    15 steps

  2. Enroll devices with SCEP, EST or CMP

    Configure device enrollment and see a device enroll.

    23 steps

  3. Enroll a satellite agent

    Enroll an agent that installs certificates on its host.

    7 steps

  4. Add an agentless target

    Manage a target over SSH or WinRM with nothing installed.

    8 steps

  5. Roll out to a cluster, canary first

    Send a certificate to one node, check it, then the rest.

    9 steps

  6. Watch the failed-renewal queue

    See every renewal that needs a person, in one place.

    3 steps

Docs

Paths that use this