Kryptkeeper
Feature

Linux and macOS hosts

Certificates that land on the host and renew themselves.

Run the lightweight agent on Linux and macOS, or manage hardened hosts agentlessly over SSH. Renewal policy is set per target, rollouts go canary first, and anything that fails lands in one queue.

kryptkeeper.example.com/targets/setup

Coming: Screens from the host side (installing the agent, the certificate landing on disk and the service reloading) are being captured on the lab hosts and will be added here.

How it works

  1. Enroll an agent

    Enroll a Linux or macOS host so it can receive and renew certificates.

    7 steps

  2. Manage a host without an agent

    Bring a host under management over SSH, with no agent installed.

    8 steps

  3. Set renewal policy per target

    Decide when each target renews and how it is checked.

    8 steps

  4. Issue SSH host and user certificates

    Replace long-lived SSH keys with short-lived signed certificates.

    7 steps

Docs

Paths that use this