Skip to content

CertIntel Documentation

Reference material for administrators and technicians integrating with, or configuring, CertIntel. Everything reporting-related here is also available on the versioned API - interactive docs at /api/v1/docs on your CertIntel deployment.

New to CertIntel? Start with Getting started.

Setting up Agent certificate workflows? The Workflow studio walkthrough covers the template library, shared settings, review, reusable workflows, and Windows store verification.

ACME client plugins

Use CertIntel delegated DNS-01 with simple-acme, win-acme, Posh-ACME, Certbot, or acme.sh. The Plugins section provides downloads, installation, credentials, staging tests and renewal setup for each.

Reporting integrations

The CertIntel Agent is the preferred method for reporting certificates, renewals and check-ins from your hosts. It handles monitoring, certificate workflows and reporting together, making setup and ongoing operation easier. Start with the Windows Agent or Linux Agent.

The integrations below are example scripts that use the API to report similar information when you need a custom integration or want to keep an existing ACME client:

  • ACME check-ins & renewals - the requests behind a scheduled ACME renewal run: a check-in before and after the run, the renewal event itself, and the enrich step that fills in real certificate details. Example wrappers for simple-acme, Certbot and Posh-ACME are downloadable from that page.
  • Internal certificate scanners - reporting certificates on hosts CertIntel can't reach itself, either by a live TLS probe from inside the network or by reading a machine's own Windows certificate store.

Agent (Windows and Linux)

A compiled service, CLI, and - on Windows - desktop app that can issue, renew, store, install and monitor certificates. Linux has a full-screen terminal interface (certintel tui) for the same day-to-day tasks. The agent contains its own ACME client and keeps private keys on the machine; simple-acme is not required for agent-managed workflows.

  • Windows: install & setup - the one-line bootstrap installer, the MSI, enrollment, the administrator-approval model of the desktop app, schedules, verified automatic updates and update requests from the dashboard.
  • Linux: install & setup - the systemd service, bootstrap installer, terminal interface, update checks and CLI updates, and what's different from the Windows build.
  • Certificate workflows & deployment - native ACME accounts, renewal actions, renewal history, ARI renewal timing, renewal and deployment windows, file/JKS/Windows storage and application installation.
  • Workflow studio & usage - illustrated setup, shared settings, references, conditions, import/export, Windows store verification, complete deployment examples, and the ACME DNS challenge timeline.
  • Modular workflows - bundled templates, field types, conditions, retries, secrets, validation rules, and every built-in action input.
  • Appliance deployment (remote) - deploying renewed certificates to F5 BIG-IP, FortiGate, PAN-OS, NetScaler ADC and SonicWall over their management APIs (Agent 1.5.0+; tested against simulated APIs).
  • Microsoft services - Exchange, Remote Desktop, RRAS/DirectAccess, SQL Server/SSRS, AD FS, NPS and WinRM templates (Agent 1.5.0+).
  • Linux service targets - HAProxy, Caddy, Traefik, LiteSpeed, Postfix, Dovecot, PostgreSQL and MySQL through root starter hooks (Agent 1.5.0+).
  • Server detection - pre-filling workflows from the machine's own server configuration, read-only and local (Agent 1.5.0+).
  • ACME providers & EAB setup - Let's Encrypt, ZeroSSL, SSL.com, Actalis, Google Trust Services, DigiCert, Sectigo and GlobalSign accounts, and GoDaddy through a custom directory.
  • Monitors & internal endpoints - local TLS probes, internal endpoints assigned by the platform, schedules, and the post-install re-check.
  • Certificate stores & files - reading Windows stores and PEM/CRT/CER/DER/PKCS#7/PKCS#12/JKS files.
  • Delegated DNS-01 - connecting a CertIntel delegation to a native certificate workflow, testing or rotating its key, and moving certificates off HTTP-01 (removed in Agent 1.5.0).
  • External simple-acme integrations - the separate reporting-script path for renewals that remain owned by simple-acme.
  • Install tokens & enrollment - the dashboard side: the organization token and one-time tokens, the generated install commands, approving a newly-enrolled device, the Agents page, and dashboard update requests (Update now, Update all outdated).

Certificates & monitoring

  • Certificates - the unified inventory for public probes, internal reports, and ACME renewals: search, cross-source sightings, certificate paths, expiry tracking, and TLS grades for monitored sites. CT findings have their own list.
  • Certificate Transparency (CT Log Watch) - watched domains, certificates CertIntel issued or already holds, and alerts on new name sets.
  • Trusted CAs & ignore list - validate chains with per-organization internal CA trust or independently suppress CA expiry alerts.
  • Private CA - CertIntel as an issuing CA for internal names, client and code-signing certificates: subordinate or standalone setup, issuance, CRLs, and using it from the Agent.
  • Delegated DNS-01 (dashboard) - creating a delegation record, the CNAME you publish, and Cloudflare's proxy gotcha.

Administration

  • API keys & authentication - key types, scopes, and narrowing a key to specific ingest resources.
  • REST API overview - hosts, authentication, pagination, error format and the resource families behind /api/v1.
  • Organizations, users & roles - the tenant / child organization hierarchy, the built-in role permissions, who can manage whom, demo accounts, and MSP mode (client co-branding, switch into a client, the Clients page).
  • Platform credentials - appliance logins and API tokens stored write-only and delivered sealed to the assigned Agent (Agent 1.5.0+).
  • Alerts & notifications - webhook, email, Slack, Discord, Teams, Pushover and ntfy destinations for certificate expiry, monitor failures, renewal outcomes and security warnings, plus periodic scheduled reports by email.
  • Branding & themes - tenant appearance, logos and favicons, per-user appearance, workspace and personal time zones, and the Windows Agent theme.

Single sign-on

  • Two-factor sign-in (TOTP) - authenticator apps and recovery codes for local accounts, the workspace policy, and administrator resets.
  • OIDC / SSO overview - concepts that apply to any identity provider: provider types, default-deny role mapping, the CertIntel.* claim convention, delegation and single logout.
  • Microsoft Entra ID setup - a full step-by-step walkthrough against Entra ID specifically, including app roles and front-channel logout.

Getting an API key

Each custom reporting integration needs a write-scoped API key created on the API Keys page in your dashboard. The key is shown once, in full, at creation (cik_<prefix>.<secret>) - save it somewhere durable immediately. Authenticate every request with a single header:

X-Api-Key: cik_<prefix>.<secret>

A key is bound to one child organization (or, for a tenant administrator, optionally workspace-wide). One integration key can be used across all reporting endpoints, or narrowed at creation time to renewals / checkins / internal_certs so a given script can only ever submit one kind of data. Agents use credentials created by install-token enrollment and managed on the Agents page - see Install tokens & enrollment.