Run your own certificate authority, and stop finding out about expiry from an outage.
Kryptkeeper is a self-hosted CA and certificate lifecycle platform. It issues over ACME, EST, SCEP, CMP and Windows autoenrollment, finds the certificates you didn't know about, and renews and installs them without a person in the loop.
The whole certificate lifecycle in one place
Certificate authority
Root and intermediate CAs, templates with name, key-strength and SSH policy, CSR-in issuance, renew, revoke and import. Post-quantum ML-DSA and hybrid certificates with software keys.
Unattended renewal
Renews and installs on nginx, Apache and HAProxy over SSH, on hosts running the agent, and on Kubernetes, IIS, F5 and Citrix targets. Checks the served certificate, rolls back on failure, and tells the owner when it gives up.
Discovery and inventory
Network TLS scanning with ML-KEM detection, Kubernetes and service-mesh discovery, agentless WinRM discovery, CT log monitoring and a cloud key inventory.
Windows autoenrollment
Native MS-XCEP and MS-WSTEP servers, so domain machines enroll through Group Policy without an ADCS server.
Governance
Append-only audit log with SIEM forwarding, an approval queue that keeps proposer and approver apart, key dual control on by default, custom roles, OIDC, SAML and SCIM.
Revocation built in
OCSP responder and CRL distribution ship in the open-source release, not behind a paid tier.
Speaks the protocols your clients already use
certbot and acme.sh, network devices, MDM, and Windows clients all enroll against the same CA.
| Protocol | Spec | Typical client |
|---|---|---|
| ACME | RFC 8555 | certbot, lego, acme.sh; http-01, and dns-01 for wildcards |
| EST | RFC 7030 | Enterprise devices and services |
| SCEP | RFC 8894 | MDM and device enrollment with one-time challenges |
| CMP | RFC 4210 | Certificate Management Protocol clients |
| MS-XCEP / MS-WSTEP | [MS-XCEP] | Windows Group Policy autoenrollment |
| OCSP | RFC 6960 / 5019 | Real-time revocation checks |
| CRL | RFC 5280 | Revocation lists for offline and legacy clients |
Running in a few minutes
Docker Compose with SQLite. Set two different secrets in .env; the hub creates its root CA on first boot. The dashboard comes up on port 3000 and the API on 8080.
git clone https://github.com/bpmforge/kryptkeeper.git
cd kryptkeeper
cp env.example .env
# set APP_BOOTSTRAP_TOKEN and KRYPTKEEPER_KEYSTORE_PASSPHRASE
# (different values): openssl rand -hex 32
docker compose up -d
Helm, Terraform, binary, deb/rpm and air-gapped installs are in the deployment guide.
Signed without a key to leak
Checksums and images are signed keyless with Sigstore cosign, bound to the GitHub release workflow. There is no long-lived signing key to fetch or trust.
cosign verify ghcr.io/bpmforge/kryptkeeper:0.9.1 \ --certificate-identity \ "https://github.com/bpmforge/kryptkeeper/.github/workflows/release.yml@refs/tags/v0.9.1" \ --certificate-oidc-issuer \ "https://token.actions.githubusercontent.com"
Images: ghcr.io/bpmforge/kryptkeeper, -agent, -certmanager, -mcp for linux/amd64 and linux/arm64.
What's proven, what's beta
The version number is below 1.0 on purpose. Each area is labelled by how it was tested: validated means run against real clients, not only unit tests.
Validated
- ACME against certbot and lego
- EST, SCEP, CMP, OCSP and CRL against openssl
- SSH certificates with OpenSSH
- Unattended renewal on nginx and Apache, with rollback
- Windows autoenrollment on a Kerberos lab
- SQLite and PostgreSQL, including upgrades
Beta
- Reports, compliance evidence, CBOM, PQC readiness
- SAML, OIDC and SCIM
- CT monitoring and cloud inventory
- Terraform provider, Helm chart, MCP server
Experimental or unverified
- Multi-tenancy (not a security boundary yet)
- HashiCorp Vault and GCP Cloud KMS key stores
- F5 and Citrix plugins on real devices
- SCEP from network devices
Full detail is in the v0.9.1 release notes.