Certificate management for people and AI agents.
certwerk finds the certificates in your company and renews them on time. Your AI assistants and agents work with it directly through MCP, within your policies and approvals. It all runs in your own Azure or AWS account.
certwerk is not available yet. This page describes the planned scope; we are looking for design partners for the launch.
Your agents ask. certwerk acts by your rules.
certwerk gets a built-in MCP server (Model Context Protocol) that runs inside your installation, with no hosted middleman. AI assistants such as Claude or Microsoft Copilot and your own agents can look up, request, renew and revoke certificates with it. You enable each tool individually.
› Which certificates expire in the next 14 days?
certificates.list expires_within=14d
3 results · shop.example.com (4 d) · vpn-gw-02 (9 d) · mail.example.com (12 d)
› Renew shop.example.com.
certificates.renew id=shop.example.com
Request created · waiting for approval by team Web (profile "Public TLS")
- Tools, not shell scriptsQueries, reports and lifecycle actions (request, issue, renew, revoke) as MCP tools. You enable the MCP server and each tool one by one.
- Writes need approvalActions that change something wait for an approval by default. Lift that per tool where you want to.
- Agents get only what you allowEvery agent signs in via OAuth and has its own identity with an owner, roles and scope. Profiles, policies and approval workflows apply to agents just as they do to people.
- Every action on recordWhat an agent looks up or triggers lands in the audit log: agent, owner, result.
- Protected against prompt injectionText from certificates, metadata and comments is treated as data, never as an instruction to the agent.
- Identities for machines, tooCI pipelines and Kubernetes sign in through workload identity federation, without long-lived keys.
Public TLS certificates are getting short-lived.
The CA/Browser Forum cuts the maximum lifetime of public TLS certificates in three steps. If you renew by spreadsheet and calendar reminder today, you will be doing it roughly eight times as often by 2029, and repeating domain validation far more often.
Maximum lifetime of publicly trusted TLS certificates under CA/B Forum ballot SC-081v3 (passed April 2025). Domain-validation reuse drops in parallel from 398 to 10 days. Private PKI is not affected.
Everything a mid-sized company needs for its certificates.
Planned scope at launch. It follows the large CLM suites, deliberately lean and built on open source.
Inventory and discovery
One view of every certificate with its owner, found by network scan, agent, import from ADCS or EJBCA and from public CA accounts.
Automatic renewal
Renewal and domain validation run on time without manual work, even at 47-day lifetimes.
Your own CA in your cloud
Private root and issuing CAs on OpenBao. CA keys stay in Azure Key Vault or AWS KMS and never leave the key service.
Public CAs connected
DigiCert and any ACME CA such as Let's Encrypt or HARICA, with automatic DNS validation.
Microsoft environments
AutoEnrollment for Windows clients, SCEP for Intune, import and gradual replacement of an existing Microsoft CA.
Approvals and evidence
Workflows with approvals, an owner per certificate, audit log and reports for auditors.
How it works.
You run certwerk in your own cloud account, with no hardware of your own.
- Deploy from the marketplaceAzure Marketplace or AWS Marketplace, into an existing network or with its own template. Works without a public IP.
- ConnectSign in with local accounts and MFA or through Microsoft Entra ID, pick Key Vault or KMS, start the agent in your internal network, import existing certificates.
- AutomateSet profiles, approvals and agent permissions. From then on certwerk renews by itself and only reports what needs attention.
Development status
certwerk is in active development and not yet available. The features above describe the planned scope.
Become a design partner
Want to try certwerk before launch or bring in your requirements? Write to us.
kontakt@certwerk.euExisting requests: support.certwerk.eu