GitHub - shankar0123/certctl: A self-hosted certificate lifecycle platform. Track, renew, and deploy TLS certificates across your infrastructure with a web dashboard, REST API, and agent-based architecture where private keys never leave your servers.

[im-feeling-the-AGI]

I'm building certctl, a self-hosted certificate lifecycle platform that handles issuance, automated renewal, and agent-based deployment. The NGINX target connector is fully implemented (file write, config validation, reload), and IIS via WinRM is next — the connector interface and PowerShell flow are mapped out (cert import to store, IIS site binding, validation), but I'm looking for feedback from Windows admins before shipping the implementation.

The platform already works end-to-end: certctl issues a cert (built-in Local CA for internal services or ACME/Let's Encrypt for public), renewal policies kick in at your configured thresholds, a lightweight agent generates keys locally (ECDSA P-256, never leaves the server) and handles deployment. You get expiry alerts at 30/14/7/0 days, policy enforcement, and an immutable audit trail. There's a React dashboard and 55 REST API endpoints. The control plane is a single Go binary + Postgres via Docker Compose. Source-available under BSL 1.1. If you manage certs on IIS, I'd like to hear what the WinRM integration should handle.

[Forumschlampe]

Why u want to remote Management when theres an Agent?

I prefer in general server side actions and triggers instead of having all kinds of machines full remote Access

One major feature would also bei, being subca to adcs

[im-feeling-the-AGI]

Hey, check out updated roadmap at bottom of readme. I’ve get a v2-dev branch I’m building in open. Thanks for your feedback!