Technical documentation
Official documentation for Certinite: architecture, Windows IIS and Linux agents, ACME and commercial TLS flows, dashboard operations, and troubleshooting—optimized for teams automating certificate lifecycle management (CLM).
TL;DR: What is Certinite?
Certinite is a centralized Certificate Lifecycle Management (CLM) platform for Windows IIS and Linux web servers. A control plane (API + web dashboard) orchestrates ACME and commercial issuance; lightweight agents poll for work, validate domains, install certificates locally, and report results—so renewals and bindings stay repeatable instead of spreadsheet-driven.
Use this page as the entry point to how the product fits together. For capability marketing copy, see Features; for discussions and updates, visit Community.
Traditional automation often installs a heavy ACME client on every server and hopes each host is configured consistently. That pattern breaks at fleet scale: drift, opaque failures, and credential sprawl become normal.
Certinite centralizes orchestration: policy, visibility, and CA interaction live in the control plane. Edge servers run a small agent that executes only what must run locally (file writes, store imports, IIS or web-server binding).
Think of the dashboard and API as the control plane (what should happen, for which tenant, on which timeline). Agents are the data plane (what actually touches the certificate store and web server bindings on a specific machine).
Authenticates tenants, stores domain and certificate state, talks to ACME or commercial provider flows, and schedules jobs that agents can claim. It is the system of record for lifecycle status.
Outbound-only polling worker. Retrieves validation and installation jobs, performs privileged operations on the host, completes jobs with structured success or error payloads.
Multi-tenant operator UI for domains, agents, renewals, assignments, and monitoring signals—designed for daily operations, not one-off scripts.
Create a workspace, install an agent on each server that should receive certificates, and activate it with a one-time code from the dashboard.
Add domains and assign them to the correct agent so validation traffic and installation jobs route to the machine that serves the hostname.
For ACME HTTP-01, the agent writes challenge material where your web server can serve it. The control plane drives the CA side of the protocol.
Issued material is delivered to the agent as a job. The agent imports into the OS store and updates IIS or Linux web configuration according to the supported integration path.
Use the Windows agent when TLS terminates on IIS. Typical outcomes include PFX import into the Windows certificate store and site binding updates aligned to your hostname and SNI layout.
Use the Linux agent when HTTP-01 validation must be served by Nginx or Apache. Stack selection at registration time keeps validation paths consistent with your real port-80 server.
Operators spend most of their time in the tenant certificate panel: checking domain status, confirming which agent owns a hostname, and triggering safe operational actions when something is stuck.
Hardening is a shared responsibility: Certinite reduces manual secret handling, but you should still protect dashboard accounts, agent hosts, and outbound network paths.
Pick the path that matches your role: builders align with the control plane; operators install agents and manage domains; buyers compare plans on Pricing.
Standard designs use outbound HTTPS from the agent to the configured API base URL. HTTP-01 still requires your web server to answer validation requests on port 80 from the public internet according to your CA's requirements.
Yes. Install the Linux agent on hosts that run Nginx or Apache and manage those domains from the same tenant dashboard you would use for Windows.
The dashboard and agents talk to the same control-plane HTTP APIs described conceptually here. This page covers architecture and flows; contact us if you need formal integration materials for your environment.
Google OAuth (and email login) authenticate humans to the dashboard. Agents authenticate separately with server credentials issued during activation. Keep those concerns distinct when troubleshooting.
Use a non-production hostname, complete one issuance, confirm binding in the browser, then force or wait for a renewal cycle depending on your CA and plan. Capture agent logs if anything fails.
Create a workspace, install one agent on a lab host, and prove the full loop before rolling out fleet-wide.
