CertFlow.
CERTIFICATE LIFECYCLE MANAGEMENT

Certificates.
In Flow.

Fewer expiry dates to remember.
More control over your infrastructure.

CertFlow brings SSL/TLS certificate issuance, renewal and deployment together. Self-hosted and built for your infrastructure.

Explore editions Discover CertFlow
In development / Coming to certflow.ch
THE CERTIFICATE FLOWCONCEPT PREVIEW
01Issue
02Renew
03Deploy
*.example.ch
SSL/TLS certificate✓ Valid
IssuerLet's Encrypt
RenewalAutomated
DeploymentYour infrastructure
The entire lifecycle. One overview.
Your server. Your keys. Your control.
SSL / TLSACME & DNS-01SELF-HOSTEDCOMMUNITY & BUSINESS

01 / THE IDEA

One workflow.
Everything in sight.

From your first certificate to the next renewal: CertFlow is designed to handle repetitive tasks and bring clarity to complex environments.

01 — INVENTORY

Know what is running.

Keep track of certificates, validity periods and upcoming renewals in one place. So an expiry date never comes as a surprise.

02 — AUTOMATION

Set it up once.
Stay in flow.

Automate issuance and renewal with ACME and DNS-01. Spend less time on repetitive manual tasks.

03 — DEPLOYMENT

All the way to deployment.

Deploy certificates to servers and appliances. Community is planned to support NGINX, Apache, OPNsense and pfSense. Business adds integrations including FortiGate, F5 BIG-IP and Windows IIS.

INTEGRATIONS / COMPLETE CATALOGUE

One catalogue. Every integration.

From DNS records to target systems: these integrations are present in the current development build. Planned availability by edition is shown below.

Servers & appliances

7 CONNECTORS

NGINX

SSH · config test · reload

Community + Business

Apache

SSH · config test · reload

Community + Business

OPNsense

Trust API · import only

Community + Business

pfSense

Requires optional pfREST package

Community + Business

Fortinet FortiGate

FortiOS REST API · VDOM / HA

Business

F5 BIG-IP

iControl REST · Client SSL

Business

Windows IIS

OpenSSH + PowerShell · SNI

Business

DNS & DNS-01

18 INTEGRATIONS / METHODS

For Let’s Encrypt in Community and additional CAs in Business. Includes CNAME delegation for DNS-01 validation.

CloudflareHetzner (Console DNS / Cloud API)InfomaniakIONOS (domains)OVHcloudGoDaddyAWS Route 53Azure DNSGoogle Cloud DNSDigitalOceanDNS Made EasydeSECGandi LiveDNSNamecheapPowerDNS AuthoritativeRFC 2136 (TSIG)acme-dnsManual DNS

RFC 2136 enables dynamic DNS updates with TSIG, for example with BIND, Knot, PowerDNS and compatible Windows DNS configurations. Manual DNS requires operator action.

Hostpoint, green.ch and No-IP: delegation instead of a direct API integration

The project lists these three providers as not directly automatable. Use CNAME delegation to a supported DNS provider, acme-dns, RFC 2136 or manual DNS. They are not listed as native DNS API integrations.

Certificate authorities & protocols

ACME / API / CSR

Let's Encrypt

ACME · Production & Staging

Community + Business

DigiCert ACME

CertCentral / Trust Lifecycle · EAB

Business

DigiCert CertCentral API

REST API · Orders & Lifecycle

Business

SwissSign ACME

Production & Staging · RSA

Business

GoDaddy Certificates API

Production & OTE

Business

Custom ACME

Custom ACME directory · internal CA

Business

CSR & Import

Manual workflow for other CAs

Business

SwissSign is integrated via ACME; a SwissSign REST integration is not implemented. Production, staging and test presets are configured in the project; this does not mean production CA services have been tested.

Identity & notifications

SSO / SMTP / WEBHOOKS

OpenID Connect

SSO · Authorization Code + PKCE

Community + Business

SMTP

E-Mail · STARTTLS / TLS

Community + Business

HTTPS Webhooks

HMAC-SHA256 · Events

Community + Business

SSO group mapping is planned for Business. Native Slack/Teams connectors and Graph/SCIM directory synchronisation are not implemented; external services may be connected through a webhook relay.

02 / PLANNED EDITIONS

Your setup.
Your edition.

Get started for free with Let's Encrypt. Access the full feature set for professional environments.

FOR GETTING STARTEDPlanned

Community

Certificate management with Let's Encrypt for private, non-commercial use.

FreeCommunity edition
  • Let's Encrypt as the only certificate authority
  • Private, non-commercial use only
  • Self-hosted on your infrastructure
  • Automated issuance and renewal
  • SSO via OpenID Connect (OIDC)
  • NGINX, Apache, OPNsense and pfSense
Release coming soon
FOR YOUR ENTIRE INFRASTRUCTUREAll features

Business

The full feature set for businesses and service providers.

Full feature setPricing will be announced at launch
  • Licence for commercial use
  • All Community edition features
  • Let's Encrypt and commercial CAs
  • Additional FortiGate, F5 BIG-IP and Windows IIS integrations
  • Multiple tenants, roles and groups
  • SSO group mapping and audit logs
Details at launch

Commercial use requires a Business licence, even when using only Let’s Encrypt. Edition scope is planned; licence details will follow before release.

03 / WHAT COMES NEXT

Every good flow
starts somewhere.

CertFlow is under active development. This page offers a first look — a public release and a GitHub page will follow later.

Current stage: development & validation

Good to know.

When can I use CertFlow?

A release date has not been set yet. Information about the first release and downloads will be added here on certflow.ch.

Will the Community edition be free?

Yes. The free Community edition is planned to include Let's Encrypt, SSO via OpenID Connect, and integrations for NGINX, Apache, OPNsense and pfSense.

What will the Business edition include?

The Business edition is planned to include all CertFlow features, including commercial certificate authorities, DNS and deployment integrations, and features for teams and multiple tenants.

Where does CertFlow run?

CertFlow is being developed as a self-hosted application. You run certificate management on your own infrastructure.