certctl: Self-hosted certificate lifecycle platform with 78 API endpoints for AI agent automation
What certctl is
certctl is a self-hosted certificate lifecycle platform with a full REST API, built specifically for automation by AI coding agents ("claws"). The creator has been developing it with Claude as a copilot from the beginning, resulting in approximately 15,000 lines of Go and TypeScript code with 744+ tests.
Key features and capabilities
The platform addresses the upcoming challenge of TLS certificate management as SC-081v3 pushes certificate lifespans to 47 days by 2029, requiring constant rotation across server fleets.
The API provides 78 endpoints covering:
- Certificate issuance
- Renewal operations
- Revocation processes
- Deployment workflows
- Agent management
- Policy enforcement
- Audit trail access
- Fleet health monitoring
- Metrics collection
Every operation available in the React dashboard is also available through the API. An MCP server is on the roadmap to expose all functionality as native MCP tools.
Practical use cases for AI agents
With structured API access, AI agents can:
- Query which certificates are expiring within a specific timeframe
- Trigger certificate renewals
- Check agent fleet status
- Pull audit logs
- Revoke compromised certificates
- Read OCSP status
This eliminates the need for browser automation or screen scraping, providing direct API access to the entire certificate lifecycle.
Infrastructure compatibility
The platform is issuer-agnostic, supporting:
- ACME/Let's Encrypt
- step-ca
- Internal certificate authorities
- Sub-CAs under enterprise roots
It's also target-agnostic with current support for:
- NGINX
- Apache
- HAProxy
Support for F5 and IIS is coming soon. This provides a single interface for AI agents regardless of the underlying infrastructure.
Development workflow
The creator maintains a "CLAUDE.md" file in the repository that tracks every milestone, file location, and architecture decision. Each development session starts by reading this document to provide full context in seconds. When a milestone ships, the document updates with what changed, enabling sustained work on a complex multi-milestone project across dozens of sessions without losing state.
📖 Read the full source: r/openclaw
👀 See Also
AutoBe: How Weak Local LLMs Fixed an AI Backend Generator's Architecture
AutoBe is an open-source AI agent that generates complete backend apps using TypeScript, NestJS, and Prisma. The team discovered their initial 100% compilation success produced unmaintainable code, then rebuilt with modular generation—crashing success to 40%—and used weak local LLMs like qwen3-30b-a3b-thinking to debug schema ambiguities.
Developer Creates Practical Claude Skills for Kotlin Multiplatform Projects
A developer built a public repository of Claude skills specifically for Kotlin Multiplatform work after finding existing skills too generic, opinionated, or thin. The skills cover architecture reviews, feature implementation, modularization, Compose Multiplatform UI, navigation, platform bridges, deep links, adaptive UI, testing, and build governance.
Open-source Claude Code reimplementation patched for local model compatibility
A developer patched the open-source Claude Code reimplementation to work with Ollama and local models by removing hardcoded Anthropic client dependencies. The CLI now auto-detects providers from model names and environment variables.
Sherlock: Apple Developer Docs as Local MCP for Claude Code
Sherlock indexes 70k Apple API symbols into SQLite FTS5 and provides 5 MCP tools + 3 auto-triggering skills to ground Claude Code in real docs, preventing hallucinations.