certctl: Self-hosted certificate lifecycle platform with 78 API endpoints for AI agent automation
What certctl is
certctl is a self-hosted certificate lifecycle platform with a full REST API, built specifically for automation by AI coding agents ("claws"). The creator has been developing it with Claude as a copilot from the beginning, resulting in approximately 15,000 lines of Go and TypeScript code with 744+ tests.
Key features and capabilities
The platform addresses the upcoming challenge of TLS certificate management as SC-081v3 pushes certificate lifespans to 47 days by 2029, requiring constant rotation across server fleets.
The API provides 78 endpoints covering:
- Certificate issuance
- Renewal operations
- Revocation processes
- Deployment workflows
- Agent management
- Policy enforcement
- Audit trail access
- Fleet health monitoring
- Metrics collection
Every operation available in the React dashboard is also available through the API. An MCP server is on the roadmap to expose all functionality as native MCP tools.
Practical use cases for AI agents
With structured API access, AI agents can:
- Query which certificates are expiring within a specific timeframe
- Trigger certificate renewals
- Check agent fleet status
- Pull audit logs
- Revoke compromised certificates
- Read OCSP status
This eliminates the need for browser automation or screen scraping, providing direct API access to the entire certificate lifecycle.
Infrastructure compatibility
The platform is issuer-agnostic, supporting:
- ACME/Let's Encrypt
- step-ca
- Internal certificate authorities
- Sub-CAs under enterprise roots
It's also target-agnostic with current support for:
- NGINX
- Apache
- HAProxy
Support for F5 and IIS is coming soon. This provides a single interface for AI agents regardless of the underlying infrastructure.
Development workflow
The creator maintains a "CLAUDE.md" file in the repository that tracks every milestone, file location, and architecture decision. Each development session starts by reading this document to provide full context in seconds. When a milestone ships, the document updates with what changed, enabling sustained work on a complex multi-milestone project across dozens of sessions without losing state.
📖 Read the full source: r/openclaw
👀 See Also
Lore: MCP Server That Shares AI Agent Session History Across Tools
Lore is an MCP server that indexes AI agent sessions into a local SQLite store, letting any agent—regardless of tool—access another's session history. Fresh client sessions, no shared context, yet agents can pull up past conversations on demand.
Browser Harness: Giving LLMs raw CDP access to self-correct browser tasks
Browser Harness strips away browser frameworks, giving LLMs direct CDP websocket access and letting them write missing tools mid-task. Demonstrated by self-inventing an upload_file() function.
Zerro: Point at Your Live App, Speak, and Watch Claude Code Edit It Instantly
Zerro is a Mac app that lets you point your cursor at a running app, describe a change aloud, and have Claude Code edit the real files live. It captures motion, resolves which element you mean, and checkpoints before each run.
E2a: Open-Source Email Gateway for AI Agents with SPF/DKIM Verification and Webhook/WebSocket Delivery
E2a is an authenticated email gateway for AI agents that verifies SPF/DKIM on inbound mail, delivers via webhook or WebSocket, and supports outbound email with human-in-the-loop approval.