TLSPilot: Certificate Lifecycle Management

Two forces push at the same time.

Tenants let you group certificates and credentials. That keeps things tidy when you split by team or customer — and lets you limit issuers to certain tenants or apply permissions/roles only to specific tenants:

If an Enterprise CA (AD Certificate Services) is already available in the domain, TLSPilot detects it automatically. All templates the management service can access that allow server authentication certificates can then be used directly in TLSPilot — issued and deployed to your targets:

TLSPilot Private CA is ideal for certificates that do not need redundancy for CRL checking — for example Entra app registration authentication. TLSPilot Private CA offers various key algorithms (including ECC) and also allows CRL checking via OCSP:

Anything that follows the ACMEv2 standard can be entered in TLSPilot as a public cert source. From free public cert providers such as Let's Encrypt, ZeroSSL, etc., through to commercial CAs that support ACMEv2. Integration in TLSPilot is modular via JSON definition files that you can also write yourself. Many providers are already included — and only need configuration.

Domain validation uses DNS-01, HTTP-01, or TLS-ALPN-01. Many DNS providers are already included — plus manual DNS configuration and any that work per RFC2136. HTTP-01 can even be terminated on the management host itself with its own listener:

The catalog of direct deployment targets is huge, and many deployments can also be driven with a file path for certificate and key plus a configurable service restart / PowerShell code block (if the edition includes "Custom Deployments").

Many applications run under Nginx, Apache, IIS, etc. and can already be fully covered by those individual deployment targets. Custom Deployments also allow PowerShell for your own deployments. As long as the target system exposes an interface/API, a deployment with TLSPilot is possible.

See all supported deployment targets

Example of a deployment helper that configures RBAC with Entra ID as the identity provider or an Azure Application Gateway to obtain the permissions needed for future deployments. Everything follows best practice and the least-privilege principle:

So TLSPilot can be managed from wherever you need it, there is also a WebUI reachable in the browser — with authentication via an identity provider (AD or Entra ID). It does not only look like the Management Tool: it behaves the same way:

Role-based access control lets you define precisely and granularly which person or group (including nested groups) gets which access rights. On each certificate or credential, inheritance can also be broken and replaced with explicit permissions:

TLSPilot includes its own backup format, which can also be created automatically every 24 hours. Restoring individual components that have changed is then straightforward. With a migration backup you can also move the install quickly to another server:

Whether a normal renew in the renewal window, a forced renew, or a revoke with a replacement certificate: deployments are started again right after, and the deployment target’s health is checked — manually or in the background on the regular 24-hour cycle. Versioning stays clear, with roll-back, and every action is listed in history as well as in the log:

Simple, clear, and uncluttered — that was our credo building TLSPilot. Everyone should find their way around as quickly as possible, and find things where they expect them:

TLSPilot knows exactly when the renewal window for each individual certificate begins and when it should attempt to renew it — including different sources with different lifetimes, and even when those lifetimes keep getting shorter:

Each deployment target is checked regularly — configurable — for correctness. If something no longer matches, this can also trigger an alert on request. Multiple deployment targets per certificate are possible, each of which can be enabled or paused individually:

Secrets are stored securely in the Windows Credential Store (Local Machine) or can come from other sources — from Azure Key Vault through Delinea, CyberArk, BeyondTrust and other supported password safes. gMSA/dMSA with rotating passwords or certificates as secrets are also supported:

With alerts, specific events can trigger messages on different channels. Both the alert channel and the events can be configured in detail:

Whether Windows Event Logs, classic log files, or both — besides alerts, every operational action, audits of manual steps, and debug information can be recorded clearly and looked up at any time:

Want even more automation? No problem: besides the Management Tool and WebUI, TLSPilot also offers a full API and a PowerShell module so you can call every function directly: