CertNanny

Initial request and renewal – Creation of PKCS#10 requests with x509v3 extensions such as Subject Alternative Names or Certificate Templates. Requests can be created template-based; authentication is either via static challenge password or HMAC function. Expiring certificates are automatically renewed via Proof-of-Possession (Certificate Re-Keying).

Registrar function – Authentication of requests via client certificate (Enrollment on Behalf) and processing of externally created PKCS#10 files. Certificate revocation is integrated.

Multi-platform support – Available for Linux (x86_64, ARM, others), Windows, macOS as well as AIX, Solaris and various BSD derivatives. A lean embedded variant is available for resource-constrained embedded systems.

Flexible keystore support – Native keystore management for OpenSSL/PEM and PKCS#12 format; additional formats (Java Keystore, Windows Certificate Store) can be connected via script hooks.

Modular enrollment protocols – Support for SCEP, EST and the OpenXPKI-native RPC protocol. An external mode is also available where CSR and certificate are handed over manually or by a local script.

Trust anchor and CA rollover management – CertNanny manages CA certificate chains and root certificates and supports fully automatic root CA rollover.

Monitoring integration – Any external monitoring and alerting systems can be connected via configurable state-change hooks. Notifications for failed renewals or imminently expiring certificates are thus easily realisable.

Multi-level configuration system – YAML-based configuration with defined priority levels: existing certificate, local configuration file, environment variables, command-line arguments, backend parameters and system environment. Settings can be flexibly overridden.

Servers and workstations in the company – CertNanny is set up as a systemd timer or cron job and automatically renews TLS certificates for web servers, mail servers and other services before expiry. Script hooks ensure that applications are automatically reloaded after a renewal. No central agent, no incoming connections – ideal for restrictive network segments.

IoT and embedded systems – The CertNanny Embedded variant enables secure certificate provisioning of field devices with minimal resource requirements. Minimal program code with embedded configuration, no external dependencies and support for various hardware and software platforms make CertNanny the ideal solution for IoT deployments. Integration of cryptographic hardware such as TPMs is possible; customer-specific hardware adaptations are available on request.

OpenXPKI Enterprise Edition – Together with OpenXPKI Enterprise Edition, CertNanny forms a decentralised Certificate Lifecycle Management system with powerful extension functions. In addition to standard enrollment protocols, additional authentication methods (HMAC, challenge-based) as well as workflow-supported approval processes are available. Certificate revocation on renewal, transaction IDs and multi-level approval workflows are fully integrated.

Existing CA infrastructure – CertNanny can be connected to virtually any CA product via SCEP and EST and augments existing PKI infrastructures with automated, decentralised lifecycle management on end systems – independent of the CA software used.

Mass rollout / batch operation – Via the registrar function, certificates can be applied for on behalf of other target systems (Enrollment on Behalf).