What is CertForge?

CertForge is a certificate governance platform that gives security and operations teams a single place to define which domains can receive certificates, who must approve them, which CA issues them, and a complete audit trail of every issuance, renewal, and download. Developers get a standard ACME endpoint. Security gets policy enforcement and approval workflows. Everyone gets a dashboard instead of a spreadsheet.

​

Why CertForge

Most organizations accumulate certificate chaos over time: dev teams self-signing and ignoring browser warnings, ops manually tracking renewal dates and missing them, security with no visibility into what’s trusted where, and ACME automation bolted on per-application with no central policy. The result is outages from expired certs, shadow CAs no one controls, and audit findings because there’s no record of who approved what. CertForge is the governance layer that sits in front of your CAs — public ACME or internal — and enforces the rules your organization actually needs.

​

Two deployment options

​

Closed-loop delivery — issue and install, not just issue

CertForge doesn’t stop at signing a certificate. It completes the loop by delivering the cert to the endpoint that needs it — across every environment in your infrastructure.

• ACME clients (certbot, acme.sh, Caddy, Traefik, nginx, HAProxy) — the client requests, CertForge issues under your policy, the client installs and reloads. Full loop, no extra tooling.
• Kubernetes — certforge-issuer integrates natively with cert-manager; existing Certificate manifests work unchanged. cert-manager handles Secret storage and rotation.
• Network devices and private infrastructure — the open-source certforge-connector agent runs inside your network, reaches private management VLANs, and automates the full renew-and-install cycle for F5 BIG-IP, Ribbon SBCs, AudioCodes gateways, and any device you add.

The connector is open source and extensible. Adding support for a device not on the built-in list means implementing a four-method Go interface — a weekend project, not a vendor ticket. Your team controls the timeline. → Closed-loop delivery: all three paths explained

​

Key features

• Certificate Discovery — automatically surfaces every certificate in your environment via CT log scanning, active TLS scanning, and CA connector imports; each cert receives a governance status (tracked, untracked, or ungoverned) and is evaluated against your policy for violations
• CA Connectors — import your entire existing certificate inventory from external CAs (DigiCert, Sectigo, internal CAs) via lightweight connector binaries; discovered certs appear in the dashboard alongside CertForge-issued certs
• Domain Trust Profiles — policy objects that define which domains can get certs, which CA issues them, who must approve, allowed EKU, wildcard rules, max validity days, and key requirements
• Approval workflows — human-in-the-loop approval with full audit trail; SOC 2 and ISO 27001 compatible; configurable mandatory approval reasons
• ACME endpoint — drop-in replacement for Let’s Encrypt clients; works with certbot, acme.sh, and any RFC 8555 client
• Internal CA — built-in CA for internal domains; no external CA required for private PKI
• Network device automation — open-source certforge-connector automates certificate renewal for F5 BIG-IP, Ribbon SBCs, AudioCodes, and any device reachable from your management network; extensible with custom drivers for any additional device type
• Services — group hostnames and cert configurations under named services with owners; enables service-level coverage tracking and targeted expiry notifications to the right people
• Kubernetes / cert-manager — native cert-manager external issuer (certforge-issuer) routes cluster certificate requests through CertForge policy; existing cert-manager Certificate manifests work unchanged, policy is enforced transparently
• Dashboard — real-time KPIs across your entire certificate estate: CertForge Managed, CA Inventory, Tracked, Expiring ≤30 Days, and Ungoverned; with pending approval queue and recent activity feed
• REST API — full programmatic access for CI/CD pipelines, custom tooling, and integrations; token-authenticated
• Alerts — configurable rules for expiring certs, stale approval queues, and failing issuance; service owners receive targeted notifications listing only their service’s certs
• Reports — built-in reports for certificate inventory, expiring certs, service cert expiry (by service owner), service coverage, and approval activity; subscribe to scheduled email delivery from your profile
• Notifications — org-level notification channels: Webhook, Slack, Microsoft Teams, Webex; used for alert delivery, approval requests, and approval outcomes
• SSO / OIDC — integrate with any OIDC provider (Keycloak, Okta, Azure AD, etc.) for single sign-on
• Compliance frameworks — assign SOC 2, ISO 27001, PCI-DSS, or HIPAA to enforce policy requirements and generate audit evidence
• AI risk assessment — automatic risk scoring on approval requests with reasoning, stored in the audit trail
• DNS account management — configure DNS provider credentials in the UI (Cloudflare, RFC 2136); linked per Domain Trust Profile for automated ACME DNS-01
• SIEM integration — forward all audit events to your SIEM via HTTPS webhook or UDP syslog in JSON or CEF format (Enterprise tier)
• Audit log — immutable hash-chained record of every certificate, approval, and admin action; filterable by org, event type, actor, and date; exportable as CSV or JSON
• Tamper-evident audit chain — every approval decision is cryptographically linked in a hash chain: each record’s SHA-256 hash covers the record content plus the previous record’s hash. This proves to auditors that no certificate was issued without authorization and that the log has not been altered. Chain integrity is verifiable on demand from the UI.

​

Trust & security

CertForge is built for security-sensitive environments. The platform enforces policy before any certificate is issued, maintains a cryptographically protected audit trail, and supports MFA, SSO, and org-level isolation out of the box.