SSL/TLS certificate management
Certificate lifetimes
drop to 47 days.
Manage every certificate in one place. Renew on time, safely.
- longest certificate lifetime from 2029
- 47 days
- renewals per certificate per year, at minimum
- ×8
- manual installations
- 0
Certificate lifetimes are getting shorter
CA/Browser Forum ballot SC081v3 shortens the maximum validity of publicly trusted TLS server certificates in steps. Certificates issued from 15 March 2026 get 200 days; 100 in 2027 and 47 in 2029.
- 398days2020–2026
- 200days15 Mar 2026
- 100days15 Mar 2027
- 47days15 Mar 2029
A 47-day lifetime means at least 8 renewals per certificate per year. To keep a safety margin most organisations renew monthly, which makes it 12.
See your annual renewal workload
- Today · 200 days
- 1.370
- renewals / year
- 2029 · 47 days
- 5.820
- renewals / year
As the inventory grows, tracking with spreadsheets and server-specific scripts gets hard. Estimate: certificates × (365 / lifetime) × 1.5; every renewal includes issuance, installation and verification. The real workload depends on your renewal policy.
How Pecatra works
Pecatra detects an expiring certificate and sends an alert. The certificate is renewed, installed on the target system and verified. If the installation or reload fails, the backup is restored.
An inventory scan detects a certificate with 30 days remaining. Pecatra sends an alert, renews it through ACME, installs it and verifies the result.
- Inventory00:00.0
- Alert00:00.1
- Renewal00:00.4
- Pre-check00:07.5
- Backup00:07.9
- Installation00:08.3
- Verification00:11.1
- Record00:11.2
- 00:00.0Inventory scan: api.example.net expires in 30 days (threshold: 30 days)
- 00:00.1Alert sent via email and webhook (Teams); owner: Platform team
- 00:00.4ACME order created; DNS-01 validation started via Cloudflare
- 00:07.2New version v8 stored in the vault; private key protected in the vault
- 00:07.5Pre-check: backup and rollback support confirmed for the target
- 00:07.9Backup created and verified
- 00:08.3Certificate written atomically to the target; service reloaded
- 00:11.1TLS verification: served certificate fingerprint matches v8
- 00:11.2Audit record created and forwarded to the SIEM; alert closed
Every installation
ends with verification.
After every installation, Pecatra compares the certificate fingerprint served by the target with the expected version. Any mismatch is flagged immediately.
Based on the last installation. Run a live check to see the current state.
- active · v4web-01.example.netnginxserver_name=api.example.net · cert_path=/etc/nginx/ssl/api.pem
- active · v4web-02.example.netnginxserver_name=api.example.net · cert_path=/etc/nginx/ssl/api.pem
Built for your infrastructure
Certificate management stays in your network. Your data and private keys remain under your control.
- One static binary + PostgreSQL
- Deploys on a single server; no cloud service required.
- No agents on your servers
- Connects over SSH, WinRM and HTTPS. SSH host keys are pinned on first use.
- Your data stays protected
- Private keys and credentials live in an encrypted vault; they are never written in the clear to logs, API responses or the database.
- LDAP / AD sign-in, role-based access
- Manage access with Viewer, Operator and Admin roles. Second-person approval is enforced on the server.
- Immutable audit trail
- Every action is kept in an append-only audit trail chained with SHA-256. If you wish, records are forwarded to your own security monitoring system (SIEM) over syslog.
- External connections only where needed
- Connects to your ACME certificate authority, your DNS provider and, for validation, DNS resolvers during issuance and renewal. Notification, SIEM and directory connections depend on your configuration.
Is your certificate management ready for 47-day lifetimes?
See the whole process in a ten-minute live demo, from inventory to verified installation. Then evaluate Pecatra in your own environment, on your own systems.
- 1Initial assessmentWe analyse your infrastructure and certificate inventory together and define the scope and roadmap that fit your organisation.
- 2Live demoSee the full process, from inventory to verified installation.
- 3Proof of conceptTry Pecatra on your own infrastructure, with your own systems.