What NextPKI does.

Three areas, one inventory. Visibility shows you every certificate you run, automation renews and delivers it through the accounts you already hold, governance keeps the whole thing traceable.

Visibility
Automation
Governance
Platform
Sensor security model

Visibility

Know what you have before you automate anything.

Network discovery: A small Rust sensor opens TLS and STARTTLS handshakes against the hosts, ports and IPv4/IPv6 ranges you configure, and finds the private networks of its own interfaces (/24 to /30) on its own. Networks it has not been told about are reported for your approval, not scanned.
Certificate Transparency: Every publicly trusted certificate issued for one of your verified domains appears in the inventory within minutes, including the ones nobody ordered through your process.
Inventory: Subject, names, issuer, validity, key and signature algorithm, and every endpoint where a certificate was seen. Filter by type, organisation and coverage, including a view of certificates with no known source. Export as CSV.
Expiry alerts: 30, 14, 7 and 1 day before expiry and on the day itself. A daily e-mail digest to owners and admins, and webhooks for Slack, Microsoft Teams or any endpoint of yours.
Health alerts: A sensor that stops reporting, a network that is no longer covered, a network approval about to lapse: each is an alert in the same channels.

Automation

Renewals through your own CA accounts, delivered to the systems that serve them.

CA connectors: Connect the accounts you already hold: ACME providers such as Let’s Encrypt, and commercial CAs such as DigiCert, Sectigo and GlobalSign through their APIs. Credentials are stored encrypted per connector, and an issuer allowlist per connector keeps a renewal from landing at the wrong CA.
Renewal requests and approvals: Request a renewal from the certificate’s page, the API or the MCP server, or let the scheduler open it inside the renewal window. Requests move through an approval queue with a state machine that records every step, and spending caps per connector.
Deployment: The renewed certificate is delivered to the systems that serve it: load balancers, web servers, Kubernetes and cloud accounts, driven by the same approval model.
Post-renewal verification: After a renewal, NextPKI probes the live endpoint and raises an alert if the old certificate is still being served, if the endpoint is unreachable, or if something unexpected answers.

Governance

Access control, traceability and policy.

Roles and organisations: Owner, admin, operator, approver and viewer. Organisations below the tenant for teams or customers, with roles per organisation.
Single sign-on: SAML with your identity provider, passkeys, and passwordless e-mail login. No passwords to manage.
Audit log: Who changed what and when, across the tenant, viewable in the console.
Connected applications: See which scripts and assistants hold access through OAuth and revoke any of them.
Issuer policy: Name the issuers you allow and have every certificate from any other issuer flagged, with a report your auditor can read.

Platform

The console is one client. Scripts and assistants are the others.

Public API

A versioned REST API with token scopes for reading certificates and requesting renewals. It covers the inventory, renewal requests and sensor onboarding, documented from the same OpenAPI file the service is built from.

API reference

MCP server

An MCP server with OAuth lets an AI assistant such as Claude list certificates, show what expires soon, and, if you allow it, request a renewal. Renewal through the assistant is off until you switch it on.

Connect an assistant

Sensor security model

The sensor runs inside your network, so it is the part your security team will read first.

Read-only: It opens connections, completes the handshake and records the public side. It never holds, parses or transmits a private key.
Outbound only: One outbound mutual-TLS connection to your tenant. No inbound ports. The bootstrap token is single-use and expires in 30 minutes.
Source available: The source is published for review and self-build under the PolyForm Internal Use licence. Review it, build it, deploy the binary you built.
Signed releases: Checksums are signed; the installer verifies the signature before it trusts a download. A manual path lets a change board read every step first.

Install on Linux or macOS

NEXTPKI_BOOTSTRAP_TOKEN=npbst.… sh -c "$(curl -fsSL https://sensor.nextpki.com/latest/install.sh)"

The token comes from the console and is shown once. Install guide with the manual path

Start with the inventory.

Request an account and see your certificate estate in a day. Connectors and deployment targets are set up with you during onboarding.

Request access

What happens after you write