From 55ad46558e7b01cad9203545765d3502ea6270d2 Mon Sep 17 00:00:00 2001 From: mervin008 Date: Thu, 24 Sep 2026 09:35:05 +0200 Subject: [PATCH 1/2] Publish the comparison in the Evaluate journey certpilot/certpilot#113 adds docs/comparison.md: CertPilot beside Keyfactor Command, Next-Generation Trust Security and DigiCert Trust Lifecycle Manager, every vendor statement quoted and dated. It belongs straight after the evaluation. A reader who has just run CertPilot is the one asking whether it is the right tool at all. One line in PAGES, one in the Evaluate journey, and the Evaluate nav item's activeMatch. The page itself is synced from certpilot once #113 merges: the sync's coverage check refuses main until this lands, which is the order certpilot-docs expects. Built with a local sync of #113's branch, which is not committed: 72 pages, 9090 links, none dead. Part of certpilot/certpilot#84. Co-Authored-By: Claude Opus 5.5 --- docs/.vitepress/config.ts | 2 +- docs/.vitepress/guide-sidebar.json | 4 ++++ scripts/sync-pages.mjs | 1 + 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts index da79a99..b2c6d1b 100644 --- a/docs/.vitepress/config.ts +++ b/docs/.vitepress/config.ts @@ -87,7 +87,7 @@ export default withMermaid( * hamburger. */ nav: [ - { text: 'Evaluate', link: '/evaluation', activeMatch: '^/(evaluation|getting-started|architecture|status|compatibility)' }, + { text: 'Evaluate', link: '/evaluation', activeMatch: '^/(evaluation|comparison|getting-started|architecture|status|compatibility)' }, { text: 'Walkthroughs', link: '/walkthroughs/', activeMatch: '^/walkthroughs' }, { text: 'Deploy', link: '/configuration', activeMatch: '^/(configuration|database|operations|security)' }, { text: 'Operate', link: '/discovery', activeMatch: '^/(discovery|monitoring|deployment|templates|posture|troubleshooting)' }, diff --git a/docs/.vitepress/guide-sidebar.json b/docs/.vitepress/guide-sidebar.json index 2df4a8d..a46f286 100644 --- a/docs/.vitepress/guide-sidebar.json +++ b/docs/.vitepress/guide-sidebar.json @@ -7,6 +7,10 @@ "text": "Evaluate CertPilot", "link": "/evaluation" }, + { + "text": "How it compares", + "link": "/comparison" + }, { "text": "Getting started", "link": "/getting-started" diff --git a/scripts/sync-pages.mjs b/scripts/sync-pages.mjs index ede80a2..07735b7 100644 --- a/scripts/sync-pages.mjs +++ b/scripts/sync-pages.mjs @@ -97,6 +97,7 @@ const check = process.argv.includes('--check') */ const PAGES = [ { source: 'evaluation.md', sentinel: '## 1. Start it' }, + { source: 'comparison.md', sentinel: '# How CertPilot compares' }, { source: 'getting-started.md', sentinel: '## 1. Generate development keys' }, { source: 'architecture.md', sentinel: '## Decision 1 โ€” a gateway is a process, not a package' }, { source: 'discovery.md', sentinel: '## Certificate Transparency' }, From ecbb6afc28c52d9a43c3af46f4cced8c482ec4b9 Mon Sep 17 00:00:00 2001 From: mervin008 Date: Thu, 24 Sep 2026 23:05:11 +0200 Subject: [PATCH 2/2] Publish the comparison, synced from certpilot 3d0a4bb certpilot#113 merged as 3d0a4bb. It adds docs/comparison.md, which this branch already places second in the Evaluate journey, and corrects the status page: three of the five deployment targets are unverified, not two, because the AWS ACM deployer has only ever answered a test stub. The deployment, security and documentation-checks pages carry the same correction, and the evaluation guide now ends by pointing at the comparison. Built and checked: 9090 links across 72 pages, 0 dead. Co-Authored-By: Claude Opus 5.5 --- docs/comparison.md | 265 +++++++++++++++++++++++++++++++++++ docs/deployment.md | 12 +- docs/documentation-checks.md | 10 +- docs/evaluation.md | 15 +- docs/security.md | 13 +- docs/status.md | 16 ++- 6 files changed, 306 insertions(+), 25 deletions(-) create mode 100644 docs/comparison.md diff --git a/docs/comparison.md b/docs/comparison.md new file mode 100644 index 0000000..c430b88 --- /dev/null +++ b/docs/comparison.md @@ -0,0 +1,265 @@ +--- +editLink: false +lastUpdated: 2026-09-24T21:03:20Z +source: + repo: certpilot/certpilot + path: docs/comparison.md + commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b +--- + + + +# How CertPilot compares + +This page puts CertPilot beside three commercial certificate lifecycle +platforms a central PKI team is likely to be weighing: + +- Keyfactor Command. +- The product line that began as Venafi TLS Protect. +- DigiCert Trust Lifecycle Manager. + +It uses only what each vendor publishes, cites the page every statement comes +from, and says plainly where that material does not answer the question. + +It is not a feature-parity table, and it does not rank anything. The commercial +platforms overlap with most of what CertPilot does: outbound agents, discovery, +approval workflows and validation after deployment are all documented by at +least one of them, and none of it is unique to CertPilot. What differs is +maturity, custody, the CAs each one reaches, and who you can call. + +**Reviewed 24 September 2026**, against the documentation versions listed under +[Sources](#sources). Vendor documentation changes. `make test-comparison-sources` +fetches every page quoted here and fails when a quoted sentence is no longer on +it, and the weekly documentation run does the same. + +## How to read it + +- **For CertPilot**, each capability carries the same marker as the + [implementation status](/status). These are claims about this repository, + backed by its CI or by the runs recorded beside them: + + | Marker | Meaning | + |:--|:--| + | โœ… | Supported | + | โš ๏ธ | Constrained | + | ๐Ÿงช | Unverified: built, but nothing here has run it against the real service | + | โŒ | Planned | + +- **For the commercial platforms**, a row says what the vendor's own + documentation says, linked to the source. +- **"Not found in the documentation reviewed"** means exactly that: the pages + under [Sources](#sources) did not answer the question. It is **not** a claim + that the capability is missing. Ask the vendor. +- **Nothing here is about price, compliance certifications or performance.** None + of it was reviewed, and none of it is claimed for any product, CertPilot + included. + +## Which fits + +### CertPilot fits when + +- **You want to evaluate certificate lifecycle management on infrastructure you + control.** The source is readable, the licence is Apache 2.0, and there is + nothing to buy. It is early-development software, and its own + [status page](/status) says not to run it in production yet. +- **Your CAs are ACME or HashiCorp Vault PKI.** Those gateways exist and have + issued real certificates. See [Integrations](#integrations). +- **The failure you most need to see coming is an expiring CA.** CertPilot + monitors the authorities first: expiry thresholds, CRL freshness, and an OCSP + request whose signature is verified. See [CA health](#ca-health). +- **Private keys have to stay on the host that uses them.** The host agent + generates keys locally and never sends them, with one known defect. See + [Key custody](#key-custody). +- **You want to extend it yourself.** Gateways and agents are separate processes + with published contracts, so adding a CA does not mean changing the core. See + [writing a gateway](/writing-a-gateway). + +### Another platform fits better when + +- **You need it in production now, with a vendor accountable for it.** CertPilot + has no support contract, no service level and no paid tier. See + [Support](#support). +- **Your CAs include Microsoft AD CS, AWS Private CA, Google Cloud CAS, DigiCert + or Sectigo.** CertPilot has no gateway for any of them yet. All three + commercial platforms document a connection to a Microsoft CA + ([K7](#sources), [V9](#sources), [D7](#sources)). +- **Certificate requests must be approved before they are issued.** CertPilot + has no approval workflow + ([#87](https://github.com/certpilot/certpilot/issues/87), + [#90](https://github.com/certpilot/certpilot/issues/90)). All three commercial + platforms document one. See [Governance](#governance). +- **You need notifications, sign-in through your identity provider, or cloud + inventory that you can rely on today.** CertPilot has built all three, but each + is ๐Ÿงช: nothing in this project has run it against a real Slack workspace, mail + server, identity provider or cloud account. +- **The platform's own keys must be protected by an HSM or a KMS.** CertPilot + holds its key encryption key in memory, loaded from an environment variable, a + file or Vault. Delegated unwrapping is not built. See + [security](/security#known-gaps). +- **You need certificates for people and devices.** CertPilot issues and deploys + certificates for servers and services, and it has no enrolment protocol for + users or devices, such as SCEP or EST. DigiCert, for example, documents + "private certificate issuance for users, devices, servers, and other IT + resources" ([D10](#sources)). + +## Products compared + +| Product | Vendor | Editions and deployment models, as documented | Documentation reviewed | +|:--|:--|:--|:--| +| CertPilot | Open source, Apache 2.0 | Self-hosted only, as containers or binaries. The latest core release is v0.1.1 | This repository at the commit this page was published from | +| Keyfactor Command | Keyfactor | **Keyfactor Command** installed on premises, and **Command SaaS**, "a cloud-based Certificate Lifecycle Management platform" ([K1](#sources)) | On-premises documentation suite v26.2.2, and v25.5.2 for one page; Command SaaS documentation "latest" | +| Next-Generation Trust Security, and Certificate Manager, Self-Hosted | Palo Alto Networks, formerly CyberArk, formerly Venafi | **Next-Generation Trust Security** is the SaaS edition: "the evolution of the SaaS certificate lifecycle management offering previously known as Venafi TLS Protect and, more recently, CyberArk Certificate Manager SaaS" ([V1](#sources)). **Certificate Manager, Self-Hosted** is "built and delivered on the Trust Protection Foundation" ([V2](#sources)). Automated Secure Keypair is "included in Certificate Manager - SaaS premium packages by default" ([V6](#sources)) | Self-Hosted documentation 26.1. The SaaS documentation at docs.venafi.cloud, which still calls it Certificate Manager - SaaS | +| DigiCert Trust Lifecycle Manager | DigiCert | DigiCert ONE, including "a private on-premises DigiCert ONE deployment" ([D2](#sources)) | docs.digicert.com, which is not versioned | + +Below, **Keyfactor** means Keyfactor Command, **NGTS** means the Palo Alto +Networks line in both editions, and **DigiCert** means Trust Lifecycle Manager. + +## Capability by capability + +### CA health + +Does it watch the certificate authorities themselves: their own expiry, and +whether their revocation endpoints answer? + +| | What is documented | +|:--|:--| +| CertPilot | โœ… A scheduled sweep of every CA: expiry thresholds, CRL freshness, and a real OCSP request whose signature, delegation and subject are verified. โœ… Vault issuers are imported into the CA inventory the moment a CA account connects. ๐Ÿงช Delivering the resulting alerts to Slack, a webhook or email is tested against fakes only. See [status](/status) and [monitoring](/monitoring) | +| Keyfactor | Revocation Monitoring gives a "Warning of upcoming expiration for a CRL" and a "Notification of expired CRLs" ([K10](#sources)). For OCSP, it "provides only information on whether or not the OCSP endpoint is responsive" ([K3](#sources)) | +| NGTS | Self-Hosted: "Certificate Revocation and CDP Monitoring is a feature that must be enabled when you install Trust Protection Foundation" ([V3](#sources)). SaaS: not found in the documentation reviewed | +| DigiCert | Not found in the documentation reviewed. DigiCert documents creating intermediate CAs and issuing from them ([D1](#sources)), but not monitoring another CA's CRL or OCSP health | + +### Key custody + +Where the private key is generated, and whether the platform can hold it. + +| | What is documented | +|:--|:--| +| CertPilot | โœ… The host agent generates keys on the host and never sends them. The Vault gateway signs CSRs by preference. โœ… Keys CertPilot does generate are sealed with AES-256-GCM envelope encryption before they reach the database. โš ๏ธ Known defect: renewing an agent-held certificate by hand makes CertPilot generate and hold a key for it ([#107](https://github.com/certpilot/certpilot/issues/107)). The key encryption key lives in the core's memory, with no HSM or KMS unwrapping. See [status](/status) and [security](/security) | +| Keyfactor | Both models. PFX enrolment requires "one of the Private Key Retention options" on the template ([K4](#sources)). On-device key generation provides "the ability to enroll for a certificate using a private key" ([K11](#sources)) "generated on the target hosting the certificate store" ([K5](#sources)) | +| NGTS | SaaS, with Automated Secure Keypair: "The VSatellite generates a key pair and a CSR" ([V4](#sources)) in your environment, and "Venafi cannot decrypt private keys that are stored in Certificate Manager - SaaS" ([V5](#sources)). That service is "included in Certificate Manager - SaaS premium packages by default" ([V6](#sources)). Self-Hosted: key storage was not reviewed | +| DigiCert | "An agent can generate a key pair and securely deliver a certificate to a server" ([D3](#sources)). A Recovery manager role exists to "Recover escrowed certificates" ([D5](#sources)) | + +### Lifecycle verification + +After a certificate is issued and installed, does anything check that the right +one is being served? + +| | What is documented | +|:--|:--| +| CertPilot | โœ… Every issuance and renewal is compared against what was asked for: key, names, validity. โœ… After a renewal, the endpoints discovery has seen serving the certificate are probed again, and a renewal that never reached them is reported. โœ… The agent reconnects after installing and rolls back on a mismatch, where a destination sets `verify`. A destination that does not set one has no check. See [status](/status), [templates](/templates) and [deployment](/deployment) | +| Keyfactor | Monitoring scans "inspect previously discovered endpoints to verify certificate presence, health, and expiration status" ([K6](#sources)). A check that the served certificate is the one Keyfactor has just deployed was not found in the documentation reviewed | +| NGTS | Self-Hosted network validation: "When certificate's serial number is retrieved and compared, Trust Protection Foundation can determine if the correct certificate is being used" ([V7](#sources)). SaaS: not found in the documentation reviewed | +| DigiCert | An agent can be set to restart the web server after installing, so "the newly installed certificate can be activated and validated" ([D6](#sources)). With that off, "you will need to manually restart the web server application and select the option to validate the installation" ([D11](#sources)) | + +### Integrations + +Which CAs it issues from, and where it installs. + +| | What is documented | +|:--|:--| +| CertPilot | **CAs:** โœ… ACME, run by hand against Let's Encrypt staging and in the walkthroughs against Pebble. โœ… HashiCorp Vault PKI. โœ… A self-signed CA for evaluation. ๐Ÿงช ACME External Account Binding. โŒ No gateway for AD CS, AWS Private CA, Google Cloud CAS, DigiCert or Sectigo; AD CS is first in line on the [roadmap](https://github.com/certpilot/certpilot/blob/main/ROADMAP.md). **Installs:** โœ… The agent installs to ten named platforms, nine tested in containers and IIS on a Windows runner. โœ… A signed webhook. ๐Ÿงช AWS ACM, Azure Key Vault and F5 BIG-IP. **Discovery:** โœ… network scans; ๐Ÿงช Certificate Transparency and cloud inventory | +| Keyfactor | "a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA" ([K7](#sources)). Command SaaS "is designed to integrate with a third-party Certificate Authority (CA) for certificate issuance" ([K2](#sources)) | +| NGTS | SaaS: Microsoft AD CS, set up "for issuing and importing certificates" ([V9](#sources)) through a VSatellite ([V12](#sources)), and "Connector CAs using the CA Connector Framework" ([V8](#sources)) | +| DigiCert | A Microsoft CA connector to "import, enroll, and manage certificates from private Microsoft certificate authorities (CAs)" ([D7](#sources)). Sensors discover through connectors: "Scans appliances, cloud providers, and CA's using connectors" ([D4](#sources)) | + +### Governance + +Who may do what, and whether a request can be held for approval. + +| | What is documented | +|:--|:--| +| CertPilot | โœ… Four roles, admin, operator, auditor and viewer, enforced per route. โš ๏ธ A policy engine and certificate templates, applied on all three issuance paths. โŒ No approval workflow: [#87](https://github.com/certpilot/certpilot/issues/87) and [#90](https://github.com/certpilot/certpilot/issues/90). ๐Ÿงช Sign-in through an identity provider over OIDC. See [status](/status) and [templates](/templates) | +| Keyfactor | Workflows with approval steps, whose "Approvers can be defined by selecting security roles directly or by using tokens that resolve to security roles" ([K8](#sources)) | +| NGTS | "Certificate Approval Workflows offer a structured approach to validating certificate requests" ([V10](#sources)) | +| DigiCert | "Require manual approval by a Trust Lifecycle Manager admin to authenticate enrollment requests" ([D8](#sources)) | + +### Operational evidence + +What it can show afterwards: an audit trail, and exports a reviewer can use. + +| | What is documented | +|:--|:--| +| CertPilot | โœ… A hash-chained audit log, with `GET /audit/verify` walking the chain and counting the entries it does not cover. The chain has no external anchor. โœ… CycloneDX 1.6 CBOM export, and CNSA 2.0 conformance per certificate. โœ… [Compatibility](/compatibility) with released gateways and agents, measured rather than maintained by hand. See [security](/security) and [posture](/posture) | +| Keyfactor | "The Keyfactor Command audit logs are an immutable record of all changes made to the state of the application" ([K9](#sources)) | +| NGTS | SaaS: "The Event Log shows a list of events logged as a result of either user actions or Certificate Manager - SaaS operational activities" ([V11](#sources)) | +| DigiCert | "maintains a comprehensive log of all events including those related to enrollments, certificate lifecycle activities, seats, and connectors" ([D9](#sources)) | + +### Support + +| | What is documented | +|:--|:--| +| CertPilot | Community only: [issues](https://github.com/certpilot/certpilot/issues), and security reports through [SECURITY.md](https://github.com/certpilot/certpilot/blob/main/SECURITY.md). No support contract, no service level, no paid tier. Early development | +| Keyfactor, NGTS, DigiCert | Commercial products. Support terms are set by contract and were not reviewed | + +## What this page does not claim + +- **That any capability is unique to CertPilot.** Where a row above says + CertPilot does something, at least one commercial platform documents something + comparable, or the row says the documentation reviewed did not answer. +- **That a commercial platform lacks anything.** "Not found in the documentation + reviewed" is a statement about the pages listed below. +- **Parity, price, compliance or performance** for any product. +- **A migration path** from any of these products to CertPilot, or the reverse. + +## Sources + +Every page was read on the date shown. The quoted text is copied from the page +exactly, and it is what `make test-comparison-sources` looks for. A row whose +quote has gone is a row to re-read, not one to delete. + +| ID | Vendor | Page | Version or date | Reviewed | Quoted | +|:--|:--|:--|:--|:--|:--| +| K1 | Keyfactor | [Command SaaS: Introduction and architecture](https://docs.keyfactor.com/command-saas/latest/introduction-and-architecture) | latest | 2026-09-24 | Command SaaS is a cloud-based Certificate Lifecycle Management platform | +| K2 | Keyfactor | [Command SaaS: Introduction and architecture](https://docs.keyfactor.com/command-saas/latest/introduction-and-architecture) | latest | 2026-09-24 | The platform is designed to integrate with a third-party Certificate Authority (CA) for certificate issuance. | +| K3 | Keyfactor | [Revocation Monitoring](https://software.keyfactor.com/Core-OnPrem/v25.5.2/Content/ReferenceGuide/Revocation%20Monitoring.htm) | v25.5.2 | 2026-09-24 | OCSP monitoring and notification provides only information on whether or not the OCSP endpoint is responsive. | +| K4 | Keyfactor | [PFX Enrollment](https://software.keyfactor.com/Core-OnPrem/v26.2.2/Content/ReferenceGuide/PFX%20Enrollment.htm) | v26.2.2 | 2026-09-24 | you must enable one of the Private Key Retention options in the certificate template details | +| K5 | Keyfactor | [ODKG - On Device Key Generation](https://software.keyfactor.com/Core-OnPrem/v26.2.2/Content/ReferenceGuide/On-Device-Key-Generation.htm) | v26.2.2 | 2026-09-24 | generated on the target hosting the certificate store | +| K6 | Keyfactor | [SSL Discovery](https://software.keyfactor.com/Core-OnPrem/v26.2.2/Content/ReferenceGuide/SSLDiscovery.htm) | v26.2.2 | 2026-09-24 | monitoring scans inspect previously discovered endpoints to verify certificate presence, health, and expiration status | +| K7 | Keyfactor | [PFX Enrollment](https://software.keyfactor.com/Core-OnPrem/v26.2.2/Content/ReferenceGuide/PFX%20Enrollment.htm) | v26.2.2 | 2026-09-24 | a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA | +| K8 | Keyfactor | [Workflow Definition Operations](https://software.keyfactor.com/Core-OnPrem/v26.2.2/Content/ReferenceGuide/WorkflowDefinitionsOperations_1_Simple.htm) | v26.2.2 | 2026-09-24 | Approvers can be defined by selecting security roles directly or by using tokens that resolve to security roles. | +| K9 | Keyfactor | [Audit Log](https://software.keyfactor.com/Core-OnPrem/v26.2.2/Content/ReferenceGuide/Audit%20Log.htm) | v26.2.2 | 2026-09-24 | The Keyfactor Command audit logs are an immutable record of all changes made to the state of the application. | +| K10 | Keyfactor | [Revocation Monitoring](https://software.keyfactor.com/Core-OnPrem/v25.5.2/Content/ReferenceGuide/Revocation%20Monitoring.htm) | v25.5.2 | 2026-09-24 | Warning of upcoming expiration for a CRL. Notification of expired CRLs. | +| K11 | Keyfactor | [ODKG - On Device Key Generation](https://software.keyfactor.com/Core-OnPrem/v26.2.2/Content/ReferenceGuide/On-Device-Key-Generation.htm) | v26.2.2 | 2026-09-24 | The ODKG page provides the ability to enroll for a certificate using a private key | +| V1 | Palo Alto Networks | [Certificate Manager Is Now NGTS](https://www.paloaltonetworks.com/network-security/next-gen-trust-security/certificate-manager) | not shown | 2026-09-24 | Next-Generation Trust Security is the evolution of the SaaS certificate lifecycle management offering previously known as Venafi TLS Protect and, more recently, CyberArk Certificate Manager SaaS. | +| V2 | Palo Alto Networks | [Certificate Manager Is Now NGTS](https://www.paloaltonetworks.com/network-security/next-gen-trust-security/certificate-manager) | not shown | 2026-09-24 | Certificate Manager, Self-Hosted, which is built and delivered on the Trust Protection Foundation | +| V3 | CyberArk | [Enabling CRL Verification](https://docs.venafi.com/Docs/26.1/TopNav/Content/CRL/t-CRL-enablingCRL-Verification.php) | 26.1 | 2026-09-24 | Certificate Revocation and CDP Monitoring is a feature that must be enabled when you install Trust Protection Foundation | +| V4 | CyberArk | [What is Automated Secure Keypair?](https://docs.venafi.cloud/vaas/automated-secure-keypair/what-is-automated-secure-keypair/) | not shown | 2026-09-24 | The VSatellite generates a key pair and a CSR. | +| V5 | CyberArk | [What is Automated Secure Keypair?](https://docs.venafi.cloud/vaas/automated-secure-keypair/what-is-automated-secure-keypair/) | not shown | 2026-09-24 | Venafi cannot decrypt private keys that are stored in Certificate Manager - SaaS. | +| V6 | CyberArk | [What is Automated Secure Keypair?](https://docs.venafi.cloud/vaas/automated-secure-keypair/what-is-automated-secure-keypair/) | not shown | 2026-09-24 | The Automated Secure Keypair service is included in Certificate Manager - SaaS premium packages by default. | +| V7 | CyberArk | [SSL/TLS network validation](https://docs.venafi.com/Docs/26.1/TopNav/Content/Validation/cco-validation-about-tpp.php) | 26.1, topic updated 17 November 2025 | 2026-09-24 | When certificate's serial number is retrieved and compared, Trust Protection Foundation can determine if the correct certificate is being used. | +| V8 | CyberArk | [Adding a certificate authority](https://docs.venafi.cloud/vaas/certificates/ca/adding-a-certificate-authority/) | not shown | 2026-09-24 | Connector CAs using the CA Connector Framework | +| V9 | CyberArk | [Adding a certificate authority](https://docs.venafi.cloud/vaas/certificates/ca/adding-a-certificate-authority/) | not shown | 2026-09-24 | Setting up Microsoft AD CS for issuing and importing certificates | +| V10 | CyberArk | [About certificate approval workflows](https://docs.venafi.cloud/vaas/certificates/workflows/c-about-certificate-approval-workflow/) | not shown | 2026-09-24 | Certificate Approval Workflows offer a structured approach to validating certificate requests. | +| V11 | CyberArk | [Event logging overview](https://docs.venafi.cloud/vaas/logging/c-about-activity-logging/) | not shown | 2026-09-24 | The Event Log shows a list of events logged as a result of either user actions or Certificate Manager - SaaS operational activities. | +| V12 | CyberArk | [Adding a certificate authority](https://docs.venafi.cloud/vaas/certificates/ca/adding-a-certificate-authority/) | not shown | 2026-09-24 | VSatellite Integration with Microsoft AD CS | +| D1 | DigiCert | [Trust Lifecycle Manager](https://docs.digicert.com/en/trust-lifecycle-manager.html) | last modified 17 September 2026 | 2026-09-24 | intermediate CA creation and private certificate issuance | +| D2 | DigiCert | [Additional requirements for private on-premises DigiCert ONE users](https://docs.digicert.com/en/trust-lifecycle-manager/client-tools/deploy-and-manage-agents/additional-requirements-for-private-on-premises-digicert-one-users.html) | not shown | 2026-09-24 | Users with a private on-premises DigiCert ONE deployment | +| D3 | DigiCert | [DigiCert agents and sensors](https://docs.digicert.com/en/trust-lifecycle-manager/get-started/overview/agents-and-sensors.html) | last modified 22 September 2026 | 2026-09-24 | An agent can generate a key pair and securely deliver a certificate to a server | +| D4 | DigiCert | [DigiCert agents and sensors](https://docs.digicert.com/en/trust-lifecycle-manager/get-started/overview/agents-and-sensors.html) | last modified 22 September 2026 | 2026-09-24 | Scans appliances, cloud providers, and CA's using connectors. | +| D5 | DigiCert | [User roles](https://docs.digicert.com/en/trust-lifecycle-manager/set-up-your-account/users-and-access/user-roles.html) | not shown | 2026-09-24 | Recovery manager Recover escrowed certificates. | +| D6 | DigiCert | [Configure agents](https://docs.digicert.com/en/trust-lifecycle-manager/build-your-inventory-and-ecosystem/deploy-and-manage-agents/configure-agents.html) | not shown | 2026-09-24 | The web server application gets automatically restarted so the newly installed certificate can be activated and validated. | +| D7 | DigiCert | [Microsoft CA connector](https://docs.digicert.com/en/trust-lifecycle-manager/connectors/certificate-authorities/link-to-microsoft.html) | not shown | 2026-09-24 | to import, enroll, and manage certificates from private Microsoft certificate authorities (CAs) | +| D8 | DigiCert | [Enrollment and authentication methods](https://docs.digicert.com/en/trust-lifecycle-manager/define-policies-to-ensure-compliance/certificate-profiles/enrollment-and-authentication-methods.html) | not shown | 2026-09-24 | Require manual approval by a Trust Lifecycle Manager admin to authenticate enrollment requests. | +| D9 | DigiCert | [Audit logs](https://docs.digicert.com/en/trust-lifecycle-manager/monitor-assets-to-prevent-downtime/reporting-and-auditing/audit-logs.html) | not shown | 2026-09-24 | maintains a comprehensive log of all events including those related to enrollments, certificate lifecycle activities, seats, and connectors | +| D10 | DigiCert | [Trust Lifecycle Manager](https://docs.digicert.com/en/trust-lifecycle-manager.html) | last modified 17 September 2026 | 2026-09-24 | private certificate issuance for users, devices, servers, and other IT resources | +| D11 | DigiCert | [Configure agents](https://docs.digicert.com/en/trust-lifecycle-manager/build-your-inventory-and-ecosystem/deploy-and-manage-agents/configure-agents.html) | not shown | 2026-09-24 | you will need to manually restart the web server application and select the option to validate the installation | + +## Keeping it true + +A vendor rewriting a page is the likeliest way for this one to go wrong without +anybody noticing. Keyfactor's v26.2 documentation suite had already moved one of +the pages quoted here by the time it was reviewed. So the quotes are checked +rather than trusted: + +```bash +make test-comparison-sources +``` + +It fetches each page and fails, naming the row, when the quoted text is no +longer on it or the page no longer answers. Fix a failure by re-reading the +source, correcting the row that depends on it, and updating the version and the +review date. Deleting the quote to make it pass is not a fix. + +CertPilot's own rows are checked the same way the rest of the documentation is: +see [documentation checks](/documentation-checks). diff --git a/docs/deployment.md b/docs/deployment.md index cdedd62..d0bef36 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -1,14 +1,14 @@ --- editLink: false -lastUpdated: 2026-09-21T21:48:46Z +lastUpdated: 2026-09-24T21:03:20Z source: repo: certpilot/certpilot path: docs/deployment.md - commit: 9e9a566000099c09d1f96546a3b48910ca0fa6db + commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b --- - + # Deployment @@ -141,6 +141,10 @@ from the one asked for. SigV4 is signed by hand ([`core/engine/cloudsync/sigv4.go`](https://github.com/certpilot/certpilot/blob/main/core/engine/cloudsync/sigv4.go)). There is no AWS SDK anywhere in this project. +> Tested against a fake that answers the way ACM does. Nothing in this +> repository or its CI holds an AWS credential, so AWS itself has never checked +> one of these signatures. + ### azure_key_vault ```json diff --git a/docs/documentation-checks.md b/docs/documentation-checks.md index a1bf92b..39bf459 100644 --- a/docs/documentation-checks.md +++ b/docs/documentation-checks.md @@ -1,14 +1,14 @@ --- editLink: false -lastUpdated: 2026-09-23T06:59:39Z +lastUpdated: 2026-09-24T21:03:20Z source: repo: certpilot/certpilot path: docs/documentation-checks.md - commit: bc8c475b00fd7bb7c04dfb24906aabe8b3b80646 + commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b --- - + # Documentation checks @@ -31,6 +31,7 @@ that the site shows what this repository says. | `npm run check:links` in certpilot-docs | Every link, anchor, image and stylesheet on the **built** site lands | Links to other sites | Every certpilot-docs pull request, after the build | | `make test-doc-versions` | Every pinned image tag, module version and release ref is published. Each page names one version per component, and a pinned gateway or agent is one [compatibility.md](/compatibility) measured | Whether a pinned *combination* works. Only the evaluation run shows that, and only for its own pair | Docs pull requests, weekly | | `make test-evaluation` | [evaluation.md](/evaluation), run as written against the release it pins, does what sixteen of its sentences say | Every sentence it does not assert | Docs pull requests, weekly | +| `make test-comparison-sources` | Every vendor sentence [comparison.md](/comparison) quotes is still on the vendor's page, and every claim there cites a source the page lists | Whether the vendor's documentation is right, or anything it does not say | Weekly, and on pull requests that change the comparison | | `sync:pages --check` and `sync:guides --check` in certpilot-docs | The site shows exactly what this repository says, and records which commit it came from | Whether this repository is right | Every certpilot-docs pull request | | `make test-doc-checks` and `npm run test:checks` | Each check above fails on the breakage it exists to catch, and passes once that is corrected | Nothing beyond that. This one checks the checks | Docs pull requests, weekly | @@ -64,6 +65,7 @@ that existed, because every check reads syntax, and these were about behaviour. | The agent and the gateways "both speak gRPC" | A draft, caught in review | The agent speaks REST and has no `.proto` | Never published | | Vault is "the only gateway that answers GetCAInfo" | A draft, caught in review | ACME answers it as well. Vault is the only one that returns *issuers* | Never published | | `config.example.yaml` "defaults to a wildcard CORS origin" | A draft, caught in review | It sets `http://localhost:3000` | Never published | +| Deploying to servers: "Two of those five are ๐Ÿงช" | `status.md` | Three are. The AWS ACM deployer has only ever answered a stub, and no CI job holds an AWS credential. Found while writing the comparison on 24 September | Two days as that sentence. The โœ… it replaced had said all five | The two that were published follow the same pattern, and it is the one most worth knowing. **A sentence saying that something does not exist was true when diff --git a/docs/evaluation.md b/docs/evaluation.md index 1452ac2..70dcd28 100644 --- a/docs/evaluation.md +++ b/docs/evaluation.md @@ -1,14 +1,14 @@ --- editLink: false -lastUpdated: 2026-09-22T22:16:14Z +lastUpdated: 2026-09-24T21:03:20Z source: repo: certpilot/certpilot path: docs/evaluation.md - commit: 644ae5280b83d4ad4c6949c0a936ee05c999e664 + commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b --- - + # Evaluate CertPilot @@ -257,3 +257,10 @@ stack does the wrong way on purpose: `deploy/docker-compose.yml` and `deploy/config.production.example.yaml` are the files to start from for that, and [operations](/operations) is the page. + +## Whether it is the right tool at all + +[How CertPilot compares](/comparison) puts it beside Keyfactor Command, Palo +Alto Networks' Next-Generation Trust Security and DigiCert Trust Lifecycle +Manager. It uses only what each vendor documents, dates every source, and says +when one of them fits better than this does. diff --git a/docs/security.md b/docs/security.md index 0e20f7c..e344c02 100644 --- a/docs/security.md +++ b/docs/security.md @@ -1,14 +1,14 @@ --- editLink: false -lastUpdated: 2026-09-14T08:49:03Z +lastUpdated: 2026-09-24T21:03:20Z source: repo: certpilot/certpilot path: docs/security.md - commit: 95b0481beab6b8ff0992e82b1bf81913c39620ba + commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b --- - + # Security model @@ -530,8 +530,9 @@ internally consistent. Detecting either needs the head tag published somewhere append-only โ€” a second system, an object-lock bucket, a printed page โ€” on a schedule. Not built. -**Key Vault and F5 deployers are unit-tested only.** Written to their published -APIs; never run against a real vault or appliance. +**The AWS ACM, Key Vault and F5 deployers are tested against fakes only.** +Written to their published APIs; never run against a real AWS account, vault or +appliance. **The KEK is held in the core's memory.** It can now be loaded from a file or from Vault rather than an environment variable, but wherever it comes from the diff --git a/docs/status.md b/docs/status.md index 91dbc98..a39c25c 100644 --- a/docs/status.md +++ b/docs/status.md @@ -1,14 +1,14 @@ --- editLink: false -lastUpdated: 2026-09-22T07:37:13Z +lastUpdated: 2026-09-24T21:03:20Z source: repo: certpilot/certpilot path: docs/status.md - commit: da9423f87e1a52249cf9d42a7a2a8d04e5413775 + commit: 3d0a4bbf19f28a3596cfcd41d01eccb8b32df74b --- - + # Implementation status @@ -77,7 +77,7 @@ This is early development software. Do not run it in production yet. | Notifications | ๐Ÿงช | Slack (Block Kit), signed generic webhook, SMTP email. Deliberately not Teams or PagerDuty. Every transport is tested against a fake receiver; none against the real service | | Store conformance testing | โœ… | One suite run against both the in-memory store and a real PostgreSQL, covering the four classes of defect that had only ever been found by running the thing. Plain PostgreSQL is a supported target and proven by the suite | | Cryptographic posture | โœ… | Which endpoints negotiate a post-quantum key exchange and which do not, from real handshakes; CNSA 2.0 conformance per certificate; CycloneDX 1.6 CBOM export validated against the published schema. Post-quantum *issuance* waits for `crypto/x509` | -| Deployment to servers | โš ๏ธ | Durable, retried, audited deployment to a signed webhook, a host running the agent, AWS ACM, Azure Key Vault and F5 BIG-IP. **Two of those five are ๐Ÿงช.** **A renewal deploys itself**, and a failing target halts the rest of the rollout rather than letting a bad certificate march through the estate. The webhook and agent targets are exercised end to end by CI; Key Vault and F5 are written to their published APIs and unit-tested, and neither has ever been run against a real vault or appliance | +| Deployment to servers | โš ๏ธ | Durable, retried, audited deployment to a signed webhook, a host running the agent, AWS ACM, Azure Key Vault and F5 BIG-IP. **Three of those five are ๐Ÿงช.** **A renewal deploys itself**, and a failing target halts the rest of the rollout rather than letting a bad certificate march through the estate. The webhook and agent targets are exercised end to end by CI; AWS ACM, Key Vault and F5 are written to their published APIs and tested against fakes, and none has ever been run against a real AWS account, vault or appliance | | Deployment profiles | โœ… | Ten platforms the agent installs to by name: nginx, Apache, HAProxy, Caddy, Tomcat, PostgreSQL, MariaDB/MySQL, Postfix, Dovecot, IIS. The nine Linux ones are tested by `make verify-profiles` in [certpilot-agent](https://github.com/certpilot/certpilot-agent), which runs the service in a container, installs a certificate through the agent, and confirms over TLS that the service returns it after reloading; IIS cannot run in a container and is held to the same bar on a Windows runner instead. A profile supplies defaults; any field set on the destination takes precedence. See [platforms](/platforms/) | | Host agent | โœ… | One binary that enrols, inventories, **requests certificates with keys it generates locally and never sends** โ€” CertPilot cannot produce them and does not claim to โ€” then installs them where the server actually reads them and reloads it โ€” as PEM, as a PKCS#12 keystore for anything on the JVM, or into the Windows certificate store for [IIS](/platforms/iis), which reads no file at all. Bounded by grants an operator writes in advance โ€” which now say *which template* a host may use, so the same rules and the same estate-wide floor apply to a host as to a person. Linux and Windows โ€” see [where it runs](/agent#where-it-runs) | | Vault issuers in the CA inventory | โœ… | Connecting a CA account records the CAs behind it, and from that moment they are monitored, thresholded and alerted on like everything else. The importer refreshes what the certificate says and never touches what an operator decided โ€” the name, the thresholds, the owning team | @@ -118,8 +118,10 @@ with their reasoning in [security.md](/security#known-gaps). - The audit chain has no external anchor. An attacker holding both the database and the key encryption key can rewrite it wholesale, or truncate the newest entries. -- The Azure Key Vault and F5 BIG-IP deployers are written to their published - APIs and unit-tested. Neither has been run against a real vault or appliance. +- The AWS ACM, Azure Key Vault and F5 BIG-IP deployers are written to their + published APIs and tested against fakes. None has been run against a real + AWS account, vault or appliance, so ACM's hand-signed requests have never been + checked by AWS itself. - **Six capabilities are marked ๐Ÿงช above**: External Account Binding, OIDC authentication, CA expiry alerting, notifications, cloud inventory and Certificate Transparency. Each depends on a third party โ€” an identity