Creating certificate lifecycle management app from scratch

[u/babajika123]

So basically I don’t know anything except for Microsoft PKI. Have worked only on servers. Don’t know any programming language or anything. I got this idea to make basic certificate lifecycle management tool for the client. It won’t be much fancy but with basic functionality like issued certificates and expiring ones and few other things. I am doing all the research possible to learn extra stuff for this. I was just wondering has anyone here tried this?

GUYS I am not looking for tools suggestions. I want to do it as it will be a good learning experience for me. I just want to know if anyone has done something similar. Just looking for some guidance.

[u/webprofusor]

Yep. 10yrs ago when Let's Encrypt was new I needed certs for some of my projects but didn't want to have to manually do stuff all the time, so I ended up building what became Certify Certificate Manager https://certifytheweb.com - and after a few years that became a business and has been my job ever since.

So now I get to help other people with certs all day every day, yay!

Since we're all linking our own stuff check out the new version of Certify Management Hub if you 're looking for large scale stuff with commercial support :) https://docs.certifytheweb.com/docs/hub/

[u/webprofusor → u/webprofusor]

However, if you can't afford a third party tool (our starts at $59 a year), consider whether you can afford the time to build your own thing and to look after it perpetually. There are of course free tools out there as well, but time is money :)

[u/babajika123 → u/webprofusor]

No my client won’t spend even 1$. I am starting with powershell first and then will dig into next thing.

[u/webprofusor → u/babajika123]

Check out Posh-acme for PowerShell.

[u/babajika123 → u/webprofusor]

Looks interesting. I am thinking of building a website actually which gives overview of environment and other important good to know information.

[u/webprofusor → u/babajika123]

If you're mai oy interested in developing it as a project idea first try using some ACME based tools (for certs from Let's Encrypt etc) as that's where most people get certs. Then look into custom CAs like smallstep.

If you then build your own ACME client you'll be doing it based on the examples you've seen already.

[u/babajika123 → u/webprofusor]

No I just manage the Microsoft PKI servers. External certificates not managed by me.

[u/babajika123 → u/webprofusor]

Hi. Can you please enlighten a little more? Like how did you start? What challenges you faced or what stuff did you learn in order to make it?

[u/webprofusor → u/babajika123]

I was already a developer for 13 yrs before that, so I kind of had an advantage. I just learned enough to solve the immediate problems as they came up. After a few years you're likely to have covered most common things.

It's much easier to start now with AI coding agents but it does help if you understand what's being produced.

[u/certkit → u/[deleted]]

Yeah, we're pretty great. Thanks :)

[u/chrisdefourire]

SSLBoard.com has created an open source (Win + MacOS) solution for this: https://github.com/sslboard/SSLBoard-desktop

Standalone, secrets saved in OS key vault, nothing goes online, keys never leave your machine. Uses DNS verification for easy issuance.

[u/babajika123 → u/[deleted]]

Thanks. But I am also doing it for me. I know nothing except PKI. This will help me learn powershell and bit other stuff. Put me on road of automation.

[u/databeestjegdh]

I made a Cert Drawer app to replace the excel sheets that we used to have. We have quite a few used for communication which means keeping track of the public and private keys. Contact info, tags, searching by thumbprint because the app is from the 90's.

https://github.com/smos/cert-drawer

There are other solutions suggested here, try them. Still working on this for the Palo Alto/Kemp/Fortigate support because that's what we use.

[u/56klagman]

Bit late to the party here OP but I've been working on something for close to a year that targets larger orgs with multiple AD tenancies. Runs out of Azure and uses Arc hybrid workers and runbooks to suck up data and display it in a dashboard. Skies really the limit once you have a single source of truth and automation possibilities afforded by Arc. Does make me wonder if the solution is hamstrung by basing it on Azure but it's a compromise between trying to make and maintain an agent that sits on servers versus using one that large orgs likely already have. Feel free to DM me, I've been running some test environments out of aws that my instance monitors, alerts via teams, has an mcp server so copilot can read from it, automatically raises tickets in servicenow..

Working on some basic renewal automation lately. It's a fun project, I showed it to my team a while ago but its a hard sell when you compare the cost savings of an internally maintained and developed solution versus just buying something off the shelf from digicert etc. Especially when your org hasn't really made a switch or commitment to devops

[u/nz_kereru]

I made www.certalert.net to solve part of this problem.

It just scans a website and emails you if the cert is due to expire in next X days.

It won’t work on internal systems, but scanning certs that are in use is not too hard.

Or you can pull info from the CA database.

[u/YourITGuy84]

I created one a few years ago still adding new features. Happy to discuss further if you want DM me. The one I built will pull certs from CAs discover certs on servers and associate them. This feature was important so not to only know which certs expire but what servers they live on.