WerkWorks
DE Contact
Menu
← All products
Open Core

CertFleet

Keeps an eye on your certificates

An expired certificate can bring down a website or interrupt mail delivery. And the spreadsheet with expiry dates rarely stays current for long. CertFleet brings every company certificate into one place, monitors expiry and revocation, and alerts the responsible people in time. It can also check whether a renewed certificate is already deployed on the live system.

CertFleet grew out of everyday practice. TLS encrypts mail traffic, but many customer and partner relationships need S/MIME as well. That adds manual work: setup, renewals and keeping track of expiry dates. CertFleet makes that work simpler and less prone to mistakes.

SSL/TLSS/MIMEPGPMail gatewayPartner ExchangeOCSP/CRL

How it works

How CertFleet tracks certificates from collection to alert Certificates from servers, services and the partner portal flow into a versioned inventory. There they are monitored for expiry and revocation, including a check whether a renewed certificate is actually deployed. Well before expiry, an alert goes out to the people responsible. APPROVE DEPLOYED? EXPIRING SOON Servers & services TLS · S/MIME · PGP Certificate inventory versions · AES-256 keys Monitoring expiry · OCSP/CRL Partner portal one-time upload link Endpoint check TLS probe against live servers Alert before expiry Responsible people email reminder

Under the hood

Behind the simple surface sits a system built for company operations: a mail gateway that handles encryption in the mail flow automatically, and a server architecture that scales from a single container to a Kubernetes cluster.

Mail gateway (Enterprise)

The gateway sits as an SMTP smarthost between your existing MX and your mail server: outgoing mail is encrypted automatically with certificates from the inventory, incoming mail is decrypted with your own private keys. If a key is missing, the configured policy decides. It ranges from plaintext fallback to holding delivery in a retry queue.

Diagram: the mail gateway encrypts and decrypts mail between MX and mail server The mail gateway sits between the internet/MX and your own mail server, encrypts and decrypts mail automatically using the certificate inventory, and places undeliverable mail into a retry queue. INBOUND ENCRYPTED OUTBOUND DECRYPTED KEY LOOKUP NO KEY Internet / MX SMTP · STARTTLS ENTERPRISE CertFleet mail gateway automatic S/MIME & PGP crypto policy: enforce · opportunistic Mail server Exchange · Postfix · … Certificates & private keys S/MIME · PGP · AES-256-GCM Retry queue backoff · bounce on enforce

Server architecture

Three runtime units share the work: the web app, a worker for background jobs, and the mail gateway, all on one shared database. SQLite is enough to get started. With PostgreSQL every unit runs as multiple replicas, coordinated through job leases and a claim-based queue.

Diagram: CertFleet server architecture with web app, worker, mail gateway and database Browsers and API clients talk to the web app; a worker handles OCSP sweeps and reminders; the mail gateway runs as its own container. All three share one database, either SQLite or PostgreSQL. YOUR INFRASTRUCTURE DOCKER COMPOSE · HELM/K8S HTTPS Browsers & API clients app UI · REST API · portal OCSP/CRL responders revocation checks SMTP / MS Graph reminder delivery ×N Web app UI + API · port 3000 SSO · license gates ×N Worker OCSP sweep · reminders retry queue · retention ×N Mail gateway SMTP :2525 · STARTTLS Enterprise SQLite or PostgreSQL PostgreSQL: replicas · job leases · claim queue

Features

Labels show which capabilities are included in the core and which require a paid license.

Features
Features Included in core Business Enterprise
Versioning, expiry monitoring and reminders for the whole inventory
Revocation checks via OCSP and CRL, on demand or as a scheduled sweep
Endpoint monitoring: a TLS probe detects when a renewed certificate is not deployed yet
Encrypted storage of private keys (AES-256-GCM)
Mail gateway: automatic S/MIME/PGP encryption and decryption in the mail flow
Partner Exchange: a controlled upload portal for external partners
SSO login (Azure Entra OIDC, Keycloak) and Microsoft Graph sending
Enterprise module hook: plug your own extensions into the running system, for example automatically handing mail content to an AI pipeline like Weave
Deploy via Docker Compose or Helm, with SQLite or PostgreSQL
Portrait illustration of the founder of WerkWorks

Write to me

Whether you have product feedback or want to discuss working together, your message comes straight to me. I reply myself.

info [at] werkworks [punkt] de +49 1​76 48​99​30​12