Open alerts
Renewal due
Onboard an application
or create a team
The app is active. Pick how it will enroll. Credentials are shown once.
Approvals (maker-checker)
Findings
Readable private keys, public certificates nobody requested, certificates only keycensus knows, and static SSH keys that need action. Acknowledging needs a reason and is audited.
Scheduled sources
Discover TLS endpoints
Issuers
Every CA that can sign for Certadillo, which profiles and policy folders send requests to it, and what it has issued. Policy, approvals and audit are the same whichever one signs. Credentials are shown only as the kind of reference that holds them.
Add an installation
Installations
Each row is one certificate kept installed in one place. Push now issues under the app's policy, installs, checks the endpoint serves it, then retires the old one.
Last run
Targets
Add a target
Credentials are references only (env:, file:, vault:). A config with a password, token or secret in it is refused.
New folder
Rules only narrow what profiles allow. A locked rule cannot be changed in any folder below. Saving sends an approval request to an approver.
Policy tree
Rules flow down; a locked rule cannot be changed below its folder. Changes and moves are approval requests.
What one app gets
Request a signing key
Code-signing keys
Keys live in the HSM or Vault and never leave it. Release keys need an approver for every signature. Time stamping (RFC 3161) is at .
Signing requests
Static SSH keys
Shipping off the host
Audit trail
Certificate authorities
Crypto agility and PQC readiness
Exports