TLS certificates expire. Lucerta renews them for you.
A single inventory, renewal policies and automatic jobs: Lucerta manages the whole TLS/SSL certificate lifecycle across your distributed infrastructure, with a full audit trail and an mTLS agent channel.
Free edition: up to 10 registered agents. No credit card.
Nobody finds out a certificate expired until the outage.
Certificate lifetimes keep getting shorter, the number of certificates keeps growing, and manual management can't keep up. The bill always arrives the same way: a service goes down.
-
Scattered expirationsCertificates across dozens of servers, each with its own calendar. Without a single inventory, the date you miss is the one that costs you an outage.
-
Manual renewal at the CAsEvery renewal means logging in to the CA, repeating the procedure and distributing the certificate by hand. Mistakes and oversights are the norm.
-
Fewer and fewer valid daysCAs keep shortening certificate lifetimes: more renewals per year, more chances to slip up if you stay manual.
Two ways to manage certificates. Only one scales.
On one side, manual work spread across spreadsheets and people. On the other, a single inventory, automatic policies and audit.
| Today | With Lucerta |
|---|---|
| Discovery and inventorySpreadsheets, manual scans, knowledge living in one person's head. | One inventoryCertificates, targets and agents in one place, with status and expirations always up to date. |
| RenewalOne CA at a time, different procedures, no traceability. | Automatic policiesThe scheduler plans renewals and runs them with retry, backoff and post-crash recovery. |
| DistributionScripts spread across servers, copied and adapted by hand. | Deploy from the agentsThe agent receives the certificate over mTLS, installs it on the target and reloads the service. |
| TraceabilityNo audit trail: who changed what, and when, stays a mystery. | Full auditEvery write operation produces an audit entry: actor, category, outcome and IP. |
| CostsYou don't know what you spend per certificate, or where you're overpaying. | Built-in advisorConcrete suggestions: EV→OV/DV downgrade, wildcard consolidation, migration to DV. |
Built for those who must account for what they do.
You don't need a security department: you need someone who is done finding out about an expired certificate from a service alert.
Sysadmins and IT operations
You run dozens of servers and want to stop chasing expiry dates with a calendar.
IT managers
You want a uniform policy, visibility on renewals and an audit that stands up to review.
MSPs and consultants
You manage certificates for several customers: the Free licence allows use on your clients.
SMBs with compliance needs
You need a full audit trail without the cost of an enterprise platform.
Start free. Grow with Enterprise.
The Free edition is complete and self-hosted. Enterprise adds Edge, SSO/LDAP and support, under a signed licence.
Free
€0
Core + Console via Docker, with PostgreSQL included in the sample compose.
- Up to 10 registered agents (fixed limit, not configurable)
- Inventory, policies and job scheduler with retry/backoff
- ACME (Let's Encrypt), Cloudflare DNS, AWS Route 53 providers
- Full audit trail and 4-role RBAC
- mTLS agent channel and AES-256-GCM encrypted secrets
No credit card. Edge is not available in Free.
Enterprise
Licensed — price not published yet
Signed licence: number of agents and edges as defined by the signed licence.
- Edge management for network appliances (e.g. F5)
- SSO / LDAP
- Agent/edge count per licence
- Dedicated support
- Everything included in Free
Note: much cheaper than today's enterprise platforms (Venafi, Keyfactor, AppViewX). No price published at this stage.
Interested in Enterprise?
Leave us a contact: we'll let you know when the Enterprise edition is available, no spam.
The platform works for you, it doesn't get in your way.
The features that matter for managing certificates every day, all self-hosted on your servers.
Centralized inventory
Certificates, targets and agents in one place, with status and expirations always up to date.
Renewal policies
Automatic renewal of expiring certificates according to configurable policies, by window or percentage of validity.
Reliable job scheduler
Persistent database-backed queue with retry, backoff and recovery after a restart.
Provider SPI
Providers as separate modules, configured at runtime and never hardcoded: ACME, Cloudflare DNS and AWS Route 53.
Notifications
Email and SNMP trap channels, with configurable triggers.
Documented REST API
Versioned /api/v1 API with ApiResponse envelope, documented via OpenAPI.
Multi-platform agent
Static Go binary for Windows and Linux: nginx/apache/IIS discovery, certificate deploy and self-update.
Administration console
Web interface for inventory, policies, jobs and audit (FastAPI + Jinja2 + HTMX).
Separate modules. No vendor locked into the core.
The Core coordinates, providers talk to CAs and DNS, agents deploy to targets. Every component is replaceable.
Console (administration)
Admin frontend: FastAPI + Jinja2 + HTMX + Alpine.js.
Lucerta Core
Java 21 · Spring Boot 3.3. Inventory, policies, job scheduler, audit, provider SPI.
Lucerta Core — provider SPI
CA and DNS providers as separate modules, configured at runtime. Never hardcoded.
ACME provider
Let's Encrypt and compatible CAs, http-01/dns-01 challenges.
DNS providers
Cloudflare and AWS Route 53 for automatic dns-01 challenges.
DigiCert — future
Integration coming, same SPI pattern.
Lucerta Core
Dedicated agent channel.
Lucerta Agent
Go, cross-compiled static binary. Enrolls with a one-time token, then mTLS; 60 s polling; runs CERT_DEPLOY jobs; self-updates via signed package.
Lucerta Agent
Execution on the target.
Windows / Linux target
nginx/apache/IIS discovery, certificate deploy and reload.
Lucerta Core
Persistence via Spring Data JPA + Flyway.
DBMS
PostgreSQL / MariaDB / OracleDB, selected at runtime.
Lucerta Core
Configurable notifications.
Notifications
Email + SNMP traps, with configurable triggers.
Lucerta Core
Connector for network appliances (Enterprise only).
Lucerta Edge — Enterprise
Connector for non-standard appliances, F5 discovery via iControl REST.
Network appliances — Enterprise
e.g. F5 BIG-IP and non-standard targets.
Designed for regulated environments.
-
Authentication and authorization
JWT Bearer + BCrypt, with 4-role RBAC: superadmin, admin, reader, auditor. -
mTLS agent channel
Enrollment with a one-time token, then a mutual-TLS REST channel for every agent. -
Secrets encrypted at rest
Provider credentials and secrets encrypted with AES-256-GCM: never in plain text in code or logs. -
Complete audit trail
Every write operation produces an audit entry with actor, category, outcome and IP.
Optimize your certificate spend.
The advisor analyzes your certificates and suggests where you're overspending, with actionable recommendations and no made-up prices.
Downgrade EV → OV/DV
Browsers have deprecated EV indicators: move from EV to OV/DV and keep the same TLS encryption.
Consolidate into a wildcard
At least 3 SANs on the same domain? A single wildcard reduces the number of paid certificates you have to manage.
Migrate to free DV
Low-prominence domains on a paid CA? A free DV via ACME/Let's Encrypt offers the same TLS security.
Privacy by design. Traffic is aggregated locally by the agent: counts only (requests over the last 24h and 7 days), no IP addresses and no personal data.
Available now. Coming soon. In the works.
What's ready, what we're preparing and what comes next. No invented dates: future items are clearly marked as such.
Available now
Free
- Core + Console, up to 10 agents
- ACME, Cloudflare DNS and Route 53 providers
- Inventory, policies, jobs, audit, mTLS
- Cost optimization advisor
Coming — Q3 2027
Enterprise
- Edge management for network appliances (F5)
- SSO / LDAP
- Signed licence and support
Future
In the works
- More DNS providers (Azure, GCP, Hetzner, OVH...)
- Agentless network discovery
- Cloud/K8s inventory (AWS, Azure, GCP)
- Full DigiCert provider
The questions we get most often.
What is Lucerta?
Lucerta is a self-hosted platform that automates TLS/SSL certificate renewal and distribution across distributed infrastructure. It inventories certificates, applies your policies, runs renewals as tracked jobs and deploys certificates to targets through agents.
How much does the Free edition cost?
€0. The Free edition is complete and ships as Core + Console containers (with PostgreSQL in the sample compose). No credit card required.
Is there a limit in the Free edition?
Yes: up to 10 registered agents. It is a fixed limit in the code, not overridable via environment variable or database. Edge management is not available in Free.
What do I need to install it?
Docker (or Podman) and a database. The sample compose includes PostgreSQL; you can also use MariaDB or OracleDB. You'll find commands and the compose on the Download page and the full guide at docs.lucerta.io.
Which databases does it support?
PostgreSQL, MariaDB and OracleDB, selected at runtime. The schema is managed with versioned Flyway migrations.
What does Enterprise include and when does it ship?
Enterprise is planned for Q3 2027. It adds Edge management for network appliances (e.g. F5), SSO/LDAP, support and a signed licence with an agent/edge count per the terms. It will be cheaper than today's enterprise platforms; the price is not published yet.
Does my data stay mine?
Yes. Lucerta is self-hosted: it runs on your servers. There is no telemetry, no automatic pings back to us, and secrets stay encrypted (AES-256-GCM) in your database. The site you're reading uses no tracking cookies.
Where do I start?
Download the Free edition, start the stack with Docker and add your first agents. When you want to talk about Enterprise, leave a contact in the dedicated form.
Found a bug? Have an idea?
Report a bug or propose a feature. Every report is read, and technical ones can be tracked publicly on our tracker.
The tracker link is a placeholder and will be activated when the repository is published.
Report a bug / Propose a feature
A few lines are enough. If you can, tell us which component.