CertIntel Documentation

Reference material for administrators and technicians integrating with, or configuring, CertIntel. Everything reporting-related here is also available on the versioned API - interactive docs at /api/v1/docs on your CertIntel deployment.

New to CertIntel? Start with Getting started.

Reporting integrations

How to get certificate, renewal and check-in data into CertIntel from your own hosts:

• ACME check-ins & renewals - the requests behind a scheduled ACME renewal run: a check-in before and after the run, the renewal event itself, and the enrich step that fills in real certificate details. Bundled wrappers for simple-acme, Certbot and Posh-ACME, downloadable from that page.
• Internal certificate scanners - reporting certificates on hosts CertIntel can't reach itself, either by a live TLS probe from inside the network or by reading a machine's own Windows certificate store.
• Public site monitor - externally-reachable hostnames CertIntel polls directly. No script or key needed for the common case; just add it from the dashboard.

Windows Agent

A compiled Windows service, CLI and desktop app that can issue, renew, store, install and monitor certificates. The agent contains its own ACME client and keeps private keys on the machine; simple-acme is not required for agent-managed workflows.

• Install & setup - the online installer (install.ps1), the MSI, enrollment, local administration and signed automatic updates.
• Certificate workflows & deployment - native ACME accounts, renewal actions, renewal windows, file/JKS/Windows storage and application installation.
• Monitors & internal endpoints - local TLS probes plus internal endpoints assigned by the platform.
• Certificate stores & files - reading Windows stores and PEM/CRT/CER/DER/PKCS#7/PKCS#12/JKS files.
• Delegated DNS-01 - connecting a CertIntel delegation to a native certificate workflow and testing or rotating its key.
• External simple-acme integrations - the separate reporting-script path for renewals that remain owned by simple-acme.
• Install tokens & enrollment - the dashboard side: provisioning a token, approving a newly-enrolled device, and what "unregister" actually does.

Certificates & monitoring

• Certificates - the unified inventory every source feeds into: search, bulk actions, cross-source sightings, expiry tracking.
• Delegated DNS-01 (dashboard) - creating a delegation record, the CNAME you publish, and Cloudflare's proxy gotcha.

Administration

• API keys & authentication - key types, scopes, and narrowing a key to specific ingest resources.
• Organizations, users & roles - the tenant / child organization hierarchy and the built-in role permissions.
• Alerts & notifications - webhook destinations for certificate expiry, monitor failures, renewal outcomes and security warnings.

Single sign-on

• OIDC / SSO overview - concepts that apply to any identity provider: provider types, default-deny role mapping, the CertIntel.* claim convention, delegation and single logout.
• Microsoft Entra ID setup - a full step-by-step walkthrough against Entra ID specifically, including app roles and front-channel logout.

Getting an API key

Each custom reporting integration needs a write-scoped API key created on the API Keys page in your dashboard. The key is shown once, in full, at creation (cik_<prefix>.<secret>) - save it somewhere durable immediately. Authenticate every request with a single header:

X-Api-Key: cik_<prefix>.<secret>

A key is bound to one child organization (or, for an organization administrator, optionally organization-wide). One integration key can be used across all reporting endpoints, or narrowed at creation time to renewals / checkins / internal_certs so a given script can only ever submit one kind of data. Windows agents use credentials created by install-token enrollment and managed on the Agents page - see Install tokens & enrollment.