Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My organisation has a lot of SSL certificates and managing them is a pain: we need to keep backups of private keys and certificates, keep them secure, deal with certificate renewals (we use different CAs, some of which require a new CSR each time) and occasionally generating new keys, either because we add a new server or because we need to increase the key size.

I suppose it would be possible to write a tool to automate all of the above, but before we commit to doing so, can anyone recommend a tool that does this already? Ideally it'd run on Linux via a command line or web interface.

share|improve this question
You might get much better answers on – Brian Dec 3 '10 at 15:07

I only know of tools that exist for the entire life cycle of a CA for example Windows Certification Services.

If however you are using a third party CA and simply want to keep good record from Linux, I would highly recommend you simply organise your current system.

When working with certificates I do something along the following:

Folder called CSR - keeps the requests Folder called Public - keeps the public keys Folder called Private - Keeps the private keys

all files called xxxxxx.crt / xxxxxx.pem etc, where x is the next available number - keep them the same so 000001.crt is the public certificate to 000001.pem's private key.

Keep an up to date spreadsheet / database in the root folder that simply has the number in one column and details, expiry and any other relevant information in the next.

For a spreadsheet, this shouldn't take more than a few minutes to set up, but If you were to use a small database, you can probably build a little (but nice) DB in less than an hour that can do nice reports such as expiry warnings etc.

I think that this system could work out well for you.

share|improve this answer

With no other tool than google, here are some possibilities:

Venafi Digital Certificate Management & Encryption Key Management
Trustwave Certificate Lifecycle Manager

Both these products handle discovery, analysis, alerting and management.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.