Cyphers¶
On-premises certificate lifecycle management for infrastructure teams.
Cyphers monitors, scores, and automates the renewal of the TLS certificates across your fleet — built for the 47-day certificate era (the CA/Browser Forum is stepping maximum certificate lifetimes down to 200 days in Mar 2026, 100 days in Mar 2027, and 47 days in Mar 2029). Everything runs on your own network: no SaaS dependency, no certificates or private keys leaving your infrastructure.
The two halves¶
| Component | Runs | Role |
|---|---|---|
| Hub (Rust) | Your server | API, dashboard, built-in CA, ACME client, scoring, renewal lifecycle, fleet posture |
| Scout (Go) | Each endpoint | The agent on your servers: scans TLS posture, discovers on-disk certificates, and executes the Hub's issuance / delivery / renewal commands |
New here?¶
- Quick start — Hub, first Scout, first managed endpoint, in about 30 minutes.
- Product overview — the components, the lifecycle loop, and the operator surface, in one read.
Understand it — Concepts¶
- Endpoints, proof & management — what "managed" means, and why proof of serving is tracked separately
- Certificates: identity & observation — how Manage groups the estate per certificate
- Renewal lanes — internal CA, HTTP-01, manual and automatic DNS-01, and which lane fits which CA
- Key reuse & pinning — keeping a private key across renewals
- The Cyphers Score — what the 0–100 number means
Do it — How-to guides¶
Task-shaped, step-by-step, with expected output at every step:
- Track a new endpoint · Adopt an endpoint · Adopt a private key
- Renew via Let's Encrypt (HTTP-01) · Renew via a paid / third-party CA (EAB, key reuse — the full commercial-CA flow) · Issue from the internal CA
- Hands-off DNS-01, where the Hub publishes the challenge record itself: AWS Route 53 (the proven lane) · Cloudflare · Google Cloud DNS
- Take over certbot-managed endpoints · Enable autopilot safely
- Back up & restore the Hub · Recover from refusals
Look it up — Reference¶
- Hub: overview · install procedure · the Manage page · renewal profiles · certificate providers · settings
- Scout: overview · install · enrollment & identity · transport & health · logging · certificate discovery · scanning & scoring · proof collection · commands & remediation · security · limitations
Run it — Operations¶
- Monitoring the estate — the daily health read
- Fleet upgrades — Hub first, then Scouts, with a rollback story
- Security model summary — the trust model in one page
Read the maturity markers
These pages are a deliberately honest capability map — the Scout pages note live / partial / stub / dead status and platform gates, so you can tell a shipped feature from an aspiration.
Scope of this wiki
This is the product wiki — what Cyphers does and how to operate it.
The engineering references (architecture internals, wire contracts,
design plans) live in the repo's top-level docs/ folder.