Cyphers¶
On-premises certificate lifecycle management for infrastructure teams.
Cyphers monitors, scores, and automates the renewal of the TLS certificates across your fleet — built for the 47-day certificate era (the CA/Browser Forum is stepping maximum certificate lifetimes down to 200 days in Mar 2026, 100 days in Mar 2027, and 47 days in Mar 2029). Everything runs on your own network: no SaaS dependency, no certificates or private keys leaving your infrastructure.
The two halves¶
| Component | Runs | Role |
|---|---|---|
| Hub (Rust) | Your server | API, dashboard, built-in CA, scoring, renewal lifecycle, fleet posture |
| Scout (Go) | Each endpoint | The agent on your servers: scans TLS posture, discovers certificates, and executes the Hub's issuance / delivery / renewal commands |
This wiki started Scout-first — the endpoint agent that lives on your servers — and now also covers the Hub. Start here:
- Hub overview — the two runtime roles (Satellite/Master) and how they relate
- Satellite Hub install procedure — deploy the Hub, end to end, including its Master-side dependencies
- Scout overview — what it is and how it fits
- Install procedure — deploy it on a host, end to end
- Enrollment & identity — mTLS identity and CA pinning
- Transport & health — NATS, the mandatory acceptance-policy verifier, health
- Certificate discovery — the on-disk cert inventory
- Scanning & scoring — TLS probing and the findings it derives
- Proof collection (Trust Radar) — trust-store, installed-vs-served, renewal-controller, key-custody evidence
- Commands & remediation — every action the Hub can drive
- CT log access — the
scout ctclient - Security — the trust model, honestly stated
- Limitations & roadmap — what it doesn't do (yet)
Read the maturity markers
These pages are a deliberately honest capability map — each notes live / partial / stub / dead status and platform gates, so you can tell a shipped feature from an aspiration.
Scope of this wiki
This is the product wiki — what Cyphers does and how to operate it. The
engineering references (architecture internals, wire contracts, design
plans) live in the repo's top-level docs/ folder.