Skip to content

Product overview

Cyphers is on-premises certificate lifecycle management: it watches every TLS certificate your servers serve, scores the posture behind each one, and automates renewal — against public ACME CAs or its own built-in CA — without any certificate or private key ever leaving your network.

It exists because certificate lifetimes are collapsing. The CA/Browser Forum mandate steps maximum public certificate lifetimes down to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029. At 47 days, manual renewal is not a workload anyone staffs — it has to be automated, and the automation has to be observable enough to trust.

The two components

Component Runs on Role
Hub (one instance) a server you designate The brain: dashboard, certificate authority, ACME client, Cyphers Score engine, renewal lifecycle, Scout fleet management
Scout (one per endpoint) each server whose certificates you manage The eyes and hands: scans TLS posture, discovers on-disk certificates, generates keys, and executes the Hub's issuance / delivery / renewal commands

The Hub is a single Rust binary against one PostgreSQL database — no SaaS dependency, no external service. Scouts are single static Go binaries that enroll once for an mTLS identity and then talk to the Hub over an authenticated NATS channel. The division of labor is strict: the Hub decides and orchestrates; the Scout observes and acts locally. Private keys are generated on the endpoint and never leave it — the Hub signs certificate requests, it never holds or transports an endpoint's key.

Deep dives: Hub overview · Scout overview.

The lifecycle, end to end

Every certificate under management moves through the same loop:

  1. Observe. Scouts scan their configured targets on a cycle (default every 6 hours) and sweep their configured certificate directories, reporting what each endpoint serves and what sits on disk. The Hub can also probe endpoints from its own network position, giving an external vantage alongside the Scout's internal one.
  2. Score. The Hub computes the Cyphers Score — a 0–100 posture grade — from the findings in each scan.
  3. Decide. The Manage page groups what was observed into certificates and endpoints, and offers exactly the action each row's state supports: Adopt an untracked endpoint, Renew Now a managed certificate, or let autopilot renew it inside its renewal window with no click at all.
  4. Renew. A renewal runs a pre-flight (can this succeed? can it take effect?), then issues through the profile's renewal lane — the built-in CA, or any ACME CA over HTTP-01 or DNS-01. The Scout generates the key (or reuses the existing one), sends a CSR, and installs the returned certificate.
  5. Verify. After delivery the Scout re-probes the endpoint: is the new certificate actually being served? Only an observed-serving check closes a renewal — "the file landed" is not the bar, "the endpoint serves it" is.

Then the loop continues: the next scan cycle confirms the estate again.

The operator surface

Everything routes through the dashboard (the Hub's UI port):

  • Manage — the one operational view: every endpoint the Hub knows about, grouped per certificate, each row carrying its state and its single state-appropriate action. This is where you spend your time.
  • Scouts — the fleet: enrollment, per-Scout detail, installer downloads.
  • Settings — certificate providers (ACME CAs, EAB credentials), renewal profiles, DNS providers, domain allowlist.
  • Internal CA — the built-in CA: issuance, inventory, revocation.
  • Access / Policy / Activity — users, acceptance policy, and the audit trail of everything the system did.

Reading the rest of this section