Skyrsoft CertOps is a self-hosted certificate authority and certificate-lifecycle platform that runs on Windows Server. It runs your internal PKI — root and intermediate CAs — issues and renews certificates automatically through agents and standards-based enrolment protocols, obtains publicly-trusted certificates over ACME, and keeps an audit trail of all of it in one console.
Deploy it
Download the free edition from the download page and run the installer on Windows Server — PostgreSQL is bundled, so there’s nothing separate to provision. In the console, create a root CA and an issuing CA signed by it; day-to-day certificates come from the issuing CA, with default validities of 10 and 5 years. Distribute the root certificate to the machines that need to trust it, using whatever configuration management or MDM you already run. Then deploy the bundled agent to a Windows or macOS host from the console: it generates its own keypair, submits a CSR, and installs the signed certificate without the private key ever leaving the device. Renewal runs on its own, ahead of each template’s expiry threshold.
What it does
The capabilities below are grouped by what they do: issuing certificates, getting them onto the things that use them, day-to-day operation, and running the console itself securely.
Issue
Certificate authority hierarchy
Root and issuing CAs, the CA-resolution order for a request, and running more than one hierarchy from a single installation.
Certificate templates
What a template controls, the five built-in templates, and how far you can edit one before you need to clone it.
Certificate enrolment agents for Windows and macOS
Machine and per-user agents for Windows and macOS, unattended renewal, the user-agent relay, and preparing a golden image.
SCEP certificate enrolment
Pro editionNamed SCEP endpoints, static and one-time challenges, the NDES-compatible MDM challenge URL, and binding a token to an expected identity.
EST certificate enrolment (RFC 7030)
Pro editionNamed EST endpoints, API-key authentication, enroll and reenroll, and the same approval-gating choice SCEP offers.
Certificate management REST API
Pro editionAPI-key authentication, the enrolment and inventory endpoint surface, and why the API answers on the console's own port.
Certificate approval workflows
Manual approvals, priority-ordered approval rules, auto-approve and auto-reject, and what a rule actually matches on.
Active Directory integration and request validation
Registering AD forests, request-validation rules, the SID extension NPS needs, and revoking a certificate when the AD account is disabled.
Deploy
Certificate deployment to servers and appliances
Nineteen built-in target types plus PowerShell, SSH script and webhook targets, with reusable credentials, read-only discovery and per-target maintenance windows.
Public certificates over ACME
ACME certificates from three CAs, validated by DNS-01 across three DNS providers or HTTP-01 on the CertOps server itself.
Private certificates
Internal CA certificates issued through the ordinary enrolment pipeline, with a key CertOps holds and can push to deployment targets.
Certificate-based Wi-Fi for Macs
The device-group setting, what the Mac agent delivers and an administrator approves, how the machine certificate is bound to the SSID, and what asks for approval again.
Operate
Device inventory and groups
Onboarding, device groups, remote agent rollout, automatic cleanup, and the hard-baked 30-day heartbeat revocation.
Certificate revocation, CRL and OCSP
Manual revoke and hold, CRL and OCSP publishing, revoke-on-AD-disable, and local cleanup on heartbeat.
Self-service certificate requests
My Certificates, My Profile, and completing a stored CSR — available to every account, including Free.
PowerShell script signing
Upload, approve, sign and download — routed through the same approval pipeline as any other enrolment, and not edition-gated.
Expiry alerts and notifications
Twelve alert types, email via SMTP/Gmail/Graph plus HMAC-signed webhooks, editable per-alert routing, and licence-expiry warnings.
Audit log and SIEM forwarding
The audit log, syslog/SIEM forwarding in three formats and three transports, and what pinned-CA TLS actually checks.
Backup and restore
One encrypted archive, what it actually contains, and the offline-only restore procedure.
Run it securely
Single sign-on, MFA and roles
SSO with any OIDC provider, TOTP and passkey MFA, three enforced roles, per-provider idle-account lifecycle, and break-glass recovery.
Console access controls
A management IP allowlist with a guaranteed loopback bypass, a persistent IP block list alongside sign-in rate limiting, password policy, session timeout and DB-backed proxy trust.
Architecture, ports and reverse proxies
Four listeners, why the two agent ports need TCP passthrough, what to publish behind a reverse proxy, and a worked example.
Sizing a CertOps server
Measured throughput at 3 and 4 vCPUs, the renewal thundering herd, and a repeatable method for sizing your own hardware.
Migrating from Active Directory Certificate Services
Stand up a fresh hierarchy alongside AD CS, move workloads across in stages, and roll trust forward — with no flag day.
Licensing and offline operation
What validation sends, what activation and renewal need, and why offline never revokes an activated licence.