Kryptkeeper in use
Screens from a Kryptkeeper v0.9.1 hub running a small example estate: a classical and a post-quantum CA chain, templates, and about fifty certificates owned by three teams.
All names are examples. Select a screen to open it full size.
See what needs a person
Kryptkeeper opens on the work that won't happen by itself, then lets you drill into why.
What needs a human
/Expiring, expired and risky certificates and endpoints on one screen, with a 90-day outlook. Anything that will not renew itself is called out at the top.
Expiry timeline
/reports/expiry-timelineCertificates bucketed by time to expiry and broken down by issuing CA and owner team, with renew and notify-owner actions next to each group.
Alert rules
/alertsExpiry thresholds routed to email or a webhook per team, from a 7-day page to on-call through to a 60-day heads-up.
Know every certificate and who owns it
Inventory, trust hierarchy and issuance policy in one place instead of a spreadsheet.
Certificate inventory
/certificatesEvery certificate with issuer, expiry, grade and risk score. Selecting one shows its names, fingerprint, CA chain and the owner, team and service to contact.
CA hierarchy
/casClassical and post-quantum roots with their issuing CAs as a trust tree, with status and how many live certificates each has issued.
Certificate templates
/templatesIssuance policy as templates: validity, key usage, allowed algorithms, name policy and whether a request needs approval. Rules are enforced when a certificate is issued.
Discovery
/discoveryNetwork scans find TLS endpoints by hostname and score their risk. Here an expired, RSA-1024, TLS 1.2-only host stands out at 80.
Keep sensitive issuance under review
Some certificates should not be issued on request alone.
Approval queue
/approvalsRequests for approval-gated templates wait for a second person. The requester cannot approve their own request, and every decision is audited.
Revocation activity
/reports/revocation-activityWhat was revoked, why, by which CA and who owned it, so an unexpected revocation is easy to spot and explain.
Plan the move to post-quantum cryptography
ML-DSA (FIPS 204) certificates are issued and tracked next to classical ones.
ML-DSA certificate
/certificatesAn ML-DSA-65 certificate issued from a standard OpenSSL request, chained to a post-quantum issuing CA and root.
Crypto posture
/crypto-postureAlgorithm mix and post-quantum readiness across the estate. Full-chain quantum-safe, leaf-only and migration-ready certificates are counted separately.
PQC migration
/reports/pqc-migrationReadiness against the CNSA 2.0 and NIST SP 800-131A deadlines, counted in days, with a starting point for planning migration waves.
Evidence for auditors
Reports are computed from live inventory, so they match what is actually deployed.
Compliance evidence
/reports/compliance-evidenceSOC 2, PCI DSS 4.0.1, NIST SP 800-57 and 800-131A, and DORA controls checked against your certificates, with an evidence pack to hand to auditors.
Run it on your own machine
The quick start brings up the same hub with Docker Compose in a few minutes.