Certificate Lifecycle Management & Machine Identity
Request → policy-gated sign → deliver → renew, against the CA you already run. Air-gap-ready, FIPS-ready, and deployable in an afternoon. One codebase runs on-prem, fully air-gapped, or hosted.
No phone-home · offline signed license · STIG-able
Certheim is a certificate lifecycle management (CLM) and machine-identity platform. It puts request intake, policy-gated signing, automated delivery, renewal, and audit in a single self-hosted app, without replacing your certificate authority. Bring your own PKI; Certheim orchestrates it.
No rip-and-replace. Certheim drives the CA you already operate, and lets you mix several behind one workflow.
Designed for on-prem and fully air-gapped enclaves: no outbound calls, an offline signed license, and a STIG-able install your ATO can absorb.
Online installer, offline bundle, container, or Kubernetes. No mandatory professional-services engagement to stand it up.
The short version is below. Each area has its own page with the full detail.
The five-step lifecycle pipeline, the automation engine behind it, and deployment shapes from a laptop container to an air-gapped enclave.
Platform →In-UI, policy-gated signing against OpenBao, AD CS, EJBCA, Venafi, AWS Private CA, and ACME, or the built-in local CA with an encrypted keystore.
Signing & CAs →A built-in ACME server plus EST, SCEP, and CMP for fleets and gear, with code-signing, RFC 3161 timestamping, and DNSSEC automation.
Enrollment →Certificates that install themselves (SSH, Kubernetes, vaults, webhooks), renew on schedule, and page you on Slack or Teams when they need a human.
Operations →FIPS 140-3, CAC/PIV, and STIG-hardened air-gap installs, plus WORM audit, federal PKI, OSCAL/eMASS evidence, and CNSA 2.0 / PQC tooling.
Government →Free Community, flat-priced Commercial with unlimited domains, and a Government package, compared feature by feature.
Compare editions →Users request one or many certificates from the dashboard. Bare hostnames get your configured domain appended; IPs become IP SANs automatically.
Approvers sign in-UI against your chosen backend, governed by per-template policy, or let trusted templates auto-sign.
Certheim pushes the issued certificate to its destination (a host over SSH, a Kubernetes Secret, a vault, or a webhook) with retries.
Background renewal keeps certificates fresh inside your window, and warns you well before anything expires.
Want the deeper picture: the automation engine, the architecture diagram, deployment shapes? See the platform page →
One codebase, flat pricing, no per-domain metering. Premium features unlock with an offline-verifiable license, so even air-gapped deployments stay licensed.
Community is free with no caps. The self-hosted installer is one signed tarball that works online or fully air-gapped; containers pull straight from Docker Hub.
One tarball with the repo, a bundled wheelhouse, and the offline installer. Runs online or fully air-gapped on RHEL/Alma 9. Tell us where to send it and we’ll email a download link.
Pull the hardened image (non-root, SBOM + provenance attestations) and run with Compose or the one-command installer.
docker pull ac2solutions/certheim:latestAlready licensed? Enter your license ID and download token to pull a build with your signed license pre-bundled.
No license yet? Request a quote.
The self-hosted tarball ships the Helm chart + manifests for a clustered deployment with a pluggable Postgres. The in-app deployment generator emits a tailored values.yaml.
Every download is a checksummed release artifact. Community downloads are tied to your email; licensed downloads are validated against your active license.
Community is free with no caps. Pick how you want to run it. Each path stands up a working dashboard in minutes, then the first account you create becomes the administrator. Want a guided, tailored walkthrough for your edition? The interactive setup guide builds every command and config file around your answers, right in your browser.
Any host with Podman or Docker works: Linux, a VM, or your laptop.
Pull the public image and run the Compose stack (app + nginx, SQLite) the in-app setup guide generates for you.
docker pull ac2solutions/certheim:latest
docker compose up -dBrowse to http://<host>:8080/csr/. Register the first account; it becomes the admin. Then turn off first-admin mode in Admin → Setup so nobody else can self-promote.
In Admin → Signing, connect the CA you already run (OpenBao/Vault, ACME, AD CS, EJBCA, Venafi, AWS Private CA), set your subject profile, and submit your first request.
A fresh minimal install is enough. Grab the self-hosted tarball from the Download section. It works online or fully air-gapped.
Unpack the tarball and run the bundled installer. Setup is interactive: choose SQLite (zero-dependency) or PostgreSQL, your TLS mode, and authentication (local or CAC/PIV mTLS).
tar xzf certheim-offline-*.tar.gz
cd certheim-offline-* && sudo ./install/online-install.shOpen the URL the installer prints, register the first account (it becomes admin), then disable first-admin mode in Admin → Setup.
Wire your CA backend and, optionally, a delivery destination (SSH host, Kubernetes Secret, vault, or webhook), then enable background auto-renew per template.
The in-app deployment generator produces a ready values.yaml for your environment (image, ingress host, database, auth).
Deploy into its own namespace; point it at a managed PostgreSQL for a clustered, multi-replica install.
helm upgrade --install certheim ./deploy/helm/certheim \
-n certheim --create-namespace -f certheim-values.yamlBrowse to your ingress host, register the first admin account, then disable first-admin mode in Admin → Setup.
Configure your CA backend and Kubernetes/vault delivery so issued certificates land straight in-cluster as Secrets.
Request the self-contained tarball. It ships a bundled Python wheelhouse, so there's no network access required at install time.
Move the bundle across your boundary, extract it on the target RHEL/Alma host, and run the included offline installer.
Premium editions verify an offline-signed license. Drop the license file in place; Certheim never phones home to validate it.
Point Certheim at your internal CA, set CAC/PIV mTLS if required, and operate the whole request → sign → deliver → renew loop with no internet.
Need a deeper walkthrough? Every install ships an in-app deployment generator that emits VM, container, and Kubernetes artifacts tailored to your answers. Stuck? Talk to us.
Tell us about your environment and we’ll follow up. Design partners and air-gapped evaluations welcome.