Cert Camel
TLS certificate automation for Windows
Stop being the certificate
renewal process.
If renewing certificates currently means a calendar reminder, a checklist and an afternoon, this replaces all three. Cert Camel tracks when yours expire, renews them before they do, installs them where they belong — and then goes and checks that the new one is really the one being served.
FreeRuns on your own machineNo account, no cloud, no telemetry
The window keeps getting shorter
A certificate used to last a year or more, and renewing a handful of them by hand once a year was a manageable irritation. That is over. Under a rule every public certificate authority now follows, the maximum lifetime is falling fast:
Whatever you renew by hand today, you will be renewing twice as often next year and roughly eight times as often by 2029. Paid certificates are not exempt — the rule applies to every public authority.
The failure is quiet, too. A renewal that silently did nothing looks exactly like one that worked, right up until a browser puts a full-page warning in front of somebody. Cert Camel exists because that gap between believed and true is where the outage lives.
What it does
Expiry tracking
List the domain names you care about. Cert Camel connects to each one, reads the certificate actually being served, and shows how long it has left and who issued it — including the ones somebody else renews.
Automatic renewal
Before your certificates expire, they are renewed automatically from a free certificate authority. Ownership is proved through a DNS record, so nothing on the server needs inbound internet access and no ports need opening.
Deployment and proof
Pushes the new certificate to your HAProxy load balancers with no restart and no dropped connections, then reconnects from the outside to confirm the right one is live — on every node, not just whichever answered.
“The API returned 200” is not evidence
Most automation stops when an upload succeeds. That tells you a file was accepted. It does not tell you the right certificate is being served, and those are very different claims. Cert Camel keeps going through four checks, each one closing a gap the one before it leaves open:
-
The file arrived
The upload was accepted and the certificate is where it should be.
-
It is the right file
Compared by serial number, which is unique to a single issuance. A matching expiry date proves nothing — two certificates issued the same day look identical by that measure.
-
It is actually being served
A fresh connection from the outside, reading back what the server hands over. Installed and serving are not the same state.
-
Every node is serving it
Each machine is checked by its own address, never through the shared address that fronts them. A standby that quietly missed the update stays invisible until the day it takes over — which is precisely the wrong day to find out.
Honest about what it is not
A tool that holds the keys to your certificates should be easy to turn down. So, plainly:
- It is a single-operator desktop tool. No accounts, no roles, no multi-user anything. It runs on one machine and answers only to that machine.
- Private certificate keys sit unencrypted on disk. That is how every certificate tool on every platform works, but it is the thing most worth being deliberate about — and it means the folder must not live in OneDrive or Dropbox. (Your API credentials are a separate matter and are encrypted, with Windows DPAPI.)
- It is beta, written by one person. No support contract, no security team, no response-time promise.
The security overview goes through all of this properly, including what is recorded, what never is, and what breaks if you change which Windows account it runs as.
Where to start
Guides →
Installing it, connecting your DNS, deploying to HAProxy, and how the automation is scheduled.
Security →
What it protects, what it does not, and everything it writes to disk.
Cert Camel is on GitHub, MIT licensed, and still beta. Take the release if you just want the folder; clone it if you would rather it update itself from Settings.