Keys stay with the agent
Certificate and ACME account private keys remain on the agent. The control plane coordinates jobs and records their outcomes.
INFRA / SSL / SECURITY
Trust comes
from clear boundaries.
InfraSSL separates what a server reports, what an operator approves and what a TLS connection actually shows.
Enrollment has a scope
A verified domain and a short-lived, single-use enrollment code associate a server with its workspace. Every agent has its own revocable identity.
A policy is an explicit agreement
Only the approved version of a locally configured policy can be requested. Changes invalidate approval. Approval does not grant operating-system permissions.
Verification has its own evidence
A successful installation report is followed by a TLS observation. The beta samples one IP per collection, so it does not establish the state of every load-balancer node.
BEGIN WITH A CLEARER VIEW
Meet your certificate estate.
Explore what the beta can do, then connect a test environment through the dashboard.