TLS certificate management, automated.

One-time DNS setup, then TLS certificates in 4 minutes — no ongoing records to manage, no cron jobs, no forgotten renewals.

Get Started Free Learn More

Free to use. No credit card required.

# Issue a TLS certificate
$ krakenkey cert issue --domain example.com --wait
✓ CSR generated (private key stays local)
✓ Certificate issued in 3m 42s
✓ Saved to ./example.com.crt
# Monitor your TLS endpoints
$ krakenkey endpoint add api.example.com:443
$ krakenkey endpoint scan <endpoint-id>
✓ TLS 1.3 · ECDSA P-256 · chain valid
✓ Expires in 187 days
✓ Latency: 42ms (us-east-1)

What KrakenKey does today

Privacy-first certificate issuance with automated DNS-01 challenges. Two DNS records once, then fully automated.

Client-Side CSR Generation

Generate Certificate Signing Requests in your browser using WebCrypto API. Your private keys never leave your environment.

ACME/Let's Encrypt Automation

Automated DNS-01 challenge resolution. Add two DNS records to your domain once — KrakenKey handles every ACME challenge from there.

REST API

Issue and retrieve certificates programmatically. Every action in the dashboard is also available via REST API.

Domain Management

Add domains, verify ownership via DNS TXT records, and scope certificate issuance per domain.

The certificate deadline is here

CA/Browser Forum Ballot SC-081v3 is phasing TLS certificate lifetimes down to 47 days. Manual renewal won't scale.

March 2026 200 days ~2 renewals/yr

March 2027 100 days ~4 renewals/yr

March 2029 47 days ~8 renewals/yr

How it works

One-time domain setup, then certificates on demand.

One-time setup

Add your domain

Register your domain in the dashboard and add two DNS records: a TXT record to verify ownership and a CNAME to delegate ACME challenges to KrakenKey.

Per certificate

Generate CSR in-browser

Use the WebCrypto API to generate your Certificate Signing Request. Your private key never leaves your device.

Submit via dashboard or API

Upload your CSR through the web dashboard or submit it programmatically via REST API.

Certificate issued in ~4 min

KrakenKey resolves the ACME DNS-01 challenge automatically. Your certificate is issued and ready to download.

Pricing

Free tier includes full ACME automation. Paid plans add higher limits, auto-renewal, and team access.

Free

✓ 3 domains, 10 certificates
✓ ACME automation
✓ REST API & dashboard
✓ 3 monitored endpoints

Get Started Free

Popular

Starter

$29/mo

✓ 10 domains, 75 certificates
✓ 30-day auto-renewal
✓ 10 endpoints, 2 hosted regions

Upgrade to Starter

Team

$79/mo

✓ 25 domains, 375 certificates
✓ Organizations with RBAC
✓ 50 endpoints, 5 hosted regions

Upgrade to Team

View full plan comparison →

Ready to automate your certificates?

KrakenKey automates certificate management so you don't have to.

Get Started Free

Free to use. No credit card required.