Monitor certificates without handling private keys

Sentinel accepts no inbound connections. It enrolls with an organization-scoped token, which is reusable so a fleet can self-enroll from one image. Each Sentinel then generates its own Ed25519 key pair locally and never sends the private half. After enrollment, it uses Ed25519 and RFC 9421 to sign task-poll requests, reports, and key rotations, and the enrollment token stops being an authenticator for it. You can renew the organization token at any time, which invalidates the previous one immediately without disturbing Sentinels that have already enrolled.

When you create an organization, Nocert runs a one-off public scan of the domain after @ in the professional email address you confirm with the one-time code. A domain entered on the marketing site carries the signup handoff and prefills that work-email field; it is not independently selected as a scan target. One pass over public hostname datasets seeds it, and the scan itself reaches only hosts under the confirmed email domain, from the public internet, on TLS ports, which is the same thing any observer can do. What that scan observed keeps being rescanned, and SAN hostnames inside the same domain are followed. Reaching further requires proof of control: querying subdomain datasets again, scanning hostnames imported from a DNS connector, and adding an endpoint by hand all wait until you publish a verification token as a nocert-verify TXT record in a zone you control, which only someone with control of that zone can do. Account sign-in and password reset use one-time codes sent by email that expire after 20 minutes, with optional TOTP multi-factor authentication.

Nocert parses certificate DER in short-lived nsjail subprocesses. Each process has separate network, user, mount, and PID namespaces. Socket creation is blocked, /proc is not mounted, and CPU, memory, process, and file-output limits are enforced. In a self-hosted Custom deployment, the application and certificate parser run on infrastructure you control.

Nocert reads the organization from the authenticated session. It uses separate Elasticsearch indices for each organization and scopes PostgreSQL queries to the same organization.

You can disable network, filesystem, local-listener, and Kubernetes scans independently. The packaged Linux service runs as a dedicated unprivileged user with no Linux capabilities and a hardened systemd unit. Filesystem scans are limited by the permissions of the Sentinel service account. You provide the credentials and read-only RBAC used for Kubernetes scanning.