Certificate management: track certificates before they expire
The certificate inventory keeps leaf certificates, chains, private keys and PFX/P12 bundles as encrypted records in a vault. It is separate from the HTTPS certificate that VaultPilot itself serves, which you manage in Server settings.
- Parsed formats
- X.509, PKCS#7, PFX/P12
- Alert thresholds
- 15, 7, 3, 1 day and expiry
- Per record
- Up to 16 sources, 10 MB
Details come from the certificate itself
The editor takes leaf, chain, private-key and PFX/P12 sources side by side. VaultPilot parses X.509 certificates, PKCS#7 chains, PFX/P12 bundles and supported RSA, EC and Edwards-curve keys, and checks that a private key matches the leaf certificate. Subject, issuer and dates come from the parsed certificate, not from the file name.
Export builds a new bundle
Download chain bundle / PFX builds PEM, DER and P7B files, chain.pem, fullchain.pem, a manifest and a SHA-256 list in the browser from validated material. When a matching private key exists, you set a new export password of at least 12 characters, and VaultPilot adds a protected PFX/P12 and encrypted PKCS#8. That password is not stored.
- A Viewer can export when validated material exists
- Copy actions cover metadata and the fingerprint only
How expiry alerts work
Alerts use the earliest-expiring real certificate across the leaf and its linked chain members, not a date typed into a title or note. Each threshold fires once: 15, 7, 3 and 1 day remaining, then expiry itself. The scan decrypts records in the client, so it runs only while an authorized session has the vaults unlocked.
The Certificate Dashboard
The Certificate Dashboard groups the active vault's records by status, remaining validity, certificate authority, origin and organization. Its Live scan label describes an animation of the current inventory; it contacts no network target and performs no TLS handshake.
Limits to know
Check step by step
Read more in the guides: Certificates screen, Certificate dashboard screen, New item screen