InfoRelay/ CertGuard· Use cases
Docs · Downloads · Contact
InfoRelay·CertGuard

AD CS lifecycle. Offline. One binary.

Discover, monitor, enroll, troubleshoot every cert in a Windows AD CS environment — across multiple domains under one offline root — from a single 19 MB binary that ships zero installer, zero service, zero telemetry. Built because certsrv in a modern browser stopped working and openssl alone doesn't know how to talk to AD CS.

⬇ Download CertGuard vs CyberArk Cert Manager
11 prebuilt template recipes Bulk CSR from CSV Chain Health Map — click any bucket to drill in Multi-domain CA inventory Air-gap deployable
Built for the Windows-CA reality
★AD CS / Enterprise CA
★NTLM + EPA / CBT
★Multi-domain
★STIG'd IIS
★CMMC 2.0 cert posture
★FIPS-mode tolerant

CLI mode scriptable

certguard — bulk CSR · axis camera fleet
$ certguard (or double-click the .exe)
→ InfoRelay CertGuard 0.1 · GUI on 127.0.0.1:9988
▸ PKI Topology ▾ → Bulk enrollment (CSV)
▸ Uploaded fleet.csv · 35 rows · CA: ICA-NMC
▸ Running... [ ████████████░░░░ ] 28 / 35
✓ axis-cam-01.nmc.local · .pem + .key
✓ axis-cam-02.nmc.local · .pem + .key
✓ axis-cam-03.nmc.local · .pem + .key
…
✓ 35 / 35 issued · C:\certs\axis-fleet\

Desktop GUI double-click to open

InfoRelay CertGuard — Chain Health Map
CAsSubmit CSRBulk enrollmentPending▸ Chain Map v0.1 · localhost:9988
Chain Health Map › 120 certs across 4 CAs
120
All
46
Healthy
0
≤90d
0
≤60d
1
≤30d
73
Expired
OCA-SBX · offline root
ICA-NMC · 47 certs
ICA-IESS · 35 certs
ICA-OLD-NMC · 14 expired
⊘ External · 3 certs

Part of the InfoRelay offline suite.

CertGuard ships alongside NetGuard. Same brand spine, same install pattern (single binary), same trust model (air-gap, no telemetry). Run both at once on different ports.

Live · v0.1 🛡

NetGuard Audit

DISA Cisco STIG audit · live SSH pull · MANUAL triage · CKL outputs.

 Live · v0.1 🔐

CertGuard (this tool)

Discover · monitor · enroll · bulk CSR · troubleshoot · 11 recipes.
2026 Q3 🔍

NetGuard Trace

"Can host X reach host Y on tcp/2000?" L2/L3/ACL/routing path-walk.

2026 Q4 📐

NetGuard Drift

Continuous config-drift detection · offline alerts on baseline divergence.

2027 🌐

NetGuard Multi-vendor

PAN-OS / JunOS STIG audit modules · same intelligence layer.

2027 📊

NetGuard Inventory

Live discovery · CMDB-grade artifacts · zero connected services.

Why CertGuard?

Built to replace certsrv-in-a-browser, openssl-one-liners, and CyberArk's $50K floor — all from one binary.

🔐

AD CS HTTP enrollment that works

Drives /certfnsh.asp directly with NTLM + CBT. Fixes the modern-browser empty template dropdown. Bulk submit from CSV, poll pending, download in PEM / PEM+Key / PKCS#7 / PFX.

📦

Single 19 MB binary

No installer. No service. No .NET runtime. No Python. UAC manifest auto-elevates on double-click. Self-contained. The .exe's SHA-256 is your SWAB artifact.

🧰

11 prebuilt recipes

CAPF · WebServer · DC · CodeSigning · IPsec · User · EFS · OCSP · Smartcard · IoT TLS Client · Apache/nginx. One click to build a CSR with the right EKU / KU bits / name flags.

🔍

Template troubleshooter

"401 from /certfnsh.asp on an existing template"? CertGuard queries pKIEnrollmentService objects and tells you exactly which CA publishes which template — with a runbook to fix it.

Capabilities

Every cert operation an admin actually does, in one tool.

No more openssl one-liners + IIS GUI + browser-into-certsrv round-trips. CertGuard handles the whole CSR-to-PFX-on-target lifecycle.

🏛

Multi-domain CA inventory

Configure each issuing CA you care about. Per-CA: hostname, NTLM domain, default template. Topology-aware (offline-root vs issuing). Validation status surfaces per row.

📤

AD CS HTTP enrollment

POST CSR + template to /certsrv/certfnsh.asp with NTLM + CBT. Poll certnew.cer. Handle pending-approval. Bundle chain. PEM / PEM+Key / PKCS#7 / PFX outputs.

📦

Bulk CSR from CSV

Upload a 35-row CSV (hostname + IP + extra SANs). CertGuard kicks off a background job, submits each, saves <cn>.pem + <cn>.key per row to your chosen folder. Live progress page.

📡

Cert expiration monitor

Background scanner polls every endpoint every 6h. Buckets by days-to-expire. Notifications: SMTP, Slack, generic webhook. Per-cert throttling so you don't get spammed.

🌐

Chain Health Map

Interactive vis-network graph of your entire PKI. Color-coded by expiration urgency. Click to drill in. Shape inference (DC / ICA / phone / appliance) from hostname pattern.

🧹

Cleanup engine + rollback

Classifies every discovered AD cert (KEEP / EXPIRED / SUPERSEDED / RETIRED-ISSUER). Generates PowerShell or LDIF runbook with auto-snapshot. Fully reversible from /rollback.

How it works

From subject DN to deployed cert.

1

Configure CA

Add each issuing CA with hostname, NTLM domain, default template. Test Connection validates LDAPS + HTTPS + NTLM+CBT in one click.

2

Discover templates

LDAPS-mirror every pKICertificateTemplate. See provenance (whenCreated / whenChanged) so retired-CA stragglers are obvious.

3

Submit CSR

Pick CA + template. Generate keypair + CSR in-flight or paste your own. NTLM + CBT auth. Track in Pending Requests.

4

Bundle + deploy

Download PEM / PEM+Key (separate files for Axis cams / F5 / NetApp) / PKCS#7 / PFX. Filenames pre-set to the host's CN.

Numbers behind v0.1

11
Prebuilt template recipes covering 90%+ of real AD CS work
~19 MB
Self-contained binary · no .NET / Python / installer required
35×
Tested bulk CSR fleet — Axis cameras, NetApp clusters, 802.1x supplicants
0
External calls. The CA inventory page is the only network surface.

Built for situations CertCentral / CyberArk can't reach.

Three operator realities for Windows-CA shops.

Modern browser pain

certsrv's template dropdown is empty in Edge and Chrome.

Microsoft killed ActiveX. The page that powered IT for 15 years now shows an empty dropdown. You're forced to hand-craft CertAttrib strings on the "Submit a saved request" path — losing template-driven automation entirely.

CertGuard becomes the browser. POSTs certfnsh.asp directly with NTLM + CBT. Template dropdown is populated from our own discovery, not the dead ActiveX bridge.
Bulk operations

35 Axis cameras need certs and they're all almost identical.

Generating 35 keypairs, building 35 CSRs, clicking through /certsrv 35 times, organizing 70 files. Five hours of click-work that has to happen every two years.

Upload one CSV. One row per camera (hostname + IP). CertGuard issues, downloads, names every file after its host. 17 minutes for 35 certs on STIG'd IIS.
CA migration debris

Old CA's templates linger in AD. New CA returns 401 on everything.

You migrated CAs last quarter. The old pKIEnrollmentService object never got cleaned up. AD still lists templates the new CA doesn't publish. Every submission returns "401 - invalid credentials" — even for Domain Admins.

CertGuard's troubleshooter queries every pKIEnrollmentService in the forest and tells you which CAs publish what. Generates the certutil -SetCATemplates +X runbook to fix it.

Ready to cut your first cert?

Drop the binary on disk. UAC self-elevates. Add a CA, discover templates, submit a CSR. First issued cert in five minutes flat.

⬇ Download for Windows vs CyberArk
Get CertGuard

v0.1 builds · single binary

Self-contained ~19 MB. UAC manifest embedded so double-click auto-elevates on STIG'd boxes.

🪟 Windows
10/11 x64 · UAC self-elevate · WebView2
certguard-0.1-windows-x64.zip
🍎 macOS
Apple Silicon · 13+
certguard-0.1-macos-arm64.zip
🐧 Linux
x86_64 · GTK + WebKit2
certguard-0.1-linux-x86_64.zip

Installing on Windows

  1. Download certguard-0.1-windows-x64.zip.
  2. Right-click the zip → Extract All…
  3. Right-click certguard-0.1-windows-x64.exe → Properties → tick Unblock → OK.
  4. Double-click the .exe. UAC will prompt automatically (embedded manifest) — click Yes.
  5. SmartScreen may warn (unsigned in v0.1). Click More info → Run anyway — one-time per binary hash.
  6. CertGuard opens in its own desktop window on 127.0.0.1:9988.
Already have Python? pip install inforelay-certguard, then certguard for the native window.

Resources

Documentation home →
Comparison

CertGuard vs CyberArk Certificate Manager

Honest feature-by-feature: where CertGuard wins (air-gap, single binary, 10% of TCO) and where CyberArk is still the right tool (HSM, K8s, MSP).

 One-pager

CertGuard procurement one-pager

Print-ready single page for SWAB submission and budget-approval conversations. Pricing tiers, security posture, deployment footprint.

 Guide

User guide — installing, configuring, scanning

End-to-end walkthrough including AppLocker / SmartScreen notes for STIG'd boxes and the bulk CSV workflow for fleet enrollment.
FAQ

The questions Windows-CA admins ask first.

Does CertGuard need access to the offline root?
No. CertGuard talks only to the issuing CAs you configure. The offline root is captured in the CA inventory so its public cert can be bundled into PFX/PKCS#12 chain outputs, but no traffic is sent to it.
How does it authenticate to AD CS?
NTLM with explicit Channel Binding Token (CBT, RFC 5929 tls-server-end-point) computed from the captured TLS server cert. Works against STIG'd IIS with EPA enforcement. Credentials live in memory only — never written to disk. Session cache reuses creds across subsequent polls.
What about multiple domains?
The CA inventory captures a per-CA domain field that becomes the NTLM realm. You can have ICA-NMC on NMC\admin and ICA-IESS on IESS\admin side by side in the same CertGuard install.
Can I use it without ever talking to a CA?
Yes — keygen, CSR build, format convert, inspect work fully offline. The CA inventory is optional. CertGuard is a useful local cert toolkit even if you never configure an issuing CA.
What formats does the converter support?
Auto-detect: PEM (.pem/.crt/.cer), DER, PKCS#7 (.p7b/.p7c), PKCS#12 (.pfx/.p12). Output is operator-selected from the same set. Plus a "PEM + Key (separate files)" save option for Axis cameras, F5, NetApp — anything that wants cert.pem + cert.key separately.
What if my domain controller is STIG'd and blocks RootDSE?
Discover AD certs has three fallback layers for base-DN auto-discovery: Server.info (works on most), raw RootDSE search with check_names=False (handles ldap3 schema-validation rejection), and last-ditch derivation from the NTLM domain (NMC → DC=nmc,DC=local). If all three fail, type the Base DN explicitly in the form.