STELAU / CERTIFICATE LIFECYCLE MANAGEMENT
A certificate never stands alone. It has an issuer, usages, locations and an expiry date. reBop connects that information to make its lifecycle observable, understandable and manageable.
01 / A Stelau product
reBop is a Certificate Lifecycle Management platform, focused on certificates from discovery to observed renewal. It provides a cross-cutting view of public and private certificates beyond any single certification authority. Stelau applies its expertise in X.509, PKI infrastructures and operational constraints to the product.
02 / Discovery & collection
Internet, internal networks and local files: a useful inventory connects certificates with the places where they are observed. A filename or an expiry date is not enough.
URLs and TCP ports, host lists, DNS exports or subdomain discovery provide several ways to locate certificates presented by accessible services.
Discovery sources include DNS searches and Certificate Transparency Logs. A CT result is evidence of issuance; observing a service reveals the certificate it actually presents.
The reBop probe scans local filesystems and configured networks to discover certificates that are not exposed to the Internet.
The open-source probe runs on Windows, macOS, Linux and Unix. It produces a JSON file containing certificates and their context: local paths, hosts and IP addresses. Private key files are ignored.
The same certificate may be used on multiple hosts or services. reBop retains its usage context to track renewals at each location.
File imports or probe uploads using an API key populate the inventory without confusing a certificate with the server using it. The probe remembers previously observed certificates to identify new ones.
03 / Applied cryptography
Dates are only part of the story. An X.509 certificate carries an identity, a public key, usages and constraints. A CLM must make that information understandable.
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING
}
-- SubjectPublicKeyInfo, Validity,
-- Extensions: SAN, KU, EKU, AIA, CRL…Subject, issuer, serial number, validity period, public key and extensions: ASN.1 encoding provides access to the information describing a certificate.
SAN, KeyUsage, ExtendedKeyUsage, BasicConstraints, policies, AIA and CRL distribution points help explain the intended usage and environment of a certificate.
reBop’s detailed analysis brings together certificate information, status and elements of its trust context, along with compliance analysis.
Product documentation covers inclusion in European eIDAS trusted lists, Mozilla and Microsoft. Adding a certificate to an inventory alone does not establish its trustworthiness for a particular use.
Identifying signature algorithms, keys and usages helps prepare changes to cryptographic policies, including the post-quantum transition.
The first question is operational: where are the affected certificates, and which services depend on them? Inventory and parameter inspection reveal dependencies before a migration is planned.
04 / Renewal detection
A renewal links a previous certificate, a new certificate and their locations. reBop places that relationship at the centre of monitoring.
A new observation reveals a certificate that may replace one already being monitored.
The correlation engine, named AI Engine in reBop, identifies likely renewals and processes matches it considers sufficiently certain.
Uncertain matches become proposals to accept or reject. Acceptance carries labels and monitoring settings over to the new certificate and archives the previous one.
Continued observation of locations highlights expired, revoked or suspended certificates still online, and tracks the time between the start of validity and actual deployment.
Obtaining a renewed certificate and actually putting it into service are different steps. This delay highlights the gap between certificate availability and deployment. Detecting a renewal does not mean reBop automatically issues or deploys that certificate.
05 / Operations & oversight
Reduce blind spots, organise deadlines and share decisions: technical understanding should lead to controlled operations.
The timeline groups certificates by expiry date and renewal status. Periods act as filters leading to the certificates requiring investigation.
Renewed certificates, pending renewals and remaining actions: the operational view helps teams prepare their work ahead of time.
Validity, revocation and online-presence alerts, in-app notifications, emails and reports turn deadlines into information for the people concerned.
Periods and notifications are configurable. Alerts are tracked per user and organisation; available functions depend on the selected plan.
Labels, search and filters organise the inventory. Operator and viewer profiles distinguish operational management from consultation.
Logs record imports, certificate lifecycle events, label changes and decisions on renewal proposals; the initiating user is recorded where relevant.
06 / Deployment architecture
A hosted platform for centralised monitoring. Probes report certificates from internal environments within their configured scope.
One view of exposed, internal and imported certificates.
The Enterprise offering supports on-premise installation, virtual machines or containers, as well as deployment in your own IaaS.
Deployment arrangements and required features are scoped with the Stelau team.
07 / Your turn to explore
This Stelau workshop adapts our React application built on Lapo Luchini’s ASN.1 decoder. Import a certificate or try the fictional example: X.509 fields, the ASN.1 tree and bytes stay synchronised with each selection.
From fields to bytes: explore identities, validity, usages, extensions and QCStatements.
This decoder reads the data. It does not validate signatures, trust paths, revocation or eIDAS qualification. No OCSP or CRL requests are made.
The example is a self-signed demonstration certificate for fictional names. Its QCStatements demonstrate the encoding and do not confer any qualification. This workshop runs independently of the reBop service.