Ask your agent
Claude, Gemini and Codex over MCP. Read-only by default.
Every machine identity,
managed
without agents.
Farrier finds and renews TLS certificates, inventories SSH keys, maps your cryptography and tracks post-quantum readiness.
No agents. No manual renewals. No missed expirations.
Works with your certificate authorities and DNS providers
Let's Encrypt
Google Trust Services
ZeroSSL
DigiCert
Sectigo
SSL.com
Buypass
Cloudflare
Amazon Route 53
Azure DNS
Google Cloud DNS
DigitalOcean
Akamai
Hetzner
OVHcloud
GoDaddy
Namecheap
Porkbun
Renewals that check their own work.
Farrier scans, orders over DNS-01, installs in your change window and calls it done only when the handshake proves it. Ready for 47-day certificates.
- Until 2026398 days
- Mar 2026200 days
- Mar 2027100 days
- Mar 202947 days
The parts that usually break
Handled, so a renewal at 02:00 needs nobody awake.
Domain health
An A to F grade for every endpoint.
Zombie scanner
Certificates still alive that should not be.
Rolls back by itself
If the new certificate never shows up live, the old one goes back.
Change windows
Each device renews in its own window, with daily caps.
Change packs
Files, a runbook and a ticket for devices without an API.
Single sign-on
OIDC with viewer, operator and admin roles.
Zero-downtime HA
SQLite to start, your Postgres or MySQL when it matters.
Keys sealed, changes signed
Keys encrypted under your master key; every action attributed.
One platform for every machine identity
TLS certificates
Found, renewed and verified on the wire.
SSH keys
Host keys and authorized_keys, read over SSH.
Crypto and PQC
Ciphers and key exchange, with post-quantum readiness.
Tickets and events go to
- servicenow
Renews the appliances other tools skip
F5, FortiGate and Palo Alto through their own APIs. Everything else gets a change pack and a ticket.
See connectors
farrier
$ farrier scan 10.20.0.0/24 41 endpoints, 18 automated, 23 change packs $ farrier tick ✔ www-lb F5 BIG-IP verified live ✔ vpn-fgt FortiGate verified live ✔ edge-pa Palo Alto verified live ● asa-dc1 Cisco ASA change pack, ticket opened $
Runs where your devices are
Self-hosted on your own machines. No account, no hosted service.
AWS
ECS Fargate with Secrets Manager and RDS.
Google Cloud
Cloud Run with Cloud SQL and Secret Manager.
Azure
Container Apps with Key Vault and Front Door.
On-prem
Docker Compose, Helm on Kubernetes, or air-gapped.
Questions
Do I install an agent on each machine?
No. Farrier reads TLS and SSH over the network and makes changes through each device's management API or SSH.
Does an F5 or FortiGate need internet access?
No. Farrier answers DNS-01 through your DNS and deploys over the management interface.
Which certificate authorities work?
Let's Encrypt, ZeroSSL, Google Trust Services, Buypass, SSL.com, DigiCert and Sectigo over ACME, plus a built-in private CA.
What if a deploy breaks a profile?
The old certificate stays installed, and Farrier switches back if the new one never goes live.
What does it cost?
Nothing. It is MIT licensed and runs on your own machines, with no hosted service and no account.
Has it run on real F5 hardware?
Not yet. The appliance connectors pass tests against mock APIs. Start on a lab device.
Something else? Ask on GitHub