Imports every order on the connected SSL.com account with its status and issued certificate.
Certificate Transparency
Finds publicly logged, unexpired certificates for a domain and all its subdomains, from any CA.
Network scan
Endpoint
Common name
Issuer
Request a certificate from SSL.com
Generate the key and CSR on the server that will use the certificate, so the private key never leaves it. An approver (not you) must approve before the order is placed and charged.
Organization details (OV / EV only)
Advanced: edit the raw SWS request
Sent as-is to SSL.com POST /certificates when approved. Edits here override the form.
#
Domains
Product
Requested by
Justification
Status
Decided by
Created
How auto-renewal works
Install the small TrustHub agent on a server. Its config file lists the certificates it looks after, where they live, and how to reload the web server.
The server appears below as a target. An approver picks the product and clicks Approve once.
From then on, 30 days before expiry, TrustHub orders a new certificate, the agent makes the key, proves the domain, installs the certificate and reloads the server. Nobody has to click anything.
The private key never leaves the server. If anything fails, the agent restores the old files, TrustHub sends an alert, and it does not retry on its own (every order costs money). New or changed domains always need approval again.
Add a server
Install the agent on The token is shown only once.
1. On the server, download the agent:
2. Save this as /etc/trusthub/agent.json and change the domains, paths and site to match the server:
3. Test once, then run it as a service:
Targets (certificates managed by agents)
Server / target
Domains
Expires
Product
Period
Renew at
Status
Agents
Name
Host
Last check-in
Recent renewal jobs
#
Target
Status
Why
Updated
How ACME automation works
Servers renew their own certificates from SSL.com with a standard ACME client (certbot, acme.sh, win-acme, cert-manager). Keys are generated on the server and never leave it. Each team or customer gets its own EAB credentials, so issuance is tracked per team.
ACME certificates are DV, one year. SSL.com bills by domain set: one domain (or + www) as Basic, wildcard as Wildcard, base + 1-3 subdomains as Premium, anything else as UCC.
Create credentials for a team / customer
Credentials for The HMAC key is not stored here. Copy it now.
EAB key ID
EAB HMAC key
Issued ACME credentials
Team / customer
EAB key ID
Created by
Created
Certificate
Threshold
Raised
Webhook
Time (UTC)
User
Action
Target
Detail
Add user
Email
Name
Role
Status
Created
Connect to SSL.com
Sign in to your SSL.com account (for testing: sandbox.ssl.com), open api credentials on the dashboard, and copy the two keys here. Saved keys are encrypted and never shown again.
Email alerts and reports
TrustHub sends expiry alerts and scheduled reports through your own mail server. A certificate whose owner is an email address also alerts that person.
Deployment
Single sign-on (optional)
Let staff sign in with their company account (Microsoft Entra ID, AD FS, Okta, Keycloak: any OpenID Connect provider). Register TrustHub with the provider using this redirect address: . People still need a TrustHub user with the same email; their role comes from TrustHub.
Backups
TrustHub copies its database every day and keeps the last 14 copies inside its data volume. Copy them off this server too: ./trusthub.sh backup makes a file you can store elsewhere.