Certman MCP Server

Certman

Certman is a certificate authority platform for managing internal PKI. This bundle provides tools to create and inspect CAs, issue certificates, revoke and renew them, and retrieve full certificate chains.

Entity Hierarchy

• Certificate Authority (CA) is the trust anchor that signs certificates. CAs can be root or intermediate (linked via parentCaId).
• Certificates are issued by a CA for a specific subject (common name + SANs). Each certificate has a lifecycle: active, expiring, or revoked.

Capabilities

CA management:

• List all CAs you have read access to (filter by type or parent)
• Get CA details including its certificate PEM
• Retrieve the full certificate chain from a CA up to the root

Certificate lifecycle:

• List certificates with filtering by CA, status, search term, creation date range, or expiration window
• Get certificate details including PEM
• Issue new certificates in managed mode (server-generated keys) or CSR mode (bring your own key)
• Revoke certificates with a reason code
• Renew certificates preserving subject, SANs, and CA

Workflows

Issue a certificate: List CAs to find the signing CA's ID. Call issue with the CA ID, common name, and optional SANs (DNS or IP). Choose managed mode for server-generated keys or csr mode with your own CSR PEM.

Audit expiring certificates: List certificates with expiringInDays filter to find certificates nearing expiration. Renew them before they expire.

Investigate a certificate: Get the certificate by ID to see its PEM and metadata. Get the CA chain to see the full trust path from issuer to root.

Revoke a compromised certificate: Call revoke with the certificate ID and reason code. The CA passphrase is required.

Gotchas

• CA passphrase required: Issue, revoke, and renew operations require the CA passphrase. This must be provided per-call.
• Managed vs CSR mode: Managed mode generates the private key server-side. CSR mode requires you to provide a PEM-encoded CSR.
• Revoked CAs excluded: list_cas excludes revoked CAs by default.
• Pagination: list_certificates supports page and pageSize for large certificate inventories.