Automated certificates, with the private key wherever you want it
Request, validate, deploy and verify without touching a file — while the most sensitive piece never has to reach us
Most certificate platforms ask you to hand over the private key. Kineticlinks offers three modes: platform-managed, bring your own CSR, or an agent in your own racks that generates the key and keeps it there. With ten DNS providers for automated validation, seven CDN deploy targets, and edge checks once deployment finishes.
Why certificate automation stalls on the private key
On the surface the problem is drudgery: creating DNS validation records by hand, downloading files, uploading them to each server and CDN in turn. Validity periods keep shrinking, and one missed renewal puts a security warning in front of your users. Automation solves that part.
What actually stops enterprises is different: automating this means some system holds your private key. A security review asks where the key is stored, who can download it, and whether downloads are logged — and for most platforms the answer is "with us." Procurement stops there.
Kineticlinks hands that decision back: three key modes, including an agent that generates the key inside your own network and never uploads it. Platform-managed keys cannot be downloaded by default — an administrator has to enable it for that account, and every download after that is written to the audit log. The full security write-up is public on the platform, including the parts we have not built yet.
Where it fits
From a single domain to an environment that has to pass review
Procurement with a security questionnaire
Key storage, separation of duties, audit logging and incident timelines all have published written answers you can quote.
Managing many client domains
Track requests and renewals across a large estate, with roles deciding who can touch which certificates.
Internal and on-premise equipment
Servers that never face the internet, reached over SSH by your own agent, with the key never leaving your network.
Deploying across CDNs
Push one certificate to several CDNs, then confirm from edge nodes that it actually took effect.
How this differs from a typical certificate platform
The differences are in key custody, integration coverage, and what happens after deployment
Three key modes, your choice
Platform-managed, bring your own CSR (the key never reaches us), or agent mode, where the key is generated in your racks and stays there.
Broad DNS and CDN coverage
Ten DNS providers complete domain validation automatically, seven CDN targets receive deployments, with no API keys to distribute by hand.
Edge checks after deployment
A successful push is not proof it works. The platform connects from several edge nodes to confirm the chain and that it is live.
Team governance and audit
MFA, five roles with itemised permissions, scoped API keys, an order approval step, and an exportable audit log.
Security and governance
What the platform does today. The full write-up, including what is still missing, is published on the platform's security page
MFA and sign-in protection
Authenticator apps and recovery codes; an owner can require it team-wide, and can set idle timeout and which networks may sign in.
Five roles, itemised permissions
Owner, admin, operator, billing and viewer. Every API route must declare the permission it needs or an automated test fails the build.
Scoped API keys
Limited to what you tick and never beyond their creator's permissions; they take an expiry and a source IP range, and die when their creator leaves the team.
Order approval and audit log
Orders from operators and API keys can require approval first. Sign-ins, permission changes and key downloads are recorded, exportable as CSV or over the API.
Plans and pricing
Certificates are priced per certificate. Automation comes with a subscription, and every new account gets 14 days of Pro.
Basic
Free
Request and manage certificates as normal; automation not included. This is where accounts land when the trial ends.
Pro
US$29 /month
CDN deployment, DNS validation and edge checks, with up to 5 team members. US$319 billed yearly.
Enterprise
US$149 /month
Everything in Pro, plus the on-premise agent and unlimited team members. US$1,639 billed yearly.
Certificates are charged separately, at the same rate on every plan
- Single-domain certificates from US$30/year, wildcards from US$90/year, drawn from your account balance
- Issued by the GoGetSSL DV CA, chaining to a publicly trusted Sectigo root
- Expiry tracking, with reissues inside the validity period at no extra charge
- Multi-domain (SAN) and 12/24/36-month terms quoted on request, with volume discounts
- No cap on the number of certificates on any plan
The 14-day Pro trial drops to Basic when it ends; nothing is charged automatically. Your first certificate is fully refundable if it does not suit. Account top-ups currently accept cryptocurrency — contact us about other payment methods.
Who uses it
Teams that run into certificate management at scale
Hosting providers and agencies
Managing certificates across many client domains from one place.
Enterprise IT under audit
Teams who have to account for key storage, separation of duties and operation logs.
SaaS and platform operators
Issuing certificates automatically for large numbers of custom customer domains.
Teams with on-premise estate
Servers inside a network that still need valid, current certificates.
Frequently asked questions
Can the platform see my private key?
That depends which mode you pick. Platform-managed keys are generated and stored encrypted, cannot be downloaded by default, and need an administrator to enable it for that account — after which every download is written to the audit log. With bring-your-own-CSR the key never reaches the platform at all. In agent mode the key is generated by the agent in your own racks and stays on your machine; it is never uploaded.
Which DNS providers can be validated automatically?
Ten at present: GoDaddy, NS1, Namecheap, Cloudflare, AWS Route 53, Tencent DNSPod, Google Cloud DNS, UltraDNS, Constellix and Akamai Edge DNS. The list keeps growing — if yours is not on it you can validate manually, or talk to us about adding it.
Which CDNs can certificates be deployed to?
Seven at present: Apeiro8 CDN, Skycloud (CDNRay), CDNetworks, Alibaba Cloud, Tencent Cloud CDN / EdgeOne, EdgeNext and CDN5. Once deployment finishes the platform connects from several edge nodes to confirm the chain and that the certificate is actually live, rather than just reporting that an API call succeeded.
Can it deploy to servers that are not reachable from the internet?
Yes, using the on-premise agent. One Linux machine runs the agent as a hub and installs certificates over SSH onto the machines you list (nginx, haproxy, Apache). The key is generated on the hub and only ever travels inside your network; the platform cannot see it. Agent packages are signed, so you can verify them with ssh-keygen -Y verify. This feature requires the Enterprise plan.
Who issues the certificate, and will browsers trust it?
Certificates are issued by the GoGetSSL DV CA, chaining up through USERTrust to a publicly trusted Sectigo root. That root ships in the trust stores of every mainstream browser and operating system, so nobody has to install anything.
How does billing work? Is there a monthly fee?
Certificates are priced individually — from US$30/year for a single domain, from US$90/year for a wildcard — drawn from your account balance, with reissues inside the validity period free. Automation is what the subscription buys: Basic is free but includes none of it; Pro at US$29/month adds CDN deployment, DNS validation and edge checks with up to 5 members; Enterprise at US$149/month adds the on-premise agent and unlimited members. New accounts get 14 days of Pro and then fall back to Basic, with nothing charged automatically.