Integrations
Connect your estate. Know what’s proven.
51 deployment connector implementations, installed agents and a common ACME workflow. Validation is shown per path, so you can plan a pilot with the right expectations.
Supported
End-to-end evidence against real software or a real service, within the limits stated below. Pilot support; no vendor certification.
Preview
Implementation and contract or local tests exist. Prove issuance, deployment, verification and recovery in your staging environment first.
Not validated
At most parsing, script syntax or cross-build checks. Do not rely on this path before native acceptance.
01 · Integration directory
Servers & applications
Install where TLS terminates, then verify the serving endpoint.
- Supported
NGINX, Apache, HAProxy, Caddy, Traefik, lighttpd, Envoy
Real software lab. Reload and configuration requirements vary by service.
- Supported
PostgreSQL, MySQL, MariaDB, Mosquitto, Dovecot, Postfix
Real software lab. Validate the service’s reload behavior in your environment.
- Supported
Tomcat / PKCS#12, SSH / SFTP, files, exec, webhook
Trusted agents may run local tools and hooks; treat operator access as privileged.
- Supported
Windows certificate store, Microsoft IIS
Native Windows Server 2022; My and WebHosting stores. IIS Central Certificate Store is refused.
- Preview
Exchange Server SE
Single-server SMTP and IIS evidence only. No DAG, hybrid, IMAP/POP or least-privilege qualification.
- Not validated
RDP, RD Gateway, SQL Server, AD FS, WinRM HTTPS
Generated PowerShell parsing only; native target acceptance has not run.
02 · Integration directory
Cloud & network
API-driven deployment, with validation tied to the actual service tested.
- Supported
AWS ACM for ALB / NLB listeners
Real service rotation and recovery. Other ACM consumers are not validated.
- Supported
OCI Load Balancer, OCI Certificates
Real service rotation and recovery. OCI API Gateway and other realms remain unvalidated.
- Preview
Azure Key Vault, Kubernetes, Cloudflare, Vercel, Heroku, Netlify
Implemented connectors with contract tests; run a staging pilot on your account first.
- Preview
F5 BIG-IP, FortiGate, Palo Alto, Proxmox, vCenter, TrueNAS, Redfish
Contract-tested APIs. Appliance models and firmware need customer-specific acceptance.
- Preview
GitLab, Jenkins, Keycloak, Cockpit, Webmin, vsftpd, Exim, proxmox-local
Contract tests; not end-to-end acceptance against these products.
04 · Integration directory
Domain validation
Automate DNS-01 challenges with explicit credentials or delegation.
- Supported
DNS-01 flow & propagation checking
Real local ACME flow against a test DNS service; not proof of a provider account’s write permissions.
- Preview
Cloudflare, acme-dns, Route53, GoDaddy, DigitalOcean
Typed hosted configurations. Live account writes and cleanup need staging acceptance.
- Preview
Additional lego DNS providers on trusted agents
Agent execution supports the broader provider ecosystem. Hosted mode deliberately restricts the available providers.
05 · Integration directory
Identity, automation & operations
Connect daily workflows without pretending every vendor is qualified.
- Supported
Linux systemd, Windows Server 2022 agents
Native installation, signed worker updates, health-confirmed rollback, restart and removal evidence.
- Supported
OIDC, passkeys, TOTP, scoped API tokens
Real Dex and browser WebAuthn acceptance. Individual enterprise OIDC providers have not all been tested.
- Supported
REST / OpenAPI subset, filtered CSV, webhook notifications
Authenticated automation contract and durable notification outbox; not every admin API is in OpenAPI.
- Preview
Email, Slack, Microsoft Teams
Contract tests; delivery to live services is not recorded.
- Not validated
macOS launchd agent
Cross-build and script syntax only; native host acceptance and notarisation remain pending.
Preflight is the beginning of acceptance.
Saved integrations offer read-only preflight and redacted diagnostics. A passing read cannot prove DNS writes, commercial CA entitlement, application reload permissions or rollback. Test the complete loop with the credentials, runner and target you intend to use.
Read the preflight workflow →Start with one service.
Confirm the CA account, DNS zone, runner and recovery path before expanding to the rest of your estate.