Audit-ready by default
Graylog as the single observability sink. Automated cert renewal via ACME and EJBCA REST. NIS2 readiness PDFs generated on demand. AI-assisted triage of audit events. We turn certificate lifecycle from a fire-fighting exercise into a scheduled background job.
Most cert outages are observable hours before they bite
The signals are always there: a CT-log entry that doesn't match a known issuance, an OCSP response time creeping up, a renewal job that silently failed, a CRL that didn't refresh. The problem isn't visibility — it's that nobody is watching the right window.
Symptoms we see in cold engagements
- Cert expiry surprises"Nobody told me api.example.com was expiring this weekend."
- Mystery CT entriesA wildcard cert appears in the CT log and nobody can identify who issued it.
- Stale CRLsThe CRL has been the same for a week — the publisher quietly stopped working.
- NIS2 panicAudit deadline in six weeks, no inventory, no evidence trail.
What we put in place
- Active monitoringExternal Cert Monitor SaaS for the perimeter, internal probes for private services.
- Renewal automationACME for the easy 80%, REST automation for service-account mTLS, escalation paths for the rest.
- CT-log diffingA daily diff against a known-good cert inventory. Unknown issuance triggers an alert.
- NIS2 evidence packA quarterly PDF with the inventory, controls map and incident log — ready for the auditor.
One sink. Many feeds.
A simple architectural rule: every event in your operation lands in Graylog, in a structured form, with consistent labels. Once that's true, queries are cheap and dashboards write themselves.
Graylog GELF sink
Every component emits structured GELF. Streams route by tag, pipelines extract canonical fields, dashboards are built per audience: ops, security, compliance.
Renewal automation
ACME for the web tier, REST for service mTLS, Salt distributes the renewed bundle. Failures emit GELF alerts; success goes silently.
CT-log monitor
Polls CT logs for your domains and diffs against a known inventory. Unknown issuance is the canary for credential compromise or shadow IT.
NIS2 evidence
A quarterly PDF: cert inventory, control mapping, incident log, key-ceremony attestations. Ready to hand to the auditor.
AI-assisted triage
LLM-assisted: summarise audit feeds, draft incident timelines from the GELF stream, generate first-pass runbook updates from change tickets.
Dashboards & SLOs
Ops dashboard: total certs, expiring, critical, CRL freshness. Security dashboard: failed handshakes, unknown CT entries, revocation events.
What changes after deployment
- Zero-touch renewalsThe 80% of certs that can renew via ACME do — without anyone being paged.
- Median expiry alert lead time: 30 daysNo more 02:00 "the cert expired" messages.
- CT-log coverage for every owned domainA daily diff. Unknown issuance triggers an investigation.
- NIS2 audit evidence on demandGenerate the PDF report yourself, anytime.
- One query, one timelineGraylog answers "what happened to that cert?" in seconds, not hours.
- Runbooks that stay currentLLM-assisted updates after every incident or change.
Need a NIS2 readiness assessment?
Free 60-minute discovery call. We map your current cert inventory, observability and audit posture against NIS2 Article 21 and tell you what to fix first.