Ducks in a Row
If you run Active Directory Certificate Services (ADCS) with a small team, certificate renewals tend to live in scripts and calendar reminders.
Ducks in a Row is one Windows service in front of the ADCS certificate authority you already run. Your machines, domain joined or not, request and renew their own certificates from it with a standard ACME client.
Download Read the documentation
What you get
- Expiry alerts, free. Email and webhook alerts for every certificate in your CA's inventory.
- Pull, not push. Each machine asks for its own certificate, so no credentials for your servers are stored anywhere and Ducks in a Row needs no rights on them.
- One scoped credential per team. You set the names a team may request with an external account binding credential, and the team serves itself within them.
- Your trust chain stays as it is. Certificates come from the ADCS you already run and chain to the root you already trust.
- Rights checked before first use. The setup wizard proves what it can of the service's rights on your CA, and says plainly what it cannot.
- Kubernetes too. cert-manager's built in ACME issuer works with it, with no plugin in the cluster. The Kubernetes chapter says which parts our tests have run.
- Signed installers. Both installers, and every binary the MSI installs, are code signed by Haruspex Systems B.V. and timestamped. Windows SmartScreen may still warn about a new release while the certificate builds a reputation, so check the download before you run it. Every release also carries a software bill of materials.
The CRL nobody has in a calendar
A certificate that expires breaks one service. A certificate revocation list that expires breaks revocation checking for everything its CA ever signed, all at once, and for an offline root nothing automatic replaces it.
Ducks in a Row watches every CRL in the chain of the CA you connect it to, the offline root's included. It reads them from the CA itself and from the distribution points over LDAP and HTTP, and it watches each copy separately: a root CRL renewed into the directory but never copied to the web server is reported, with the location named.
A CRL published by hand gets warnings 30, 14, 7 and 1 days before it expires, by default. A CRL your CA replaces on a timer stays quiet unless the CA misses its own schedule, and warns again if it expires. The warnings go out by email and webhook, like certificate expiry, and they are part of the free core.
No telemetry. Ever.
Ducks in a Row runs entirely on your own servers and never sends data back to us or to anyone else. Fonts and other assets are bundled with the app, so the dashboard makes no third party requests. A tool that sits in front of your certificate authority should not be watching you, and this one does not.
Tiers
-
Free
The core, free in production on infrastructure you own or operate, or administer for customers as part of a managed IT service. One CA, the dashboard and alerting, CRL monitoring, all four ACME challenge types, external account binding, the setup wizard and the signed installer.
No limit on certificates. Community support.
-
Standard
For estates that grow past one CA, with the first paid modules.
Support by email, best effort.
-
Compliance
For regulated organisations that need audit evidence and stronger controls.
The support subscription is included.
The paid tiers are being shaped with our first customers, so what they hold is a direction, not yet a commitment. Paid modules are closed source and install beside the core, and nothing in the core moves behind them.
Support
Community help is free in GitHub Discussions. A support subscription gives your organisation a first reply from a person by the end of the next business day, as a response target with no penalties. It is available on Free and Standard, and included in Compliance; ask licensing@haruspex.systems. The support page has the details.
Security fixes
Ducks in a Row receives security fixes until 31 December 2031, at least five years after 1.0.0 became generally available, delivered through upgrades to the latest release, with no backports.
Security fixes are free to everyone, with or without a subscription. To hear about each one, sign up for security notices. Report a vulnerability to security@haruspex.systems, as the security policy describes.
License
Ducks in a Row is published under the Business Source License 1.1. It is source available and free in production on infrastructure you own or operate, or administer for customers as part of a managed IT service. Each version of the core becomes Apache License 2.0 four years after its release. Reselling it, or hosting it as a competing product, needs a commercial license. Licensing in plain language.
Contact
- Early access, support subscriptions and licensing: licensing@haruspex.systems
- Feedback and ideas: feedback@haruspex.systems
- Security reports: security@haruspex.systems
- Questions and help: GitHub Discussions