Security at EverTLS
EverTLS manages the certificates your services depend on, so we design it to need as little of your secret material as possible, and to protect what it does hold.
Your keys can stay with you
- Private keys on your servers. With the EverTLS agent, a fresh private key is generated on your server for every renewal; only the certificate signing request reaches EverTLS. You can also upload your own CSR.
- DNS keys on your servers, or none at all. Validate with one CNAME record per domain and no DNS key, or keep the DNS provider key on your server and let the agent create the validation records. EverTLS only learns the key’s name.
- PFX passwords on your servers. The agent can generate a different password for each certificate and keep it locally, or use passwords you set on the server. EverTLS only learns their names.
- If you choose to let EverTLS hold a private key or DNS credential, it is encrypted at rest with AES-256-GCM.
The agent
- Makes outbound HTTPS connections only; it opens no ports. Every request is signed with the agent’s own Ed25519 key, created on your server at enrolment.
- The server can only ask for work the agent is configured to allow: hooks and extra folders are defined on your server, never sent by EverTLS.
- Every install is tested before and checked after: configuration test, reload, a check that the new certificate is served, and automatic rollback if anything fails.
- On Linux it can run as an unprivileged user with sandboxing (restricted mode); on Windows its local secrets are encrypted with DPAPI and readable only by SYSTEM and Administrators.
- Signed releases. Agent binaries are listed in a checksum file signed with an EverTLS release key (ECDSA P-256) that is kept offline, never on our servers. The installers, served from evertls.com rather than the EverTLS application, refuse anything that isn’t signed with it. Our release public key:
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsYSeatBba4CZnM08Ua08rJaUNvd9 xRmX8M2tA7sk5Lmpk013I8dGNzfBjyket0fOszzkVN0vqYA/taKa+S3zZQ== -----END PUBLIC KEY-----
Accounts and access
- Passwords are hashed with Argon2id; sign-in attempts are rate limited.
- Two-factor sign-in (authenticator apps), which an organisation can require for every member.
- Single sign-on with OpenID Connect (Microsoft Entra ID, Google Workspace, Okta and others) for your verified company domains, which you can require for every member below owner.
- Roles (owner, admin, member, viewer) and API tokens scoped to an organisation.
- Network restrictions: allow the dashboard, API and agents only from your listed IP addresses and ranges, per organisation and per API token.
- Company domains: prove your email domain so colleagues join your organisation instead of creating their own.
- A tamper-evident audit log of security-relevant actions.
Infrastructure and operations
- All traffic uses TLS. Session cookies are HttpOnly and SameSite; the dashboard sends a Content Security Policy.
- Hosting: Hetzner Online (Germany) for the application and database; OVHcloud (Singapore) for secondary DNS and backups; Vercel for this website. See the Privacy Policy for every service that handles your data.
- Backups are encrypted before they leave the server, with a key whose private half is kept offline, and sent to a separate write-only location. Restores are tested.
- If a breach is likely to cause you serious harm, we’ll notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
- EverTLS doesn’t hold SOC 2 or ISO 27001 certification yet. Ask us at security@evertls.com for security questionnaires.
Report a vulnerability
If you think you’ve found a security problem in EverTLS, please tell us at security@evertls.com. Include what you found, how to reproduce it, and its impact as you understand it.
- We’ll acknowledge your report within 3 business days and keep you updated until it’s resolved.
- Please give us reasonable time to fix the problem before you disclose it publicly; we aim to fix serious issues within 90 days and will agree a disclosure date with you.
- We’ll credit you when the fix is announced, if you’d like.
In scope: app.evertls.com, the EverTLS API, the EverTLS agent and its installers, and evertls.com.
Please don’t: access or change other customers’ data (use accounts you create), run denial-of-service or high-volume automated tests, use social engineering or physical attacks, or test against servers of our providers (certificate authorities, hosting, email).
Safe harbour: if you act in good faith and follow this policy, we won’t pursue or support legal action against you for your research, and we’ll consider it authorised.