Stop managing certificates. Start automating them.
Zaita is the only platform that discovers every certificate across your entire organisation, runs your private PKI with ironclad key protection, and automatically renews and deploys certificates to your servers — so expiry outages become a thing of the past.
30 days free · Full enterprise limits · No credit card required
The Mandate
Certificate lifespans are shrinking — fast
Global standards bodies are mandating shorter and shorter certificate lifespans. Manual renewal processes that barely hold together today will completely collapse within years — and the timeline is accelerating.
Source: CA/Browser Forum Ballot SC-081 — Short-Lived Certificates
Platform
Every capability your security team has been asking for
Six deeply integrated capabilities covering the full certificate lifecycle — from finding certificates you didn't know existed, all the way to zero-touch automated renewal and deployment.
Certificate Discovery
Build a complete picture of every certificate across your organisation — including ones issued without your knowledge. New certificates are surfaced within 24 hours.
- Automatically catch certificates issued without your knowledge
- Scan across web, database, and mail services automatically
- Scan internal networks securely — zero firewall changes required
Private PKI
Build a complete root and intermediate CA hierarchy — fully managed, with private keys protected in a dedicated, isolated signing system that never touches the internet.
- Industry-standard encryption algorithms — you choose the strength
- Take your root CA key offline for maximum security
- Built-in ACME server for fully automated certificate issuance
Automation — Built for Every Environment
Three automation methods so no workload gets left behind. Push certificates to on-premises servers, pull from any cloud workload, or let any standards-compatible tool request its own certificates automatically.
- Bridges: zero firewall changes — connects out, not in, and self-updates
- Couriers: runs on a schedule, authenticates via cloud identity — no stored passwords
- Private ACME: secure, standards-based issuance — every major client supported
Target System Deployment
Certificates land on your servers and services restart — automatically, every time. Credentials are only ever decrypted in memory and never written to disk or stored in transit.
- Windows: IIS, Exchange, RDS Gateway, SQL Server, Windows Certificate Store
- Linux: Nginx, Apache, HAProxy, Postfix, and any custom application
- Least-privilege Windows deployments with Just Enough Administration (JEA)
Policy & Compliance
Stop non-compliant certificates from ever reaching production. Set your security standards once and Zaita enforces them — on every certificate, every time.
- Set policies per domain — warn on violations or block them entirely
- Fine-grained roles for every team — PKI, Deployment, Policy, Reporting, and more
- Lock down which certificates each server is allowed to request
Audit & SIEM Integration
Every action in Zaita — logins, certificate issuance, deployments, admin changes — is captured in a tamper-proof audit log and fed directly into your security monitoring tools.
- Complete audit trail — who did what, when, and from where
- Feed your SIEM directly via a secure, IP-restricted API
How It Works
From discovery to deployment — fully automated
Whether you're cloud-native, on-premises, or somewhere in between — Zaita handles the entire certificate lifecycle so your team doesn't have to.
Discover
Zaita continuously scans the internet and your internal networks to build a complete inventory of every certificate tied to your organisation — including ones you didn't issue.
Issue & Manage
Issue certificates from your own private CA or connect an existing one. Every certificate is automatically checked against your security policies before it's signed — no exceptions.
Automate & Deploy
Certificates are pushed or pulled directly to your servers, databases, and load balancers — and services restart automatically. Renewals happen silently in the background, every time.
Automation
Three ways to automate. Every environment covered.
Purpose-built for on-premises, cloud, and everything in between — Zaita's automation tools eliminate every last manual certificate operation across your infrastructure.
A small, self-contained agent you deploy on-premises. Bridges reach out to Zaita for work — all communication is outbound. No inbound connections, no firewall changes, no headaches.
- Windows installer, Linux packages, standalone binary, or Docker
- Deploys to Windows and Linux servers automatically
- Security tokens rotate automatically every 24 hours
- Self-updating — run multiple agents for built-in high availability
- Doubles as a secure relay for air-gapped environments
A lightweight scheduled tool that runs silently every 12 hours — no background service required. Couriers request, renew, and deliver certificates to the local application, then trigger service restarts automatically.
- No stored passwords — authenticates via cloud identity (Azure, AWS) or SPIFFE
- Private keys are generated and stay on the host — never transmitted
- Automatically restarts services on success, or triggers alerts on failure
- Connects directly to Zaita, or via a Bridge for air-gapped environments
- Works with CI/CD: GitHub Actions, GitLab CI, and more
Run your own private ACME endpoint backed by your Zaita CA. Any ACME-compatible tool — from Certbot to Kubernetes cert-manager — can request and renew certificates automatically. No custom scripts needed.
- Works with every major ACME client: Certbot, acme.sh, cert-manager, Caddy, Traefik, win-acme
- Secure client authentication keeps your ACME endpoint locked down
- Restrict which domains each client account is allowed to request
- Open standard — works with any ACME client, no vendor lock-in
- Multiple servers per account — isolate by environment or team
Security Model
Your private keys are protected by architecture — not just policy
Zaita is built with a unique split-system architecture. The internet-facing platform never touches your private key material — ever. A physically separate, air-gapped signing system handles all cryptographic operations with no external network access.
Even a complete breach of the web platform cannot expose your private keys. That's not a policy promise — it's a physical impossibility.
Hosting
Deployed wherever your compliance requirements demand
Fully managed shared hosting or your own dedicated infrastructure — across globally distributed regions to meet data residency requirements anywhere in the world.
Multi-Tenant SaaS
Fully managed cloud hosting with strong isolation between customers. Available across multiple regions with offline backups for peace of mind.
Single-Tenant
Your own dedicated infrastructure — complete isolation for regulated industries and the strictest compliance requirements. EU specialist providers available.
HSM Integration
Already have a Hardware Security Module? Connect it to Zaita for the ultimate in key protection and compliance assurance.
Pricing
Start free. Grow at your pace.
There are no hidden fees or surprise overage charges. Our pricing is transparent and predictable, so you can focus on building your PKI — not on managing your bill.
Everything you need to build and run a personal private PKI for the price of a coffee.
- One user account
- 1 Root CA + 2 Intermediate CA certificates
- 5 leaf certificates per month
- CT log scanning for 1 domain (24-hr monitoring)
- Web portal + 1 private ACME server
- Courier agent (direct SaaS connection, cron-scheduled)
No credit card required · start trial today
More certificates and more domains for active users. Perfect for home-lab use.
- One user account
- 20 leaf certificates per month
- CT log scanning for up to 2 domains
- 2 private ACME servers
- Courier agent (direct SaaS connection)
- Email support
Monthly billing · cancel anytime
For small teams ready to automate. SSO, Bridges, and target system deployment.
- Single Sign-On (SAML) with one identity provider (IdP) - Maximum 5 users
- 1 Root CA + 4 Intermediate CA certificates
- 50 leaf certificates per month
- CT log scanning for up to 2 domains + HTTPS endpoint scanning
- Web Portal + 2 private ACME servers
- Courier agent (direct SaaS connection)
- Credential-less machine auth (SPIFFE, Azure, AWS IAM OIDC)
- Email support
Monthly billing · cancel anytime
For growing teams that need higher certificate volumes, more automation, and a formal uptime guarantee with recovery SLAs.
- Single Sign-On (SAML) with one identity provider (IdP) - Maximum 20 users
- 100 leaf certificates per month
- 1 Bridge Deployment — on-prem 'push' deployment
- Automated deployment to Windows (WinRM) and Linux (SSH) servers
- Service accounts for DevOps / CI-CD pipelines
- 99.9% uptime guarantee (SLA-backed)
- 4-hour RTO / RPO recovery objectives
- Priority email support
Monthly billing · cancel anytime
Built to fit your environment. Whether you've outgrown the business plans or have specific requirements around data residency, key custody, or compliance, our enterprise offering is designed around your needs — not the other way around. Contact us for a no-obligation quote.
Frequently asked questions
Common questions from security and infrastructure teams evaluating Zaita.
Does Zaita ever have access to my private keys?
What is a Bridge and why does it need no inbound firewall rules?
How does Zaita handle the 47-day certificate mandate?
What authentication methods do Courier agents support?
Which target systems can Zaita deploy certificates to automatically?
Security expertise,
homegrown in Aotearoa
Simply Cyber Security Limited was founded in June 2021 with a clear mandate: bring world-class, independent security consulting and tooling to organisations across New Zealand and beyond — built entirely by New Zealanders, for the world.
We believe security should be practical, not performative. Our team focuses on genuine risk reduction — not checkbox compliance or boilerplate reports. When you work with us, you're working with specialists who've done this across government, finance, healthcare, and critical infrastructure.
Every line of Zaita's code is written, reviewed, and supported right here in New Zealand. No offshore handoffs, no outsourced support queues — just a team that's accountable, reachable, and deeply invested in the product.
Simply Cyber Security Limited
New Zealand Registered Business — NZBN: 9429049397420
Compliance & Standards Expertise
Deep practitioner experience across all major frameworks — from initial gap analysis through to certification and ongoing assurance.
100% New Zealand Team
Every engineer, consultant, and support agent is based in New Zealand. No outsourcing, no exceptions.
The certificate crisis is coming. Zaita is ready. Are you?
Get started with a 30-day free trial — no credit card needed, full enterprise features from day one.
30 days · Full enterprise limits · No credit card required