Skip to main content

Getting Started

Welcome to the official PKILess CLM documentation. This quick guide shows how to set up your environment, issue your first certificate, and enable expiration alerts in under 15 minutes.

Before you start​

  • Make sure you have access to the CLM portal
  • Have your primary domain on hand
  • Prepare an email address to receive notifications

What you'll see in this guide​

  • Accessing and logging into the CLM
  • Discovering existing certificates
  • Connecting to Let's Encrypt
  • Issuing your first certificate
  • Setting up expiration notifications

1. Access and login​

Access the CLM through your browser and log in with your email and password.

Forgot your password?
Use the **"Forgot my password"** link on the login screen. A reset email will be sent automatically.

2. Discover existing certificates​

Before creating new certificates, check which ones already exist in your public infrastructure. This avoids duplication and gives you better control over your inventory.

  1. Go to Discovery in the sidebar menu.
  2. On the Domain Scan tab, enter your main domain, for example yourcompany.com.
  3. Click Scan.
  4. When the scan finishes, click Import All to bring the certificates found into the CLM.

The inventory will appear on the Dashboard, and you'll be able to review which certificates need to be managed.

If the domain doesn't have public certificates yet, continue with the CA setup and issue a certificate from scratch.

3. Set up a CA — Let's Encrypt​

To issue certificates, connect at least one Certificate Authority. Let's Encrypt is ideal to start with since it's free, automated, and compatible with all major browsers.

  1. Go to Integrations in the sidebar menu.
  2. Find the Let's Encrypt card and click + Configure.
  3. Fill in the fields:
    • Name — example: letsencrypt-production
    • Email — address to receive notifications from the CA
    • Account type — select Staging to test or Production to issue a real certificate
  4. Click Create.
  5. Click Check Status to confirm the integration was established.
Testing recommendation
Use **Staging** to validate the flow without consuming your production quota. Then create a separate integration in **Production** for real certificates.

4. Issue your first certificate​

With the CA connected, create the CSR and request the certificate.

  1. Go to CSR in the sidebar menu.
  2. Click + New Request.
  3. Fill in the identification information:
    • Certificate Name — example: app.yourcompany.com
    • Domain / Common Name — protected domain, e.g. app.yourcompany.com
    • Key Size — keep 2048 bit to start
  4. Choose the CA and the validation method:
    • Select Let's Encrypt (Automated issuance).
    • Choose the account created in the previous step.
    • Select HTTP Challenge if you have access to the web server, or DNS Challenge if you control the DNS zone.
  5. Review the information and click Submit request.
  6. Follow the validation instructions and click Verify & Issue Certificate.

Once complete, the certificate will appear under Certificates with the status Valid.

See the full [Issue with Let's Encrypt](/guias/emitir/letsencrypt) guide for details on each method.

5. Enable expiration notifications​

Make sure you'll be alerted before any certificate expires.

  1. Go to Settings in the sidebar menu.
  2. On the Notifications tab:
    • Enable Email Notifications
    • Set Expiry Notification Period to 30 days
    • Enable Request Status Notifications for issuance failures
    • Add the emails that should receive alerts in Email Recipients
  3. Click Send Test Email to validate delivery.
  4. Click Save Notification Settings.

Done! What to do next​

You now have PKILess CLM set up with an active, monitored certificate. When you're ready to go further: