Why did Certeasy change its name to Hortval?

The former name turned out to be shared by other, unrelated products. Same product, same team, same company, and nothing changes for a running deployment. Read the full story.

Is Hortval a certificate authority (CA)?

No. Hortval is not a CA and does not issue public certificates. It acts as an internal ACME server in front of your existing Microsoft ADCS CA. All issuance remains on-prem.

Do I need to expose Hortval on the Internet?

Never. Hortval is designed to run fully on-premise. Your ACME clients point to an internal URL such as:
https://acme.your-domain.local/directory.

How is Hortval installed?

You install Hortval on an internal server, connect it to your ADCS CA, and configure your servers to use the internal ACME URL.

Does Hortval require Internet access?

Not for its PKI work, and it can run fully air-gapped. Certificates, private keys, CSRs, the domain names you issue for, ACME data, DNS configuration and the audit log never leave your network. No analytics, no trackers.
By default (online mode), Hortval makes a single outbound connection: HTTPS to api.hortval.com for the license lifecycle (registration, validation, automatic renewal, plan changes). What it sends is limited to licence metrics: the licence and installation keys, the declared machine name and environment, the binary version, the database driver, and the number of configured authorities and managed servers. No certificate, no key, no issued domain name — the exhaustive list is in our terms of use.
For air-gapped or strictly segmented networks, set offline mode (license: offline: true): zero outbound connections. Nothing leaves the server, not even a licence metric — the strongest guarantee we can offer.
The trade-off is real: the entire licence lifecycle becomes manual. Renewal, change of offer, retirement, updates — each one means downloading the file from the portal and installing it on the server. Expiry reminders still arrive by email, but acting on them is up to you: nothing catches an oversight, and once the licence expires, after the grace period, the service stops. Offline mode is a date in a calendar, not just a line in a configuration file.
A self-update mechanism is on the roadmap. The EU Cyber Resilience Act (CRA, Annex I) requires automatic security updates to be enabled by default, with a clear and easy opt-out; Hortval will follow that model in online mode (on by default, opt-out), while air-gapped or offline deployments never auto-update.

Is Hortval production-ready?

Hortval is a stable release, already used for day-to-day issuance, renewal and revocation. Core ACME issuance, HTTP-01, DNS-01 and TLS-ALPN-01 validation, and revocation (CRL/OCSP propagation to ADCS) are all implemented and supported, with certbot, acme.sh and lego. We reserve the full production-ready label for the upcoming V1 milestone, which closes a couple of known, non-blocking limitations (see below). Upgrading to V1 will be recommended once available.
Plan limits (managed server quota, CA count) are enforced by the binary at startup and on every new order, including during the evaluation period.

Are there any known limitations?

Yes, and we list them openly. As of today:
• Data retention: there is no automatic cleanup yet, so ACME records (orders, authorizations, challenges) accumulate over time. On long-lived deployments, plan periodic maintenance until automated retention ships.
• Health / metrics endpoints: there are no built-in HTTP health or metrics endpoints yet, so supervision relies on logs and database introspection for now.
Neither blocks core certificate automation, and both are scheduled for the V1 release. See the changelog for the full, up-to-date list of known limitations.

Can I use certbot with Hortval?

Yes. Hortval supports any standard ACME client including Certbot, acme.sh, lego, Caddy, Posh-ACME, and others.

Which ACME challenges are supported?

Hortval supports HTTP-01, DNS-01 and TLS-ALPN-01 on all plans, today. Distributed validators for segmented networks are planned for V3.

If Hortval goes down, are my certificates at risk?

No. Certificates already issued keep working regardless. ACME clients start renewal 30 days before expiry, giving ample time to restore the service before any certificate actually expires.

What's the difference between the Free, Starter, Pro and Enterprise plans?

• Free: 1 production installation, ~25 managed servers, 1 ADCS production authority. Renewed annually at €0, price locked.
• Starter: €299/year, 1 production installation, ~250 managed servers, 2 ADCS production authorities.
• Pro: €499/year, 1 production installation (cold Active/Passive supported), unlimited managed servers, 3 ADCS production authorities, PostgreSQL, SQL Server.
• Enterprise: €999/year/CA, everything in Pro + up to 5 ADCS production authorities, split deployment, Active/Active HA (V2), distributed validators (V3).

What does "1 production installation" mean?

One license covers one production Hortval deployment. Dev and staging instances may run under the same license at no additional cost. They do not count as production installations.

Can I run multiple Hortval instances?

Yes. One license covers one production installation, and dev and staging are included. For failover you can run cold Active/Passive (a second host, standby stopped, manual switchover) with PostgreSQL or SQL Server. Warm Active/Passive and Active/Active multi-node deployments are planned for V2 (Enterprise).

How does high availability work?

Today, Hortval runs as a single instance, or as cold Active/Passive with manual switchover: the standby is fully stopped, and you fail over by stopping the active node and starting the standby (shared PostgreSQL or SQL Server, no SQLite). Running two instances concurrently is not supported.
Warm Active/Passive and Active/Active high availability are planned for V2 (Enterprise).

Do plan limits apply right now?

Yes. The managed server quota (distinct ACME accounts with at least one active certificate) and CA count limits are enforced according to your plan, including during the evaluation period. You can switch to a different evaluation plan during the trial; the new plan's limits apply from that point.

What happens after the 6-month free trial?

Nothing automatic. 15 days before expiry, we'll ask whether you want to continue. If you subscribe, you pay for a year. A new license file is sent to your email. Replace the existing hortval.lic on your server: no reinstallation, no configuration change. Your license is extended by one year from the trial expiry date, not from the payment date.
On connected installations, auto-renewal can be configured so the binary fetches and replaces the file itself. On air-gapped servers, the manual file replacement is the only step required.
If you stop, the license simply expires.

What does "price stability over time" mean?

Once you become a customer, your price stays the same. Any future pricing changes will apply only to new customers.

What database should I use?

SQLite (Free, Starter): zero setup, single file, sufficient for most deployments up to ~250 managed servers.
PostgreSQL or SQL Server (Pro+): recommended for larger infrastructures, cold Active/Passive failover, and teams that already operate a PostgreSQL or SQL Server stack.

Are the certificates secure?

Yes. Hortval uses your existing ADCS templates and policies. Certificates are identical to those issued through Microsoft consoles, just automatically.

Can we audit the source code before buying?

Yes. Source code access is available under NDA for security evaluation purposes — whether you are a prospect or an existing customer. Contact us at [email protected] to request access.

What features are planned next?

V2: split deployment (ADCS connector on Tier 0), warm Active/Passive and Active/Active high availability.
V3: distributed validation agents for segmented networks.
V4: admin dashboard, certificate expiry tracking, network discovery.

How does support work?

• Free: email support (best-effort, for now).
• Starter: email support.
• Pro: priority email support.
• Enterprise: priority email and Teams support.
There is no phone support.

Do you offer onboarding or professional services?

Yes. Paid onboarding and advanced-support engagements are available on request, on any plan. A one-year license is included in the engagement, so the license cost for that year is effectively covered by the service. Contact us at [email protected] for a quote.

Can I upgrade from Starter to Pro or Enterprise?

Yes, at any time. Upgrading requires no reinstallation.