CertConductor

Inspiration

TLS certificate lifetimes are collapsing. The CA/Browser Forum is taking the maximum certificate lifetime from 398 → 200 days (2026) → 100 (2027) → 47 (2029). Renewal is going from a once-a-year chore to a near-monthly, high-stakes scramble — and the data is brutal: ~83% of organizations had a certificate-related outage in the last 24 months, and 15–25% of certificates have no known owner. Real outages at crates.io and IBM Aspera trace back to a single human who simply forgot to check.

It's exception-heavy work where the final "swap it now?" call genuinely needs a human — the exact shape UiPath Maestro Case was built for. We wanted an agent that does the 20 minutes of investigation a human would do, then hands them a one-click, fully-contextual decision.

What it does

CertConductor runs one Maestro Case per expiring certificate:

1. Assess — a coded LangGraph AI agent classifies the renewal mechanism (ACME / manual-rekey / HSM / orphaned), resolves the owner, scores blast radius, and writes a one-sentence summary.
2. Human Decision — if the agent flags risk (manual-rekey, HSM, or an ownerless "shadow cert"), the case pauses and creates an Owner Approval task in Action Center showing the cert, branch, criticality, and blast-radius summary, with Approve / Defer / Reject.
3. Renew & Close — on approval it renews, verifies, and closes — rolling back on a failed verification. SLA timers are tied to the expiry clock; orphaned certs escalate to nobody, surfacing the risk instead of silently ignoring it.

How we built it

100% through Claude Code driving the UiPath CLIs and the official UiPath Agent Skills — no low-code canvas:

• The brain: a coded LangGraph agent (Python) — a router plus four specialists (classifier, owner-resolver, blast-radius reasoner, renewal-planner). Scaffolded, tested (34 unit tests), and shipped with uipath new → run → pack → publish to UiPath Orchestrator. It reasons via the keyless UiPath LLM Gateway.
• The orchestration: the Maestro Case authored as code — a caseplan.json built with the uipath-maestro-case Agent Skill (plan → JSON → uip maestro case validate (0 errors / 0 warnings) → uip solution upload).
• The human-in-the-loop: a Coded Action App (React + @uipath/uipath-typescript) deployed to Action Center via uip codedapp publish -t Action → deploy.
• Agent Skills installed with uip skills install --agent claude.

The whole solution is the "UiPath for Coding Agents" story, demonstrated end to end.

Challenges we ran into

• Regional model routing: the EU LLM Gateway only routes OpenAI models — Gemini/Claude returned 417 "no routing rule." We diagnosed it from the gateway error body and switched the agent to gpt-4o-mini.
• Structured-output reliability: the model occasionally omitted fields; we hardened every output model with field descriptions, safe defaults, and a synthesized-summary fallback so a partial response never breaks a run.
• Agent ↔ Case completion handshake: the deepest one — the coded-agent task dispatches its Orchestrator job and the agent runs successfully (✓ Successful execution in the job logs), but the Maestro Case doesn't always register the job's completion, causing the case to re-evaluate. We traced it through the instance span export down to the exact element, ruled out our agent's output format (the behavior persisted across two agent versions), and isolated it to the platform completion mechanism — a great example of debugging an agentic system end to end with real telemetry.

Accomplishments that we're proud of

• A genuinely novel, well-timed use case — machine-identity lifecycle as an exception-heavy case with human approval gates, on a problem whose urgency is objectively increasing.
• A real multi-agent, production-minded design: 4 specialists, 4-way exception branching, orphaned-promotion, idempotent deploy + rollback, SLA-vs-expiry timers, 34 tests, and an eval harness.
• Three coded UiPath artifacts (agent, Maestro Case, Action App) — all built and deployed through coding agents, the literal AgentHack "UiPath for Coding Agents" theme.

What we learned

How deep the UiPath coding-agent surface goes — the uipath/uip CLIs and Agent Skills can author and ship an agent, a Maestro Case, and an Action App entirely from the terminal. And how to debug an agentic, multi-system orchestration using span/trace telemetry rather than guesswork.

What's next for CertConductor

Real ACME/CA and CT-log integration (mocked today), publishing the agent + case to the AI Catalog, a multi-cert triage dashboard, and finalizing the agent↔case completion handshake with the UiPath team.

Built With

• anthropic-claude
• claude-code
• langchain
• langgraph
• openai-gpt-4o-mini
• pydantic
• pytest
• python
• react
• typescript
• uipath
• uipath-action-center
• uipath-llm-gateway
• uipath-maestro-case
• uipath-orchestrator