Certificates renew silently.
Until they don't.
Track SSL, domain, APNs, and SAML certificates across every client. Get alerted when fingerprints change unexpectedly—the same day a renewal fails.
Example data
as of 2026-10-19
Why this matters: SC-081
The CA/B Forum passed ballot SC-081, reducing maximum public TLS certificate validity on a fixed schedule. Renewals that used to happen once a year will soon happen every 47 days.
Previous standard. Renewed roughly once per year.
Current maximum. Almost twice as many renewals.
Three to four renewals per year. Manual tracking breaks.
Nearly every six weeks. Automated monitoring required.
What CertWatch does
Four certificate types in one place
Monitor SSL certificates, domain registrations (RDAP), Apple APNs push certificates, and SAML signing certificates. Organize by client, bulk-import domains, upload .p12/.pem files.
Failed-renewal detection via fingerprint tracking
CertWatch checks daily and stores each certificate's fingerprint. When a cert changes but less than a third of its validity remains, you get an alert—the same day the renewal went wrong.
Alerts at 30/14/7/1 days, email + Slack
Receive threshold alerts at 30, 14, 7, and 1 day before expiry. Alerts go to email and Slack webhooks you configure per client or globally.
White-label client reports
Generate monthly reports with your agency branding—logo, name, and custom colors. Shareable links and PDF export. Pro plan only.
Pricing
Three tiers. Limits are per monitored item (one SSL cert, one domain registration, one APNs cert, or one SAML cert). Daily checks, all certificate types, failed-renewal detection, and alerts included on all plans.
| Plan | Free | Agency | Pro |
|---|---|---|---|
| Monthly price | $0 | $19 | $49 |
| Items | 5 | 100 | 500 |
| Daily checks | ✓ | ✓ | ✓ |
| Email & Slack alerts | ✓ | ✓ | ✓ |
| Failed-renewal detection | ✓ | ✓ | ✓ |
| Multi-client dashboard | ✓ | ✓ | ✓ |
| White-label reports | — | — | ✓ |
| PDF export | — | — | ✓ |
| Start free | Start Agency | Start Pro |