We won't let you get blindsided again! CertTracker watches every TLS endpoint you care about — public sites, internal services, customer infrastructure — and alerts you the moment something changes or approaches expiration. Set it up in minutes, run it for years. And when renewal time comes, CertTracker can now issue and deploy the new certificate for you — automatically, across your whole fleet.
No credit card required · Full Pro features during trial · Cancel any time
The Network Discovery Scanner sweeps any subnet for TLS-bearing services in about 30 minutes — HTTPS, mail, LDAP, databases, admin consoles, custom ports. Found certs are one-click added as monitors. The most common first-run outcome: three to five forgotten certs already silently expired. Then add hostnames manually for anything the scanner can't reach — CertTracker captures the live cert and the full chain in seconds.
Email alerts when certificates change unexpectedly or are approaching expiration. Tag related monitors as an application stack — the same cert across a load balancer, four origin servers, and a CDN endpoint — and CertTracker routes alerts to the team that owns the stack, not to everyone.
Every issuer change, SAN update, or rotation is recorded in change history so you can see exactly when and how a certificate moved. No more guessing who renewed what.
See your estate cert by cert, not endpoint by endpoint — every certificate and everywhere it's deployed, wildcards first. When one name has more than one certificate live, a renewal still rolling out or two CAs side by side, they're grouped together so you can spot the endpoint that missed the new cert.
Every poll flags weak ciphers, deprecated TLS versions, and certificates served on the wrong hostname — surfacing the misconfigurations that an “expires in 60 days” reminder would miss.
Watch the registrar, nameservers, and renewal date for every domain you own — and the ones you want to grab when they drop. Alerts fire on expiration windows, registrar/NS changes, and watched-becomes-available.
Auto-renewing certificates depend on DNS that has to stay correct
long after setup — CAA vs the issuing CA, A/AAAA, and the ACME
_acme-challenge delegation. CertTracker verifies it,
alerts the moment it drifts, and lets you preflight DNS-01 with a real
Let’s Encrypt staging test before a silent renewal failure bites.
Not just HTTPS. CertTracker reads the cert a service actually presents on the wire — mail over STARTTLS (SMTP, IMAP, POP3), LDAP, PostgreSQL, MySQL/MariaDB and SQL Server, the 802.1X / RADIUS server cert, and now the Cisco CAPWAP wireless-controller cert. The certificates that fail silently and take a whole service — or all of Wi-Fi — down when they expire.
Drop the CertTracker poller binary inside your own network and monitor internal endpoints that never face the public internet. Same UI, same alerts, fully air-gapped data path.
Request and renew from the CA you already use — Let's Encrypt, Google Trust Services, Sectigo, DigiCert, ZeroSSL, and many more — or your internal Microsoft AD CS over SCEP or CES. CertTracker renews ahead of expiry and installs the new cert before anything goes red. Public or private, no more calendar reminders.
One renewed cert, installed everywhere it lives — nginx, Apache, IIS, pfSense, TrueNAS, Microsoft NPS, and network gear from Cisco (IOS, Catalyst 9800, ISE, CIMC), Dell iDRAC and HP JetDirect. Add a host, pick the service, done.
A lightweight agent runs inside your network and generates and holds the private keys. CertTracker orchestrates issuance and deployment but stays zero-knowledge of your keys — they’re created on your own hosts and never uploaded.
Automate the certificates ISE runs on — admin, portal, EAP/RADIUS, SAML, pxGrid — issued from your internal CA and imported over ISE’s API. CertTracker trusts the issuing CA in ISE first, binds the roles you pick, rides the service restart, and verifies the node came back on the new cert.
A rotation only breaks things when a relying party stops trusting the new issuer. CertTracker pushes the issuing CA into the trust stores that need it — starting with ISE’s own — so certificates keep validating as your CA rotates, with no manual re-import.
Deployments that restart a device move only inside the maintenance windows you set — with criticality ordering so the most important hosts go first, blackout dates and holidays honored, and a manual override for when you need it now.
Create your company account in under a minute. No credit card. Your 14-day trial unlocks the full Pro plan so you can put CertTracker through its paces on real infrastructure.
Drop in hostnames and ports for the endpoints you want watched. CertTracker polls them on the schedule you choose — from every five minutes to once a month.
Configure recipients per monitor and let CertTracker handle the watching. You'll hear from us only when something needs attention.
Every paid plan starts with a 14-day free trial of Pro features — no credit card required. Switch tiers any time after, including downgrade to Personal. Billed by 12 Squared Technologies LLC. All prices in USD; non-US cards are billed in USD and your bank handles the local-currency conversion.
$0/forever
For homelabs and side projects.
$19.99/month
For solo operators outgrowing the free tier.
$49.99/month
For small teams keeping a tight fleet healthy.
$129.99/month
For ops teams managing customer infrastructure.
$0.625/monitor/mo
$250 / mo minimum
For large fleets that have outgrown Business.
Start your 14-day trial — full Pro features, no card required. Switch tiers any time after, including downgrade to Personal.
