CertTracker
Features Pricing Compare plans
Log in Start free trial
Product Roadmap

See what we're building next.

Vote for features you want most. Log in to vote and suggest features.

In Progress 2

Alternative Notification Channels

Receive certificate expiry, availability, and change alerts through the channels your team already uses — Microsoft Teams, Slack, WhatsApp, PagerDuty, and more — in addition to or instead of email.

Upvotes

Full CLM Support for Let's Encrypt Certificates

Add-on support for automation to renew and deploy Let's Encrypt certificates directly from our site.

Upvotes
Coming Soon 2

MSSQL deep TLS audit

Bring the full TLS hardening audit — protocol acceptance, cipher strength, forward secrecy, and more — to Microsoft SQL Server endpoints. Today MSSQL gets basic certificate monitoring (expiry, change detection, hostname match) but not the deep audit panel.

Upvotes

Distrusted CA detection

Warn when a certificate's issuer matches a CA that has been distrusted by major browsers or hit a publicly known incident.

Upvotes
Future Ideas 13

Opt-In Certificate Industry News Emails

Stay informed about CA incidents, root certificate changes, and industry events that could affect your certificates — opt in to receive occasional advisory emails from the CertTracker team.

Upvotes

Monitor In-House Certificate Authorities

Track certificates issued by your own internal CA alongside public certificates — get the same expiry alerts, change detection, and inventory visibility for your private PKI.

Upvotes

Origin Certificate Monitoring (Behind CDN)

Monitor the certificate on your origin server directly, bypassing CDN edge nodes — so you can track both what your users see and what's running underneath.

Upvotes

Custom SNI Hostname Override

Specify a different hostname for the TLS handshake than the one being resolved — useful for staging environments, internal servers, and shared-IP hosts where DNS doesn't point where you need it.

Upvotes

RADIUS / EAP-PEAP certificate monitoring

Track the server certificate your RADIUS servers present to Wi-Fi and 802.1X clients — the cert that, when it expires, locks everyone out of the network.

Upvotes

iOS app

Native iOS app with push notifications for cert changes and expirations.

Upvotes

Azure certificate discovery

Connect your Azure tenant and automatically discover and monitor certificates across Key Vault, app registrations, and web services — no per-host setup.

Upvotes

Android app

Native Android app with push notifications for cert changes and expirations.

Upvotes

AWS certificate discovery

Bring the same automatic cloud discovery to AWS — ACM certificates, IAM server certificates, and ACM Private CA — via a read-only role.

Upvotes

CES/CEP enrollment (authenticated internal-CA issuance)

Issue from a Microsoft internal CA via Certificate Enrollment Web Services (CES/CEP) — fully authenticated automated enrollment, no single-use SCEP challenge password.

Upvotes

DNS-01 TXT Automation

Let CertTracker create and remove the _acme-challenge DNS record for you through your existing DNS provider, so renewal testing — and, later, renewals themselves — need no manual DNS edits.

Upvotes

Certificate Transparency presence

Cross-check certificates against Certificate Transparency logs to detect missing entries and — more usefully — unexpected ones.

Upvotes

RC4 cipher detection

Detect endpoints that still accept the long-broken RC4 cipher — including cases a standard scan can miss.

Upvotes
Completed 54

Choose your own theme

Pick the look that suits you — a bright light theme, the classic dark, or a warmer palette — right from the header. Your choice follows your account on every device.

Upvotes

Free website TLS check

Run a free, one-time SSL/TLS health check on any site you control — expiry, issuer, chain trust, protocols, ciphers, and hardening — right from our site, no account needed.

Upvotes

Free offline network scanner

Download a free Windows app that finds the certificates across your own network — entirely on your machine, nothing uploaded — so you can see what you have before you commit to anything.

Upvotes

Revocation status (OCSP)

Check each certificate's revocation status via OCSP and surface revoked or unknown results.

Upvotes

Chain validation & self-signed detection

Surface whether a certificate would validate against a normal browser trust store, separately from whether the handshake succeeded.

Upvotes

Proper Scanner GUI

A native desktop UI for the Network Discovery Scanner — paste your API token, type a CIDR, pick port profiles via checkboxes, watch live progress, click "Add selected" to create monitors. Same engine as the CLI today, friendlier shell.

Upvotes

Certificate inventory view (by certificate)

See your certificates listed one row per certificate — not per endpoint — with everywhere each one is deployed, so you can plan renewals and rotations at a glance.

Upvotes

Automated issuance & renewal DNS health

Verify the DNS records that let your certificates auto-issue and auto-renew are set up correctly — and alert you if they get changed or removed after the fact.

Upvotes

Expanded service coverage — mail, LDAP & database TLS

Monitor certificates on services that upgrade to TLS in-band (STARTTLS) rather than serving it on a dedicated port — starting with mail, directory, and database servers.

Upvotes

IP Range Scanning

Scan Range of IP for hidden Certs

Upvotes

Network Discovery Scanner

Sweep an IP range for TLS-bearing services and one-click add the new endpoints as monitors — the fastest way to onboard a network you didn't build.

Upvotes

Mobile-responsive web app

Full mobile layout for dashboard, monitor detail, and change history on viewports under 768px.

Upvotes

API access for integration to NMS Sytems

Allow monitor status and summary information via API calls to allow integration with customer in house or cloud NMS.

Upvotes

Key size & algorithm strength

Detect certificates using undersized or deprecated keys: RSA below 2048 bits, ECDSA below P-256, DSA at any size.

Upvotes

TLS session resumption support

Detect session-id and session-ticket resumption support. Purely informational metadata for performance-conscious admins.

Upvotes

Server cipher preference

Detect whether the server enforces its own cipher preference order. Important for ensuring strong ciphers actually get picked when modern clients connect.

Upvotes

CAA DNS record check

Confirm the monitored domain has a CAA record restricting which Certificate Authorities can issue for it. Closes a quiet mis-issuance vector.

Upvotes

TLS compliance profile rollup (PCI DSS 4.0 / NIST 800-52r2)

Single pass/fail per monitor against PCI DSS 4.0 and NIST 800-52r2 TLS requirements, derived from the granular checks. Particularly valuable for MSPs serving regulated clients.

Upvotes

HSTS header audit

Check for HTTP Strict Transport Security headers on HTTPS endpoints. Validates max-age length, includeSubDomains, and preload-list membership.

Upvotes

OCSP stapling check

Verify the server delivers a stapled OCSP response in the TLS handshake — faster certificate validation and better client privacy than client-side OCSP lookups.

Upvotes

Forward secrecy enforcement

Detect whether the server requires ephemeral-key ciphers (DHE/ECDHE). Without forward secrecy, past traffic can be decrypted if the long-term key is later compromised.

Upvotes

Monitor Intermediate Certificates

Detect when intermediate certificates in your chain are approaching expiry or have changed — not just the leaf certificate — so a bad chain rotation doesn't catch you off guard.

Upvotes

Cipher suite enumeration

List every cipher suite the server will accept, sorted by strength. Reveals weak ciphers still on the list even when stronger ones are preferred.

Upvotes

TLS protocol acceptance probe

Enumerate which TLS versions the server actually accepts — not just the one we negotiate. Surfaces deprecated protocols still enabled alongside modern ones.

Upvotes

Export All Account Records

Export all the account and logs for an account.

Upvotes

Account Data Purge

Purge all account data and replace with a confirmation date record

Upvotes

Excessive validity period detection

Flag certificates issued for longer than the 398-day maximum browsers enforce.

Upvotes

Hostname mismatch alerts

Email alert when a monitor's hostname stops matching the certificate's Subject CN or any SAN entry.

Upvotes

Weak signature algorithm detection

Flag certificates signed with SHA-1, MD5, or other broken signature algorithms.

Upvotes

Weak cipher & deprecated protocol alerts

Email alerts when a monitor negotiates a weak cipher or deprecated TLS version, on top of the existing in-app warnings.

Upvotes

Send Test Notification

Administrators can send a test email for any notification type — expiry warning, certificate change, availability alert, or recovery — directly from the Administration page, so you can verify delivery and formatting before a real event fires.

Upvotes

Custom Monitor Tags

Create and assign your own tags to monitors — group them by environment, team, application, or anything that makes sense for your organization — then filter the inventory by tag to focus on exactly the monitors you care about.

Upvotes

Certificate element change tracking or highlighting.

Highlight content or fields that have changed or been updated.

Upvotes

MSP Company Access

Companies can designate themselves as an MSP and then their customers can grant them access to manage their accounts.

Upvotes

Hostname / certificate CN mismatch detection

Flag monitors where the certificate's Common Name or SANs don't match the hostname being monitored.

Upvotes

Monitor Filter & Sort Bar

A filter bar above the monitor table lets you narrow the list by domain, polling interval, status, or availability, and sort by priority or days until certificate expiration — making it fast to find what you're looking for in large inventories.

Upvotes

Community wiki

A collaborative knowledge base where users can share configuration tips, integration guides, and troubleshooting solutions.

Upvotes 💬 1

Reseller workflow improvements

Audit and polish the full reseller journey: referral visibility, commission tracking, and payout reporting.

Upvotes

Priority Reorder — Number Input Shifts Full List

Typing a priority number into the input field now correctly repositions that monitor and renumbers all affected rows, matching the behavior of drag-and-drop reorder.

Upvotes

Per-monitor alert frequency

Set different alert cadences per recipient on the same monitor — immediate for on-call, daily digest for managers.

Upvotes

Support ticket system

In-app ticket submission so customer issues are tracked and never lost in email.

Upvotes

Offsite database backups

Daily blob backups of both the primary and replica databases for point-in-time restore capability.

Upvotes

Feature request portal

Public roadmap and community voting on upcoming features — the page you're looking at right now.

Upvotes

Force-poll button

Immediately trigger a fresh poll for any monitor instead of waiting for the next scheduled interval.

Upvotes

Monitor detail modal improvements

Days Remaining indicator and previous/next navigation added to the monitor detail popup.

Upvotes

Enterprise tier & self-serve billing

Enterprise plan with volume pricing, unlimited users, and private pollers — available directly through the app.

Upvotes

Health page

Internal admin dashboard showing service status, database health, poller heartbeats, and live journal logs.

Upvotes

PostgreSQL logical replication

Live replica of the production database on the UAT server for zero-downtime failover capability.

Upvotes

UAT environment

Dedicated staging server (persistent) cloned from production for safe testing before release.

Upvotes

Monitor enable / disable (Paused state)

Pause individual monitors or all at once. Paused monitors keep full history but are skipped by the poller.

Upvotes

Private poller distribution & assignment

Deploy private pollers to your own infrastructure and assign them to specific monitors.

Upvotes

Windows poller CI pipeline

Native Windows poller binary built and distributed via automated CI.

Upvotes

Reseller program

Referral and commission tracking for reseller partners.

Upvotes

UTC storage with browser-local display

All timestamps stored in UTC; displayed in each user's local timezone.

Upvotes