About SSL certificates

InfraNest keeps a single inventory of all your SSL/TLS certificates — wherever they live and whoever issued them — tracks when they expire, checks they're set up correctly, shows which of your domains aren't protected, and alerts you before anything breaks.

#What you can do

• See every certificate in one place, found automatically from your monitors, scans, pasted certificates and connected providers — all deduplicated into one list.
• Track expiry and get warned in good time. Auto-renewing certificates stay quiet while they renew on schedule, so an alert really means a renewal failed.
• Hear when a certificate is swapped, not when it renews. A renewal from the same issuer that covers the same names sends no alert. You are told when an address starts serving a certificate from another issuer, one that expires sooner, or one that no longer covers every name.
• Catch a renewal that stopped. A Let's Encrypt, ZeroSSL or Google certificate normally renews about a third of the way before it expires. If it is still the old one a few days after that, Home tells you — with weeks to spare — and says when it should have renewed. Until then it simply appears under Coming up on Home, dated at its renewal.
• Know when we lose sight of an address. Every address is checked at least once a day. If it stops answering — the name no longer resolves, the connection times out or is refused — and that is still true the next day, the address shows Not reachable for N days and Home tells you, because we can no longer vouch for its certificate. Check now tries again; the warning clears as soon as it answers.
• Check they're installed correctly — InfraNest rebuilds the certificate chain and tells you in plain language if something's missing or untrusted.
• Spot weak or misconfigured certificates — weak keys, old signatures, self-signed, hostname mismatches and more.
• Find gaps — see which of your domains are uncovered, expiring or expired, and scan any of them in one click.
• Catch unexpected certificates issued for your domains that you didn't set up.

#What a certificate costs

Open a certificate and its Cost panel shows the yearly price. Certificates from an issuer that doesn't sell them — Let's Encrypt, Cloudflare, Amazon and Google Trust Services — are recorded as free automatically, marked free from this issuer, so they don't sit in your Spend report as prices waiting to be filled in.

For anything else, select Set price and enter what you pay. We don't guess: issuers like ZeroSSL, Sectigo and DigiCert sell both free and paid certificates, so assuming yours was free would put a €0 next to something you're being billed for. A blank asks the question; a wrong zero answers it.

Paid or free, a price you enter yourself always wins and is never overwritten.

#The Certificates page

The page answers one question first: is anything at risk, and what do I do? It has three tabs: Overview, Addresses and All certificates.

#Overview

The overview reads top to bottom: what needs you, what is coming, everything else. Each problem is shown once.

• One sentence tells you where you stand — 29 of 31 addresses are fine. 2 need you. — with your counts in a line under it and, on the right, when your addresses were last checked. When nothing needs you, it says so and names the next renewal, so you know it is still watching.
• Needs you has one card per address with a problem — the same problems Home shows, in the same order. Snooze until tomorrow or This is intentional on a card sets it aside here and on Home at once; a line under the cards counts what is set aside, and Bring back undoes it. Each card says what is wrong, the date it matters (Due 17 Nov 2026 · in 31 days) and what happened. A certificate about to expire on a site among the most-visited on the web (in the public Tranco list) is one step more urgent — its alert reaches destinations set to critical only — and its card says why, with the list's credit under it. Under it, short notes say what else InfraNest knows about that address — DNS · no record for support in example.com, Hetzner · not connected to InfraNest, Domains · example.com expires 2 Dec, before this certificate. What to do says how to fix it — Reload the web server on mail-01 (for example systemctl reload nginx), then check again. The button does the next step: Check now reads the address again and Fix CAA record shows the record before adding it. Click the address itself for everything we know about it. Where an automation would catch the same problem next time, the bottom of the card says so — Next time: … — and Set it up opens it as a draft for you to check and switch on. For example, a renewal that did not reach every server offers Alert me if a renewal is not live within 24 hours, and an address whose DNS record is gone offers Stop tracking an address when its DNS record is deleted.
• An address that no longer exists. When an address has stopped answering and its DNS record is gone, or its domain is retired or no longer yours, the card says so — No longer exists — and offers Stop tracking. The warning goes away and the address leaves the page; nothing else changes. Changed your mind? Undo in the message, or later: on the Addresses tab, the Stopped tracking chip lists them, each with Track again.
• A renewal that is not live yet. When the old certificate is still served from one of your servers, the card names the server and how to reload it. When it runs at a provider you have not connected, such as Hetzner, it offers to connect it. With our agent on that server, the card can also say why. For example: certbot on web-01 renewed status.example.com, but nothing reloads nginx afterwards. It then tells you to reload nginx now, and to add a small deploy hook so the next renewal goes live by itself. The same card shows at the top of that server's page.
• Next 90 days shows when things happen, with dates along the bottom. A line runs through the chart on the date something needs you — amber, or red when it is urgent, anything overdue at the far left. Hover its dot to see what it is; click it to go to its card. Green bars count the certificates that renew themselves each week, with the number on the bar; click one to see those addresses. Add to calendar puts every expiry in your calendar.
• Recommendations come after that and are never shown as problems — one line per kind, such as 8 paid certificates have no owner. The ones that protect the most come first — a domain about to lapse before a missing owner — and Show N more has the rest. Review them lists each one with what to do. Assign owners names the teammate who renews each paid certificate — one person for all of them, or one each — and offers to remind that person a month before it expires. You can change the owner later on the certificate's page. Some can be applied right there: Monitor all 25 lists the addresses only the daily scan checks, ticks as many as your plan has room for (and says so when that is not all of them), and adds one monitor for each. Add all 3 lists the domains your certificates use that are not in Domains yet, with where each is registered, and adds them, so you are warned before a registration runs out, not only a certificate. There is nothing to type: the registrar and expiry date come from the public registry. Not mine takes a name that belongs to someone else, such as a supplier, off this list and off Domains' suggestions for good. What you applied is listed at the bottom of Addresses by domain.
• For a site behind Cloudflare, visitors see Cloudflare's certificate, which renews itself. Behind it sits the certificate on your own server, and with Cloudflare's Full (strict) setting your site goes down the day that one expires. When we cannot see it, the recommendation names the step that would let us: connect Cloudflare, install the agent on the server, or connect the cloud account the server runs on. With the agent installed, we read that certificate's expiry and warn you before it runs out.
• Not needed asks why — We handle this elsewhere, Not relevant to us or Later — and hides the whole kind (or, in the list, just one). Nothing you hide comes back on its own: N dismissed under the recommendations lists each one with why, who and when, and Bring it back returns it.
• Addresses by domain has one row per domain: how many addresses, the next expiry (the date itself when something needs you there) and whether anything needs you. Click a domain to see its addresses. Open domain goes to the domain; Add to Domains adds one that is not in your Domains yet. The line under it says what was tidied up for you: replaced certificates kept as history, certificates no longer served, and certificates several sources found, shown once.

#Addresses

One row per address (a host and port, like shop.example.com or mail.example.com:993), grouped by domain, with the certificate visitors actually get and, when something is wrong, why in a few words (Renewal 6 days late, Not reachable for 14 days): who serves it (your server by name, a provider's edge such as Cloudflare, Akamai, Fastly or CloudFront, or the hosting network when it is not one of your servers; hover for the IP), who renews it, when it expires and what checks it. Every domain starts folded; click it to open it. Search by host, or filter with the chips — Needs you, Renewed by a person, Monitored, Behind Cloudflare (one per provider edge you use) and Sites you watch — each with its count.

• Behind Cloudflare or another proxy, the provider's edge certificate is its job, not yours: open the domain and one line says so — Cloudflare manages the edge certificate for example.com and renews it automatically.
• Select an address to open its panel: what is wrong and what to do, how it is connected (domain → DNS → server → certificate → monitor), what your monitor sees from each location, how it renews, and the certificates it served before. Behind a proxy, the panel shows What visitors see — the provider's edge certificate — and, under Behind Cloudflare, your own server with the origin certificate it serves to the proxy.
• When a problem started shortly after something changed on the way to that address — its DNS record, the Cloudflare proxy, a firewall or the server it points at — the panel names it under Possibly related, with who made it and a link. It is a lead to check, not a verdict.
• Sites you watch are addresses that are not yours — a monitor on your bank, a supplier or a news site. An address is yours when its domain is in your account, its DNS zone is connected, or it points at one of your servers. Sites you watch are not counted with your addresses and get no renewal or owner suggestions; we only tell you if their certificate expires or breaks. Got it wrong? In the address's panel, This is ours or Not ours — only watched changes it.

#All certificates

Every certificate we found, with What it is — In use, Provider edge, Replaced, No longer served and so on — plus search, filters, tags and bulk actions. Open a certificate for its full details, chain and security checks.

#Related

• Add a certificate · Where certificates come from · Certificate coverage · Certificate health