Domains & DNS
Never let a certificate take your site down
InfraNest finds every certificate you use and tells you which ones need you. A renewal that stopped shows up weeks before it hurts, with the next step. No spreadsheet, no calendar reminders.
Free plan · No credit card · First certificates found in under a minute
- Hear about a failed renewal weeks early
- Know a new certificate reached every server
- See the next 90 days without a spreadsheet
- Find the certificates you forgot about
Works with your certificate sources
Hear that a renewal stopped, weeks before your site breaks
Most certificates renew themselves, until something quietly stops them: a moved server, an old password, a full disk. Nothing looks wrong until browsers start warning your visitors. InfraNest works out when each certificate should have renewed. If the old one is still in use a few days later, you hear about it. You get both dates and what to check. That leaves you weeks, not minutes. Add your site and see when it renews next.
- Quiet while renewals go well
- Covers Let’s Encrypt, ZeroSSL and Google certificates
- Turns urgent in the last week
Renewal 9 days late
Its client should have renewed it around 25 Oct 2026, and it is still the certificate being served. It expires on 25 Nov 2026.
Check the ACME client (certbot, Caddy, Traefik) on the server that serves it.
Know when a new certificate never reached one of your servers
A renewed certificate often has to reach several places: two web servers, a load balancer, a mail server. One gets forgotten, and it fails weeks later, long after everyone thought the job was done. InfraNest checks every address that used the old certificate and names the one that did not move. You see which server it is and the step to take. Press Check now when you are done, and you know it worked.
- Names the address and the server
- Gives the step, such as a web server reload
- An automation can alert you next time
Still serves the replaced certificate
northwyndr-mail.com was renewed and 1 of 2 addresses serve the new certificate. mx1.northwyndr-mail.com:993 still serves the old one from mail-01, which expires on 22 Nov 2026.
- Daily check · still serves the old certificate
- DNS · A record → 198.51.100.166
- TransIP · your server mail-01
Reload the web server on mail-01 (for example systemctl reload nginx), then check again.
- mx1.northwyndr-mail.com:993Old certificate · expires 22 Nov 2026
- webmail.northwyndr-mail.com:443New certificate
Track SSL certificate expiry without a spreadsheet
A spreadsheet is out of date the week after you write it. InfraNest gives you one timeline instead. Green bars are certificates that renew themselves, and a line marks each date a person has to act. Under it, each domain says whether it is fine and when it next expires. Every address is checked at least once a day, and more often around a renewal. You can throw the spreadsheet away today.
- Reminders from 30 days out for hand renewals
- Paid certificates start earlier, from about 60 days
- Expiry dates in your calendar, on Pro and up
Tidied up for you. 2 replaced certificates kept as history · 1 seen by several sources, shown once
Find the certificates you forgot about
The certificate that takes a site down is usually the one nobody wrote down. So you do not have to list anything. InfraNest reads your monitors, your connected providers and the public logs where certificates are recorded. You can also scan any address, or paste a certificate in. It all lands in one list. A certificate found four ways is still one row, and each row says whether it is in use.
- Warns about a certificate nobody here asked for
- Lists your domains with no certificate at all
- Twenty-five certificates free, one hundred on Pro
The raw inventory, with what each certificate actually is. Only the ones in use or served by a provider edge appear on the overview.
12 more · Tidied up for you. 2 replaced certificates kept as history · 1 seen by several sources, shown once
Get told what could break next, without asking
Some problems have not happened yet. An address gets only a daily check. A paid certificate has nobody responsible for it. Another costs money and gives no more trust than a free one. InfraNest finds these on its own and says why each one matters. You press the button or mark it Not needed, and nothing changes until you do. Anything you dismiss stays dismissed until you bring it back.
- Adds monitors after showing you the list
- Shows a DNS change before making it
- Flags paid certificates a free one could replace
Nothing here is broken. These make it harder for something to break unnoticed.
Everything else it handles
The parts that are only interesting when you need them.
One row per certificate
The same certificate seen by a monitor, a scan and a provider shows up once, and you can still see who found it and when. If the matching gets it wrong, merge or split by hand.
A domain that expires first
A certificate is no use if its domain lapses. InfraNest warns you when a domain runs out before its certificate and auto-renew is off.
An owner for each paid certificate
Name the person who renews it, and the reminder goes to them, not to everyone. It can arrive a month before the certificate expires.
Who really renews it
With the agent on a server, “guessed from the issuer” becomes a fact: certbot on web-01, and when it last ran. A failed run shows up long before any expiry date.
Certificates behind Cloudflare
Visitors see Cloudflare’s certificate, and yours sits behind it. If InfraNest cannot see yours, it names the step that would let it, so that one does not catch you out.
What each certificate costs
Set a yearly price per certificate. Issuers that sell nothing are marked free, and a blank stays blank rather than a wrong €0. The Spend report is on Business and up.
Sites you do not own
A monitor on a supplier’s site counts as watched. You only hear if its certificate expires or breaks, with no renewal or owner advice.
Ready for shorter certificates
Warnings follow each certificate’s own lifetime, so the 47-day certificates on the way need no change from you.
Automatable, and audited
Automations can scan an address and link a certificate, and they start from certificate events. Every change is in the audit log.
See your own certificates in about a minute
Scan an address or connect a provider. Nothing changes until you say so.
Tracking certificates by hand vs InfraNest
The difference between a spreadsheet nobody trusts and a list that keeps itself up to date.
By hand
- A spreadsheet that is out of date within a week
- Calendar reminders for the certificates somebody remembered
- A renewal that failed, found when browsers warn visitors
- One forgotten server, weeks after the renewal
- No idea who got a certificate for your domain
With InfraNest
- One list that fills itself
- One timeline, with each date a person has to act
- A warning weeks before a failed renewal hurts
- Every address checked, and the forgotten one named
- A warning about a certificate nobody here asked for
Comparing tools? See Oh Dear vs InfraNestStatusCake vs InfraNestTrackSSL vs InfraNest
One login, ten modules
Nine modules are on every plan, Free included, and firewalls start on Pro. What changes is how much of each you get, plus a few advanced features from Pro.
Build on it
The cost of doing it separately
Buy each piece from a different tool and it adds up fast:
- Uptime monitoring
- ~€26
- SSL tracking
- ~€15
- Status page
- ~€26
- Across 3 separate tools
- ~€67/mo
Also in Pro, not counted above: 100 domains with DNS, 10 servers across your cloud providers, 25 automations, Dynamic IP and Drop Catch.
Each line is that tool’s cheapest paid plan. Pro covers all of it: 50 monitors, 100 certificates and 3 status pages on your own domain.
Prices checked October 2026 · dollar prices at the ECB rate
Built for how you work
Try it with a free tool
Frequently asked
How do I check when my SSL certificate expires?
Add your site or scan any address. InfraNest reads the certificate and shows when it expires and who renews it. Every address is then checked at least once a day, and all of them sit on one 90-day timeline.
How do I know if my SSL certificate failed to renew?
Renewal tools start about a third of the way before a certificate expires. If a Let’s Encrypt, ZeroSSL or Google certificate is still the old one a few days after that, InfraNest tells you, with the day it should have renewed and the day it expires. That is usually weeks ahead. The warning clears once the new certificate is in place.
Why does my site still show the old certificate after renewal?
Usually the new certificate is on the server but the web server was not reloaded, or one server was missed. InfraNest checks every address that used the old certificate, names the one still serving it, and gives the step to take. With the agent on that server, it can also say why, for example that nothing reloads nginx after certbot runs.
How does InfraNest find my certificates?
It reads your SSL monitors, your connected providers and public certificate logs. You can also scan any address or paste a certificate. Providers are AWS ACM, Cloudflare, DigitalOcean, Hetzner, IONOS, Namecheap, Openprovider, Porkbun, SSL.com and TransIP. Everything lands in one list, matched to the domain it belongs to.
Will I get an email every time Let’s Encrypt renews?
No. A healthy renewal sends nothing. You only hear when one stops working. Reminders at 30, 14, 7, 3 and 1 days are for certificates a person has to renew. A certificate close to expiry still works, so it does not open an incident or turn your status page red.
Does InfraNest issue or renew certificates?
No. Issuing and renewing stay with your certificate authority, your host or your renewal tool. InfraNest watches the result: did the renewal happen, and did the new certificate reach every address?
Do you store my private keys?
No. The list holds details about each certificate, never a key. Some providers can hand you the files to install. Those are fetched from the provider when you ask, shown once and not kept. Every fetch is in your audit log.
Which certificate authorities does it support?
All of them. A scan and a public log do not care who issued a certificate, so any authority works, including your own internal one.
How many certificates can I track for free?
The Free plan tracks 25 certificates, Pro 100, and Business has no limit. Every plan gets the findings, the timeline and the recommendations. Adding every expiry to your calendar is on Pro and up.
Can I import certificates from my own tooling?
Yes, on Pro and up. Send up to 500 at a time to POST certificates/import, and it is safe to send your whole set on every run. The server agent does not import certificates: it sends metrics and says what renews each one, and it warns you about a certificate on the server that nothing else watches, 14 days before it expires.
Find out which certificates need you
Scan an address or connect a provider. Within minutes you see your certificates, who renews each one and what needs you.
Free plan · No credit card required · Set up in minutes