Frequently asked questions

It watches the SSL certificates and domain registrations of the domains you add, checks each one once a day, and emails you before either expires. On paid plans, Pro and Business add more readings to the daily check, such as security headers, TLS version, whether the site responds, DNS record changes and new certificates in Certificate Transparency logs, plus alerts to Slack, Teams, Discord or a webhook. There are also 69 free tools that work without an account.

No. CertNotify connects to your site the way a browser does and reads public records (certificates, DNS, registration data). Nothing is installed and no credentials are needed. The only exception is code scanning, where you choose to paste a file or connect a repository.

As soon as you add it from the dashboard: the certificate and registration are read in the background. After that it joins the daily check. A domain added through the API is first checked on the next daily run.

Once a day, around 00:00 UTC, from one location. CertNotify is built for expiry dates, which change over days, not minutes. You can also re-check any time from the dashboard. Outages that start and end between two daily checks are not seen.

Yes. Each hostname you add (example.com, www.example.com, api.example.com) is one domain against your plan's allowance: 3 on Free, 25 on Pro, 500 on Business.

A certificate shows as a warning at 30 days or fewer and as critical at 7 days or fewer. A domain registration shows as a warning at 45 days and as critical at 14 days. The same thresholds are used in the dashboard, the API and emails.

Use "Recheck all" on the Overview, or the re-check on a domain's own page. The result replaces the last reading straight away; the daily check carries on as usual.

A number from 0 to 100 on each domain, the same on every plan. It reflects certificate and registration expiry, the TLS version in use and whether DNS resolves. Downtime and missing security headers appear as findings rather than in the score.

Remove a domain you no longer need from its page, or move to a larger plan: 3 domains on Free, 25 on Pro, 500 on Business, and more on Enterprise by arrangement.

Compare plans →

Open the domain from the dashboard and choose "Remove domain" at the top of its page, then confirm. Its check history and findings are deleted, and it frees one domain on your plan. On Pro you can also remove domains through the API.

How many days before expiry the email warnings start for a domain. Each domain has one lead time: 30 days on Free, and on Pro you choose 7, 14, 30 or 60 days. Once inside it, you get one email a day for that domain until it is renewed or expires.

It finds hostnames under your domain from Certificate Transparency logs and a check of common names (www, api, mail and so on), when you click "Discover Now" on Pro. It runs on demand, not on a schedule, and finds up to 50 subdomains a run on Pro and 500 on Business.

On Pro, an image you can embed on your site that shows one domain's current certificate status, linked to a public verification page. You can turn it off or rotate its link at any time.

When a domain is added, when you re-check it, and when you click "Scan Now" on its page (paid plans). It is not part of the daily check.

Fix the underlying problem: the next check that no longer sees it resolves the finding automatically. There is no manual "resolve" button, so the list always reflects what the checks actually see.

By a priority score: severity weighted by how exposed the asset is. An internet-facing critical problem comes before a low-severity note in code.

From the checks your plan runs: certificates and registrations on every plan; on Pro, also TLS version, security headers, uptime, DNS changes, Certificate Transparency and the on-demand scans; and code scanning on every plan, in the files or repositories you scan.

Six: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Each is graded good, warn or bad as part of the daily check on Pro.

A newly issued certificate for your domain from an issuer outside a list of commonly used CAs (such as Let's Encrypt, DigiCert, Sectigo, Google, Amazon and Cloudflare). On Pro it reads the public CT logs once a day. A certificate wrongly issued by one of the listed CAs would not be flagged, so it complements, rather than replaces, your own controls.

It comes from crt.sh, a free public CT search service that is sometimes slow or unavailable. When it is, CertNotify retries, and the next run that reaches it catches up on every certificate issued in between, so nothing is lost, only delayed.

No. It shows how your domains do against common technical controls, as evidence for your own review. It does not certify compliance with any standard.

On paid plans, changes to A, AAAA, MX and NS records raise a finding. TXT and CNAME records are recorded so you can see them change, but they do not raise alerts.

On the DNS screen, click "Accept new baseline". It records the current records as the new normal for your domains.

The propagation check asks five public resolvers, once, whether they agree on a record, which is useful right after a change. Drift detection compares your records with a saved baseline once a day on paid plans and tells you when they change.

No. Pasted code is scanned and discarded; only the findings and summary counts are kept. Repository scans read the files they need for the scan and keep the findings, not the code.

You can install the GitHub App and see your repositories, and paste up to 2 files for scanning. Turning on repository scanning needs a paid plan, and is checked again at every scan, so it stops if the plan lapses.

Leaked secrets such as API keys and tokens, dependencies with known vulnerabilities (from the OSV database), and common misconfigurations in Terraform, Kubernetes YAML and Dockerfiles.

Yes, through the GitHub App on a paid plan: each pull request gets a check run with what the scan found. Draft pull requests are skipped.

Yes. All 69 tools work without an account or payment. They have an hourly per-visitor limit so they stay available for everyone.

A tool checks something once, when you ask. Monitoring keeps checking your domains every day and tells you when something needs attention, which is what an account is for.

Both are free tools: the Subdomain takeover check and the Lookalike domain check. Each runs on demand when you use it; neither runs on a schedule.

Subdomain takeover check →Lookalike domain check →

7 days on Free, 90 days on Pro and two years on Business. Records beyond that are kept rather than deleted, so they reappear if you upgrade.

Yes, as a CSV file from the History screen, on every plan.

Once a day, after the daily check, at around 00:30 UTC. An expiry email starts when a domain enters its lead time and repeats daily until it is renewed or expires.

Email on every plan, to your account address. On Pro and Business, also Slack, Discord, Microsoft Teams and any HTTPS webhook.

Use "Send test" next to it on the Alerts screen. The message arrives in the channel, or the channel shows the error it got.

On Pro, raise the minimum severity, lengthen the reminder interval, lower the digest threshold so a busy run arrives as one message, add a rule that never sends a category or an asset pattern, or snooze an asset during maintenance.

They stay saved but stop delivering; email carries on. They resume, unchanged, if you upgrade again.

Free covers 3 domains with certificate and registration checks and email alerts. Pro covers 25 domains and adds the TLS version check, security headers, uptime, DNS drift detection, Certificate Transparency, subdomain discovery, chat and webhook alerts, team members and the API. Business covers 500 domains and adds compliance readiness, PDF and white-label reports, and longer history.

Full comparison →

Pro is $15 a month or $144 a year; Business is $79 a month or $758 a year. In India, Pro is ₹499 a month or ₹4,790 a year, and Business ₹2,499 or ₹23,990. Yearly billing is 20% less than twelve months.

Yes: 14 days of Pro, once per account, with no payment details needed. Start it from the Pro card on the pricing page. You get reminder emails before it ends, and afterwards the account returns to Free unless you subscribe.

Start a trial →

Yes, by arrangement: more domains, seats and history, with terms agreed in writing. Contact us to talk about it.

Contact →

No tool can. Compliance readiness shows which of your technical findings bear on which control families, which helps you prepare evidence. Certification comes from an audit.

The Owner can do everything, including billing and transferring the workspace. An Admin can do everything except billing. A Member can add and watch assets and configure alerts, but not delete assets, connect code hosts, issue API keys or manage members. A Viewer can only look.

Pro includes 3 seats and Business 10, counting the owner and invitations not yet accepted. Enterprise can have more by arrangement.

They lose access to it straight away, and any API keys they created in it are revoked. Their own account and personal workspace are unaffected.

Yes. The owner can make another member the owner. The workspace then follows the new owner's plan, so check the warnings shown before confirming; your own subscription, if any, keeps renewing until you cancel it.

List your domains with their certificate and registration status, read one domain, add a domain and remove one (with a write key). The full reference, with examples and error codes, is on the API page.

API reference →

No, keys are shown only once and stored only as a hash. Revoke the old key and create a new one.

Yes, to 120 requests a minute per key. A request over the limit gets a "rate_limited" error and can be retried shortly after.

By UPI AutoPay or card, through our payment provider Cashfree. You are charged in Indian rupees or US dollars; the other currencies on the pricing page are shown as a guide.

Settings → Plan & usage → "Cancel renewal". You are not charged again and keep the plan until the end of the period you paid for, then the account moves to Free. You can also stop the mandate from your bank or UPI app.

Payments are not refundable, except charges made in error (a duplicate charge, a charge after you cancelled, or a technical fault), which are refunded in full. Email support@certnotify.com within 30 days of the charge.

Refund policy →

The new plan starts straight away and the unused part of your current period is credited against it. Moving from monthly to yearly works the same way.

Nothing is deleted. Your domains stay and keep being checked for certificate and registration expiry, but you cannot add more while above the Free allowance of 3. The paid checks stop, chat and webhook channels pause, repository scanning stops, and history shows the last 7 days until you upgrade again.

Under Settings → Billing history, where you can view and download each one.

The payment is retried during a short grace period, and the plan stays active meanwhile. If it still fails, the account moves to Free; you can subscribe again at any time.

Explain your monitoring results in plain language, rank what needs attention using fixed rules (expired or untrusted certificates first, then the nearest expiries), walk through why a domain is failing, explain SSL, TLS and DNS terms, point you to the right page, draft a note for a registrar or a colleague, and offer to add, re-check or remove a domain for you to confirm.

Only the records of the workspace you are in, read at the moment you ask, and only what the question needs. Your questions and its replies are kept with your account so you can return to them, and you can delete them from the panel. Questions it could not answer are reviewed by CertNotify with domain names, addresses and emails masked.

25 replies a month on Free, 300 on Pro and 1000 on Business, per person; Enterprise has no limit. The count resets on the 1st of each month (UTC), and the panel shows how many are left.

Only by offering a card that you confirm. It can propose adding, re-checking or removing a domain; the change happens when you press the card's button, runs through the same checks and plan limits as the dashboard, and is recorded. It cannot change billing, your plan, alerts or team members.

A summary of one workspace: domains that need attention, ranked by the same fixed rules as the assistant, certificates and registrations expiring soon, findings new since the last briefing, and alert channels that are failing. It is built from your records without AI, so it uses none of your monthly replies. Read it any time from the panel menu, or choose an email in Settings → CERTIBOT assistant: weekly on Mondays on every plan, or every day on Pro and above, sent around 07:00 UTC. The everyday email is skipped on days with nothing to report, and every briefing email has a one-click link to stop it.

Untick "Show CERTIBOT in the dashboard" under Settings → CERTIBOT assistant, or choose "Turn CERTIBOT off" in its menu. "Hide for this visit" removes it until you next open the dashboard.

Untick "Send me upgrade and product emails" under Settings → Email preferences, or use the unsubscribe link in any of those emails. Expiry alerts, trial and plan notices and receipts keep coming either way.

Not from the dashboard yet. Contact us from the address on the account and we will move it for you.

Contact →

Choose "Request account deletion" at the bottom of Settings (or write to us through the contact page, choosing "Privacy / Data Request"). We delete every asset, finding and check record and your personal data within 30 days. Export anything you want to keep first.

On Business, Settings → Reports downloads a PDF with an overall score, every domain's certificate status and the top open findings with fixes. You can replace the CertNotify name with your own brand on it.

The readings from each check (certificate dates and issuer, registration dates, DNS records and, on paid plans, headers, TLS version and response status), the findings they raise, and the alerts sent. Pasted code is not kept.

Privacy policy →

We do not sell it. Account data is shared only with the providers that run the service (hosting, sign-in, email and payments). The privacy policy lists them, together with the analytics and advertising used on public pages.

Privacy policy →

You can watch any public website, as a browser would: for example a supplier's or a client's. The checks only read what the site makes public.

Use the contact form and choose a subject, or email support@certnotify.com. We reply on business days. On Pro and Business, requests sent while signed in are answered first.

Contact →

The domain, what the dashboard shows and what you expected, through the contact form with the subject "Report a Bug". A screenshot helps.

The Learning Center has guides on SSL basics, TLS, DNS and DNSSEC, fixing common errors, automation and security headers.

Learning Center →