Track the digital assets your team cannot afford to forget.
Monitor domain health, renewal risk, SaaS tools, hosting, licenses, and client-ready proof reports from one CertPilot dashboard.
Overview
Finch Studio · May 2026
4 items need attention across 3 clients.
SSL expiring
3
Next: 12 days
Renewals due
2
Due in 30 days
DNS changes
1
Verify with client
Healthy
43
All clear
Priority actions
client-site.io
SSL expires in 12 days — renewal overdue.
brandagency.com
MX record changed — verify with client.
Monthly Proof Report · May 2026
ReadyMonitored
47
domains
Findings
4
need action
Healthy
43
all clear
Risk patterns
Three things you cannot afford to miss this quarter.
Every agency that runs client domains has lived through at least one of these. Most have lived through all three.
Domain risk
A domain expires on your watch.
The site goes dark on a Saturday morning. The client finds out before you do.
CertPilot flags domain expiry at 60, 30, and 14 days — before it becomes an incident.
Renewal risk
A hosting plan lapses without anyone noticing.
A retired card, an unread invoice, an inbox no one watches — then staging or production is gone.
The Renewal Ledger tracks every asset with a due date, an owner, and a billing contact.
Retainer risk
A client asks what you actually did this month.
The work is real: alerts caught, renewals coordinated, DNS changes verified. Without a paper trail, the retainer feels expensive.
The Monthly Proof Report turns invisible maintenance into documented deliverables.
What CertPilot does
One operational layer for every recurring asset you carry.
Built for agencies, MSPs, and ops teams that own a portfolio of client domains, renewals, and recurring tools — not a single internal stack.
Domain Health Monitoring
- SSL / TLS certificate expiry and validity
- Domain registration expiry via public RDAP
- DNS records: A, AAAA, MX, NS, TXT, CAA
- DNS change detection between checks
Renewal Ledger
- SaaS tools, hosting, plugins, licenses, contracts
- Owners, renewal dates, billing contacts
- Per-client grouping and visibility flags
- Overdue, upcoming, and incomplete records
Smart Alerts
- Overdue and upcoming renewal warnings
- DNS change detection alerts
- Missing renewal date notifications
- Daily digest email — one summary per check run
Monthly Proof Reports
- Executive summary in plain language
- Domain Health and Renewal Risk sections
- Recommended actions list
- Client-ready PDF with agency branding
Monthly Proof Reports
Send proof, not screenshots.
Every month, turn domain checks, renewal risks, DNS changes, and recommended actions into a client-ready PDF. Branded with your agency and written in plain language.
- Executive summary — Plain-English overview of domain and renewal health — what is fine and what needs attention.
- Domain Health — SSL expiry, domain registration status, DNS record changes, and per-client domain status.
- Renewal Risk — Overdue, upcoming, and incomplete renewal records across hosting, SaaS, licenses, and contracts.
- Recommended actions — A numbered list of what needs review — something you can walk clients through or act on directly.
CertPilot
Monthly Proof Report
Sample Agency
Executive Summary
2 items require attention. 7 domains are healthy. Renew SSL on example.net before 14 May.
Monitored
9
domains
Findings
2
need action
Healthy
7
all clear
Domain Health
Client Alpha — 3 domains
Recommended actions
Renew SSL certificate for example.net (16 days remaining)
ActionConfirm MX record change on example.org was authorised
ReviewGenerated by CertPilot · Sample Agency · May 2026
The SSL shortening timeline
Certificate lifetimes are shrinking. Renewal work is multiplying.
CA/Browser Forum has approved a phased reduction in maximum SSL certificate lifetimes. The changes are confirmed and on a fixed schedule.
Until March 14, 2026
398 days
Current maximum SSL certificate lifetime
March 15, 2026
200 days
Renewals double — 2× the tracking work per domain
March 15, 2027
100 days
Renewals double again — 4× the original volume
March 15, 2029
47 days
Final phase — 8× renewal events. Manual tracking breaks.
Source: CA/Browser Forum Ballot SC-081. Dates are confirmed minimums; browsers may enforce stricter limits earlier.
Renewal work calculator
How much renewal work does your agency face?
Drag the slider to see how shorter certificate lifetimes multiply manual tracking effort for your client portfolio.
| Period | Renewals / year | Manual hours / year |
|---|---|---|
| Today (398-day certs) | 50 | 8.3 hrs |
| From March 2026 (200-day) | 100 | 16.7 hrs |
| From March 2027 (100-day) | 200 | 33.3 hrs |
| From March 2029 (47-day) | 400 | 66.7 hrs |
Estimate assumes 10 minutes per renewal event for manual tracking (checking expiry, coordinating with clients, updating records).
Renewal Ledger
For the assets your team cannot afford to forget.
Manually track SaaS tools, hosting plans, plugins, licenses, and contracts — with owners, renewal dates, billing contacts, and risk flags — before something lapses unnoticed.
- SaaS tools and subscriptions
- Hosting and domain-related services
- Plugin, theme, and license renewals
- Contracts and vendor renewals
- Billing contacts and invoice emails
- Per-seat plans, cost notes, and billing visibility
CertPilot
Renewal Ledger
Cloudflare
Pro plan
Overdue
No owner
Adobe CC
License renewal
Due in 14 days
Jane D.
WP Engine
Hosting — Client Alpha
Due in 42 days
Tom R.
Renewal alerts sent daily. Proof reports generated on demand.
Free tools for agency domain operations
Check SSL expiry, renewal readiness, DNS health, and client-domain risk — no login needed.
What CertPilot monitors
Public checks, no credentials required.
CertPilot reads the same public data any browser would see — no website login, registrar access, or DNS provider API keys needed.
SSL certificate expiry
Tracks the exact expiry date and validity of each domain's TLS certificate. Alerts fire at 47-day, 30-day, and 14-day thresholds — matching the new browser enforcement timeline.
Domain registration expiry
Queries public RDAP endpoints for each domain's registration expiry date. Flags renewals 60, 30, and 14 days before they lapse.
DNS record changes
Checks A, AAAA, MX, NS, TXT, and CAA records on every run. Additions, removals, or value changes are compared against the previous snapshot, with a safe guard for older CAA-free snapshots.
DNS drift detection
When DNS records change between checks, CertPilot flags the drift immediately. Useful for catching unauthorised changes, CDN misconfigurations, or accidental deletions.
Client-grouped daily alerts
Alerts are grouped by client so you see issues in context, not as a noisy list of domains. One email digest per check run, not per domain.
Renewal assets and due dates
Track manually entered SaaS tools, hosting plans, licenses, plugins, contracts, payment labels, owners, and renewal dates. CertPilot flags overdue, upcoming, and incomplete records for review.
How CertPilot checks domains
Public data only. No login access needed.
- Reads public SSL/TLS certificate data over HTTPS
- Queries public RDAP endpoints for domain registration data
- Looks up public DNS records (A, AAAA, MX, NS, TXT, CAA)
- Does not require website login, registrar access, or DNS provider API keys
- Does not monitor uptime, page speed, or perform vulnerability scanning
Operational evidence
Evidence for web-facing assets, not just monitoring alerts
CertPilot helps agencies, MSPs, and IT teams keep recurring evidence around SSL certificates, DNS records, domain expiry, renewal risks, email authentication, and public trust signals.
For teams preparing internal cybersecurity governance or NIS2-related documentation, these records can support operational evidence workflows — without replacing legal advice, security audits, certification, or compliance determination.
For Romanian organizations preparing under GEO 155/2024, NIS2 Pilot can help organize broader internal preparation before discussions with consultants, legal advisors, or cybersecurity specialists.
How CertPilot compares
Purpose-built for agencies. Not repurposed infrastructure tools.
| Feature | CertPilot | TrackSSL | Oh Dear | Spreadsheet |
|---|---|---|---|---|
| SSL certificate monitoring | ||||
| Domain expiry tracking | ||||
| DNS / MX / NS change alerts | ||||
| Client workspaces | ||||
| Branded PDF reports | ||||
| Per-agency pricing | ||||
| 47-day renewal readiness | ||||
| Renewal Ledger (SaaS, licenses, contracts) | ||||
| Renewal risk alerts | ||||
| Monthly proof reports |
UptimeRobot monitors whether a site responds — not whether its certificate, DNS, or domain registration is healthy. Oh Dear and TrackSSL cover SSL monitoring but are built for general use, not agency client-management workflows. CertPilot is the only tool in this comparison that combines SSL, DNS drift, and domain expiry monitoring with client grouping and a branded PDF report agencies can send to clients.
Pricing
Flat per-agency pricing. No per-domain surprises.
Start free. Upgrade when your agency is ready.
Founder Pilot — €49/month
For the first agencies onboarded manually.
Start with the free trial. If CertPilot is useful, reply to the founder email to activate the Founder Pilot.
Starter
Best for smaller agencies starting with domain health and basic renewal tracking.
- SSL, DNS, and domain expiry monitoring
- Renewal Ledger — manually entered renewal records
- Domain Health Report
- Renewal Risk Report
- Daily digest email
Agency
Best for agencies managing client care plans and monthly deliverables.
- Everything in Starter
- Client grouping across domains and renewals
- Renewal digest alerts
- Monthly Proof Report
- Agency logo and brand color on all reports
Studio
Best for larger agencies managing multi-client portfolios.
- Everything in Agency
- Higher domain and renewal capacity
- Monthly Proof Report
- Priority support
Start with a 14-day free trial. Founder Pilot activation is handled manually during early access.
FAQ
Common questions.
Why does 47-day SSL matter to my agency?
Starting March 2029, SSL certificates will be valid for only 47 days, down from the current 398 days. That means renewals happen 8× more often per domain. For an agency managing 50 client sites, that's 400 renewal events per year. Without automation, manual tracking becomes a full-time job.
What if we already use Oh Dear?
Oh Dear is strong for developer-oriented site monitoring — uptime, broken links, and response times. CertPilot covers a different layer: client-domain operations for agencies. That means bulk domain import, SSL and domain expiry tracking, DNS change alerts, client grouping, and a branded PDF report you can send to clients monthly. If you need uptime monitoring, Oh Dear does that well. If you need client-domain oversight and a monthly client deliverable, CertPilot is the purpose-built tool for that.
What if we already use TrackSSL?
TrackSSL is useful for SSL certificate tracking. CertPilot covers that and adds domain registration expiry monitoring, DNS record change alerts, client grouping across your agency account, a daily digest email, and a branded PDF report you can include in client retainers. If you manage more than a handful of clients and want a structured monthly report to send them, CertPilot is built for that workflow.
Is CertPilot an uptime monitor?
No. CertPilot does not ping your sites for uptime or response time. It focuses on SSL certificate expiry, domain expiry, and DNS record changes (MX, NS, A). If you need uptime monitoring, tools like Better Uptime or UptimeRobot handle that job.
Is CertPilot an IT asset management platform?
No. CertPilot is focused on agency client-domain operations and renewal tracking. Renewal Ledger helps you track manually entered hosting, SaaS, license, contract, plugin, and domain-related renewal records. It does not discover subscriptions automatically, connect to bank accounts, parse invoices, or replace a full IT asset management system.
Is CertPilot secure enough for client domains?
CertPilot reads public TLS handshake data, public DNS records, and RDAP — the public domain registration protocol. It does not require client login credentials, registrar account access, DNS provider API keys, or website admin access. It does not perform vulnerability scanning, page speed testing, or content inspection. You add a domain name; CertPilot reads the same public data any browser would see.
Can agencies send branded reports to clients?
Yes. Every plan includes PDF report generation. Agency and Studio plans support your agency logo and brand color so you can include the report in client retainer deliverables or monthly check-ins.
Will clients actually care about these reports?
Clients may not care about certificate chain details or DNS TTLs. But they do care that their agency is actively protecting their website and flagging issues before they cause problems. The report turns invisible maintenance — SSL renewals, DNS checks, domain registration status — into visible, documented proof of ongoing work. For retainer clients, that documentation matters.
Is CertPilot for developers or account managers?
Both can use it, but it is designed for agency operations: founders, technical leads, and account managers who need a clear view of client domain health without a developer-heavy observability dashboard. The daily digest and PDF report are the primary outputs — not log streams or raw metrics. If your account manager needs to know which client sites need attention this week, CertPilot gives them that without requiring technical expertise.
Why not just use a spreadsheet?
A spreadsheet works when you manage a handful of domains and certificates last 398 days. Once you have 30–300 client sites, multiple registrars, DNS changes you did not make, and certificate lifetimes dropping to 47 days, a spreadsheet falls behind. CertPilot replaces that manual tracking with daily automated checks, a single alert digest, and a monthly report you can send to clients without extra work.
Why is CertPilot priced per agency, not per domain?
Agency tools should have predictable pricing. You should not pay more simply because a client adds a subdomain. CertPilot is priced by agency size — how many domains and clients you manage — so your cost stays flat as you grow within a plan tier.
I’m Alex, the founder. I built CertPilot because agencies should not lose clients over expired certificates, domain renewals, or unnoticed DNS changes. Every early customer email goes to me personally.
Start free. No credit card required.
Track the digital assets your team cannot afford to forget.
Start with domains and renewals. Monitor SSL, DNS, and domain expiry. Track renewal dates with owners and due dates. Turn the monitoring work into client-ready Monthly Proof Reports — before something lapses unnoticed.
Questions? Email hello@certpilot.app