Team
€199 / month
90-day trial — no credit card
- Managed certificates
- 50
- Domains
- 10
- Deploy targets
- 5
- Discovery scans
- Daily
- Managed certificate estate
- Deployment workflows and scoped API keys
- Team access and core features
Automate Certificates
TLS renewal
without the hunt.
Tracks certificates, runs ACME renewal, and deploys to cloud and database targets.
ISO 27001 · DORA · GDPR
ACME v2 · TLS 1.3 Capabilities
Inventory, renewal, deployment, and audit records
Capabilities
Discovery, ACME renewal, and deployment to 22 targets
-
ACME issuance and renewal
Request Let's Encrypt certificates via ACME v2 with DNS-01 or HTTP-01 challenges; the cron job renews 30 days before not_after.
-
Tenant-wide discovery
Scan Azure subscriptions, Key Vaults, App Services, and App Gateways to surface certificates that never made it into your inventory.
-
Multi-target deployment
Push renewed certs to 22 target types — Azure Key Vault, App Service, App Gateway, AWS ACM, ALB, GCP load balancers, PostgreSQL, and more.
-
Expiry alerting
Slack, Microsoft Teams, Graph email, and SMTP notifications when a cert enters the renewal window or a renewal attempt fails.
-
Audit records per renewal
Append-only log with CSV export and webhook delivery for every issuance, deployment, and Marketplace lifecycle action.
-
Entra SSO and scoped API keys
Azure service principal authentication for tenant scans; OIDC sign-in with TOTP MFA and API keys scoped to specific operations.
In the product
Inside Automate Certificates.
Real product screens — dashboard, certificate inventory, deployments, discovery, monitoring, alerts, and sign-in.
How it works.
-
Discover your inventory
Run an Azure tenant scan or import existing certs — every domain, issuer, and expiry date lands in one inventory with risk badges on the ones due soon.
-
Issue and schedule renewal
Request certificates through ACME v2; Automate Certificates renews 30 days before expiry and records each attempt in the audit log.
-
Deploy and alert
Push the renewed cert to linked targets on schedule or immediately; Slack, Teams, or SMTP alerts fire if deployment or renewal fails.
Pricing.
Team at €199, Business at €499, and MSP from €1,499 per month. Every plan starts with a 90-day trial — no credit card.
Business
€499 / month
90-day trial — no credit card
- Managed certificates
- 250
- Domains
- 50
- Deploy targets
- All 22
- Discovery scans
- Hourly
- Larger estate and broader deployment coverage
- More API and member capacity
- Priority support and quarterly review
MSP
from €1,499 / month
90-day trial — no credit card
- Managed certificates
- 1,000+
- Domains
- 250+
- Deploy targets
- All 22
- Discovery scans
- Hourly
- Customer-tenant certificate and deployment workflows
- Per-customer reporting
- White-label notification templates
Questions.
-
Where is certificate data stored?
Each customer environment runs on Cloudflare Workers and D1 in the EU. Private keys are encrypted at rest with AES-256-GCM. Certificate metadata and audit events stay in your tenant database — we do not copy your inventory to a shared multi-tenant store.
-
How does sign-in work?
Operators sign in through Spot Suite OIDC with passkeys, authenticator-app MFA, or Entra ID federation. Azure tenant scans authenticate via a service principal with RS256 JWKS validation; programmatic access uses scoped API keys with fine-grained permissions.
-
What compliance records does it produce?
DORA and NIST-aligned audit reports, per-renewal exports with CSV download and webhook delivery. The append-only log records every issuance, deployment, and Marketplace lifecycle action with reviewer identity and timestamp.
-
What does the 90-day trial include?
Every plan starts with a 90-day trial — no credit card. Full ACME issuance, auto-renewal, and deployment. After the trial, choose Team at €199 per month, Business at €499 per month, or MSP from €1,499 per month.
Stop hunting expired certificates
Connect your first target, run a discovery scan, and let ACME handle renewal. Every plan starts with a 90-day trial — no credit card.