Inventory & monitoring
Know what expires next — and what already needs attention.
Central inventory of certificates you issued or imported: expiry, days remaining, renewal status, deployment state and Action Required. This is not a sensor fabric for the whole enterprise network.
What you can see
- Common name and SAN identifier rows
notAfter,auto_renew,next_renewal_at, status- Issuer, serial, SHA-256 fingerprint
- Failed orders and webhook delivery health
- Imported unmanaged hostnames (no private key collected)
List filters on the API: status, domain, expires_before, expires_after, auto_renew.
| Hostname | Status | Not after | Renewal | Attention |
|---|---|---|---|---|
| shop.demo-merchant.test | Active | 2026-10-20 | Scheduled · 30 days before | Expiring · 30 days |
| api.demo-merchant.test | Renewal failed | 2026-09-28 | Attempt 2 · dns_record_not_found | Action Required |
| pay.demo-merchant.test | Active | 2027-02-02 | next_renewal_at 2027-01-03 | Verified handshake |
| legacy.demo-internal.test | Imported | 2026-10-12 | Unmanaged | No connector |
Action Required
Renewal failures, disconnected deploy targets and imported names without a connector are work. They stay in the organization until a person fixes DNS, connects a target, or accepts a manual install. That is the difference between a dashboard and a control.
Lifecycle timeline
Orders, challenges, issuance, renewals, revocation and webhook deliveries are the timeline. Audit events answer who downloaded a platform-generated key. API logs are kept 30 days.
Unmanaged and CT — only what exists
You can import a hostname for expiry monitoring. You can record a Certificate Transparency observation for a name you typed. Wording is unexpected_certificate_observed — not compromise. There is no agent and no CIDR scan. Live CT tailing is not a customer-ready product.
Related Solutions and Integrations
Solutions this product surface is built for:
Customer-facing integrations to open next:
Questions people actually ask
What can I filter on?
GET /api/v1/certificates supports status, domain, expires_before, expires_after and auto_renew. The dashboard list is the same organization set.
Do you scan my network?
No. We inventory certificates you issued, hostnames you imported, observations you recorded, and bindings a connected panel listed.
What is Action Required?
Work that needs a person: renewal_failed, disconnected deploy targets, imported names without a connector, webhook delivery failures. It is a queue, not a decoration.
Can I see unmanaged certificates?
Yes — import a hostname for expiry monitoring without taking the private key. That does not enable auto-renew until you take issuance.
Do you do CT monitoring?
You can record a Certificate Transparency observation for a hostname you named. That is not a live subscription to public CT logs and not a compromise detector.
How long are API logs kept?
Authenticated API request logs for the organization are deleted after 30 days.
Is inventory multi-tenant?
Yes. Every certificate belongs to an organization. API queries always include that constraint. MSP and agency use-cases use one organization per customer or client.
Where should MSPs start?
The MSP solution page, then this inventory, Automated Renewals, Deployment, and Teams, Workspaces & Audit on Features.
Put every named certificate in one organization.
Issue what you terminate. Import what you only watch. Let Action Required list the rest.