The product for continuous operation
SaQura CertWatch — on watch before anything fails.
The certificate watchdog for your own server: it checks your domains and services from the outside every day, warns you well before anything expires and proves — with sealed reports — that watch was kept. Runs entirely on your side; your monitoring data never leaves your house.
Warns before things fail
Alert levels 30/14/7/1 days before expiry (configurable), reminders until it's fixed — and the all-clear only once the new certificate is actually being served.
Checks more than the expiry date
Grades A–F with reasons in plain sentences: the certificate chain exactly as your server serves it, revocation status (OCSP/CRL), protocol and key quality — mail servers and arbitrary ports included.
Sealed reports
Every report carries a protocol number and a checksum from a continuous audit chain. Any auditor can recalculate the checksum independently — no CertWatch required.
No one has to log in
Alerts and reports arrive by e-mail (German, English, Japanese), expiry dates as a calendar subscription, and your systems connect via webhooks and a read API.
Tenants and your own brand
End customers with their own recipients and reports under your logo — built for IT service providers and MSPs.
Finds what was forgotten
Inventory discovery via the public certificate logs: suggests certificates of your domains nobody remembers — and reports when new ones appear.
Start without a license: trial mode monitors up to 3 addresses — download the package, set a password, try it.
Buy
Self-Host
Your server, your data
- All checks, unlimited addresses
- Sealed reports + continuous audit chain
- Tenants, your own brand, webhooks, read API
- License file by e-mail, updates during the term
- Windows · macOS · Linux (systemd)
IT service providers & MSPs
Many end customers, one watchdog
- Tenants with their own recipients and reports
- Reports under your brand
- Terms per end customer
Annual subscription, renews automatically — cancellable to the end of each term. Prices excl. VAT.
Renew
CertWatch is an annual subscription: renewal happens automatically and the new license file arrives by e-mail every year — drop it into the settings, done. If a license runs out (for example after cancellation), CertWatch keeps watching for another 14 days and then stops its checks; your data is preserved. To reactivate, simply purchase again.
Download
Current version 1.0.3 — with license-free trial mode (up to 3 addresses). After downloading, compare the SHA-256 checksum:
Windows (10/11, 64-bit)
SaQura-CertWatch-Windows.zip · 50,2 MB
SHA-256 6386e242b99951d1c76b9748f6fec05683904ad03fbfca1096ff416857a0e392
macOS (Apple silicon, macOS 12+)
SaQura-CertWatch-macOS.dmg · 47,8 MB
SHA-256 61a2e78df833722954a63ffda8d8116db8a34be9280b88caef17e2a9fc35aa52
Linux x86-64 (with systemd template)
SaQura-CertWatch-Linux.tar.gz · 43,4 MB
SHA-256 228870dc5d5c8ac6fac2adc96456703b64e99138569af77292d4f1e683c9e4ad
Linux arm64 (Graviton · Ampere · Raspberry Pi)
SaQura-CertWatch-Linux-arm64.tar.gz · 41,3 MB
SHA-256 29cffd43e18b65d13f45254658ff69154da7d874ee157535cb484f90157f1f54
Compute the checksum: macOS/Linux shasum -a 256 <file> · Windows certutil -hashfile <file> SHA256
Windows packages are signed (KyotoTech LLC, via Microsoft's signing service); the macOS package is notarized by Apple. Note on macOS: TLS 1.3 and revocation checks are limited by the system there, and it runs on Apple-silicon Macs only — macOS is fine for trying it out and for the desk; for continuous operation we recommend Linux or Windows.