The product for continuous operation
SaQura CertWatch — on watch before anything fails.
The certificate watchdog for your own server: it checks your domains and services from the outside every day, warns you well before anything expires and proves — with sealed reports — that watch was kept. Runs entirely on your side; your monitoring data never leaves your house.
Warns before things fail
Alert levels 30/14/7/1 days before expiry (configurable), reminders until it's fixed — and the all-clear only once the new certificate is actually being served.
Checks more than the expiry date
Grades A–F with reasons in plain sentences: the certificate chain exactly as your server serves it, revocation status (OCSP/CRL), protocol and key quality — mail servers and arbitrary ports included.
Sealed reports
Every report carries a protocol number and a checksum from a continuous audit chain. Any auditor can recalculate the checksum independently — no CertWatch required.
No one has to log in
Alerts and reports arrive by e-mail (German, English, Japanese), expiry dates as a calendar subscription, and your systems connect via webhooks and a read API.
Tenants and your own brand
End customers with their own recipients and reports under your logo — built for IT service providers and MSPs.
Finds what was forgotten
Inventory discovery via the public certificate logs: suggests certificates of your domains nobody remembers — and reports when new ones appear.
Start without a license: trial mode monitors up to 3 addresses — download the package, set a password, try it.
Buy
Self-Host
Your server, your data
- All checks, unlimited addresses
- Sealed reports + continuous audit chain
- Tenants, your own brand, webhooks, read API
- License file by e-mail, updates during the term
- Windows · macOS · Linux (systemd)
IT service providers & MSPs
Many end customers, one watchdog
- Tenants with their own recipients and reports
- Reports under your brand
- Terms per end customer
Annual subscription, renews automatically — cancellable to the end of each term. Prices excl. VAT.
Renew
CertWatch is an annual subscription: renewal happens automatically and the new license file arrives by e-mail every year — drop it into the settings, done. If a license runs out (for example after cancellation), CertWatch keeps watching for another 14 days and then stops its checks; your data is preserved. To reactivate, simply purchase again.
Download
Current version 1.0.1 — with license-free trial mode (up to 3 addresses). After downloading, compare the SHA-256 checksum:
Windows (10/11, 64-bit)
SaQura-CertWatch-Windows.zip · 50,2 MB
SHA-256 acc2af6062226d03dacdbac0c1c7c6f96b14405b27e1c12895171ab1ebeaf40f
macOS (Apple silicon, macOS 12+)
SaQura-CertWatch-macOS.dmg · 47,4 MB
SHA-256 11f1c034312127e1298f802154a6a407be810e067a895ab20135f4c047669165
Linux x86-64 (with systemd template)
SaQura-CertWatch-Linux.tar.gz · 43,4 MB
SHA-256 42f0c9e72c9a214397f85ee6febb50417896625fdaa810ea5bbaab63fe66dff9
Linux arm64 (Graviton · Ampere · Raspberry Pi)
SaQura-CertWatch-Linux-arm64.tar.gz · 41,3 MB
SHA-256 c2cb013b99635d8612a733d0fa3781dc1cfb4085891a17bbec5da1f6c986b468
Compute the checksum: macOS/Linux shasum -a 256 <file> · Windows certutil -hashfile <file> SHA256
Windows packages are signed (KyotoTech LLC, via Microsoft's signing service); the macOS package is notarized by Apple. Note on macOS: TLS 1.3 and revocation checks are limited by the system there, and it runs on Apple-silicon Macs only — macOS is fine for trying it out and for the desk; for continuous operation we recommend Linux or Windows.