For hosting platforms
Certificate monitoring as a building block of your platform — under your brand.
Your customers' certificates expire where your panel does not reach: third-party CAs, forgotten subdomains, systems next to the panel. SaQura CertWatch runs on your infrastructure, monitors per tenant and sends alerts and reports under your brand — as an add-on you sell.
Why now
of organisations had a certificate-related outage in the last twelve months.
CyberArk, State of Machine Identity Security 2025
Public TLS certificates will be valid for at most 100 days from 2027 and only 47 from 2029. Every reduction multiplies the renewals — and the chances of missing one.
CA/Browser Forum, ballot SC-081 — an industry rule, not a law
Your panel renews what it issued itself. Everything else expires unnoticed: certificates from other issuers, forgotten subdomains, systems next to the panel. That is exactly where the tickets come from.
How it runs on your side
One package, your server, any number of customers — without your customers having to learn a new tool.
On your infrastructure
CertWatch runs self-hosted on your server — Linux, Windows or macOS. Findings and inventory stay with you.
One tenant per customer
Every customer gets their own addresses, recipients and reports. Inventory discovery via the public certificate logs also finds the subdomains that are no longer on any list.
Under your brand
Alerts and reports carry your logo. Your customer sees your platform — and never has to log in anywhere.
Connected to your panel
Webhooks report every state change to your systems; the read API delivers inventory and grades for your customer portal or ticket system.
What your customer gets
Three things they do not get from their host today — and understand immediately.
Alerts before things fail
30, 14, 7 and 1 day before expiry (configurable), reminders until it is fixed — and the all-clear only once the new certificate is actually being served.
A recurring report under your brand
A regular report on all of the tenant's addresses with grades A–F and reasons in plain sentences — by e-mail, in English, German or Japanese.
A seal they can recalculate themselves
Every report carries a protocol number and a checksum from a continuous audit chain. Any auditor can recalculate the checksum — no CertWatch required.
Pricing
The same prices as on the CertWatch page — the basis for pricing your add-on.
MSP monthly
€69/ month
Per managed tenant, cancellable monthly
- Up to 10 tenants €69 per month
- Each additional tenant €6 per month
- From 20 tenants unlimited for €129 per month
- The licence renews itself; change the quantity any time in the customer portal
Self-Host
€1,290/ year
Your server, your data — annual licence
- All checks, unlimited addresses
- Tenants, your own brand, webhooks, read API
- Sealed reports + continuous audit chain
- Licence file by e-mail, updates during the term
Partner terms
On request
For platforms with many tenants or their own sales channel
- Terms per end customer
- Sample report under your brand
- A named contact at KyotoTech
All prices excl. VAT. Buy, renew and download on the CertWatch page (saqura.org/en/certwatch).
Frequently asked questions
Does it run on our infrastructure?
Yes. CertWatch is a self-hosted product: a package for Linux (x86-64 and arm64), Windows or macOS that you operate on your own server. For continuous operation we recommend Linux or Windows.
Do our customers see SaQura?
Alerts and reports go to the recipients of each tenant under your brand. You operate CertWatch; your customers never have to log in anywhere.
How many tenants are possible?
The MSP tier counts per tenant: a flat rate up to 10 tenants, each additional one individually, unlimited tenants at a fixed price from 20. The Self-Host annual licence includes unlimited addresses; tenants are included.
Does CertWatch renew certificates?
No. CertWatch monitors and documents — it does not renew. Renewal stays with your panel, your certificate authority or your ACME client. CertWatch checks from the outside whether the new certificate is actually being served, and only then gives the all-clear.
Which data leaves our premises?
Findings and inventory stay with you. Two outbound connections can be switched off: the daily licence refresh of the MSP subscription (only a checksum of the licence number is sent) and the check for new versions. The checks themselves run from your server — to the monitored addresses, to the issuers' revocation lists and to the public certificate logs.
Want to see a sample report?
We will send you a sample report as your customer would receive it under your brand. To try it on your own server: trial mode monitors up to 3 addresses without a licence.