SaQura Certificate Report · one-time €29
Every certificate under your domain, checked from the outside and graded — no installation, no credentials, no subscription.
Enter your domain and within minutes the sealed report is in your inbox: every publicly discoverable certificate, every address checked live, with a grade from A to F and its expiry date. The report only sees what is visible from the outside. That is exactly the side your customers, their browsers and any attacker see.
Pay by card, the report arrives as a PDF by e-mail, invoice included. Subdomains are covered.
Finds what is no longer on anyone's list
The search runs through the public certificate registers, not through your list. Test, legacy and shadow systems that ever received a certificate for your domain show up, even if nobody inside remembers them.
Checks every address the way your customer sees it
Live from the outside: expiry, chain, key, signature, revocation status, and whether the server already picks a quantum-safe key exchange. Every address gets a grade from A to F and the one sentence why.
A document that holds up
Protocol number, timestamp and a checksum over the content: any auditor can recalculate the seal. That makes the report a dated record you can put in front of management, an auditor or your insurer, not just a note for IT.
Why this report exists
An expired certificate is reported first by the customer.
A warning page in the browser, rejected mail, an interface that stops. According to CyberArk (State of Machine Identity Security 2025), 72% of the organisations surveyed had exactly that kind of outage most recently. Almost always the certificate was known; only the date was out of sight.
Before any monitoring comes one question: what is running at all?
Until now there were two ways to answer it: a script that only checks what you tell it, or an enterprise tool with a project and an annual contract. The €29 answer in between was missing because we had to build it first. Now it exists.
€29, because everything runs automatically.
No consultant, no appointment, no contract: register search, live check, grading and seal are produced without manual work. The checking logic is the same as in SaQura CertWatch, our continuous monitoring from €69 a month. You get its view of your domain, once, at the price of a snapshot.
One price. This is included.
One page of overview with key figures and “act first”, then one line per address, sorted by urgency: what expires this week is at the top. For large domains additionally as CSV.
- Every hostname found, with issuer and expiry date
- Grade A–F per address, with the reason
- Wildcard certificates and addresses that no longer respond, in their own sections
- Whether the server already picks a quantum-safe key exchange
- Protocol number, timestamp and checksum as the seal
- Report in English, German or Japanese, invoice by e-mail
Couldn't our admin do this with a script?
A script checks the addresses you give it. The report starts one step earlier: through the public registers it also finds the addresses that are no longer on any list, checks each of them live by the same rules as SaQura CertWatch, grades them and delivers a sealed, dated document in three languages. We maintain the checking rules. Your admin gets the result and keeps the day.
How fast does the report arrive?
Usually within a few minutes. Domains with very many addresses take longer; in that case you receive an interim notice after ten minutes, and the report follows automatically as soon as every address has been checked.
What if nothing is found?
Then that is your report: “No publicly discoverable certificates.” It is a result too, and you see what the registers know about your domain.
Is this continuous monitoring?
No, it is a snapshot of today. If you want to be warned every day before something expires, run SaQura CertWatch on your own server.
Once is good. Daily is safe.
SaQura CertWatch checks the same addresses every day and warns 30, 14, 7 and 1 day before expiry. Three addresses free, from €69 a month for service providers.
Checked are publicly reachable addresses recorded for your domain in the certificate registers (CT logs); internal systems and private certificates are not included. The report is a snapshot at the time of checking and does not replace continuous monitoring. A result with no findings is delivered as a report as well. Digital content, produced immediately after payment; by purchasing you consent to immediate performance and waive your right of withdrawal (§ 356(5) BGB). Price incl. VAT, invoice by e-mail. Source for 72%: CyberArk, State of Machine Identity Security 2025.