Add a domain
Name the domain. Every name the logs have published for it, including subdomains, is part of the inventory. The plan counts the domain, not each name.
Certificate visibility for teams without a PKI team.
See certificates before they expire.
CertLantern keeps an inventory of certificates published for your domains: issuer, names, key, signature, and expiry. It is a hosted product for teams anywhere, built only from public Certificate Transparency logs.
Read public logs
A scheduler queues Certificate Transparency refreshes. Each run stores one page of what the logs return.
Watch expiry
Expired and expiring certificates are highlighted. Pro and Team can export the inventory as CSV or a printable report.
What you can see
Identity
Subject names, issuer, serial, and SHA-256 fingerprint when the log provides the certificate.
Cryptography
Key type and size, plus the signature algorithm, when the certificate bytes are available.
Access
Owner, admin, and viewer roles, with an audit log of who changed the organization.
Add an endpoint under a domain and CertLantern probes the certificate that host is serving. The live demo is an example domain from public Certificate Transparency logs and is never probed. Email alerts are on Pro and Team. Slack, Teams, Discord, and webhooks are on Team. Renewal-overdue, unexpected certificate authority, new-name, and CAA alerts are on Pro and Team.
Pricing
Early pricing
Early pricing; billing isn't live yet
Nothing is billed. Listed domain, endpoint, live-check, and member limits are enforced.
CSV and the printable inventory report are on Pro and Team. Renewal-overdue, unexpected certificate authority, new-name, and CAA alerts are on Pro and Team.
Free
$0
- 1 domain, including every name found for it
- Full Certificate Transparency inventory
- 3 hosts you choose to probe
- 3 live checks of hosts you add
Pro
$9/mo or $90/yr
- 10 domains, including every name found for each
- 25 hosts you choose to probe
- Daily live checks
- Email alerts
- Renewal-overdue, unexpected certificate authority, new-name, and CAA alerts
- CSV and printable inventory report
Team
$29/mo or $290/yr
- 50 domains, including every name found for each
- 150 hosts you choose to probe
- Daily live checks
- 5 users
- Email alerts
- Renewal-overdue, unexpected certificate authority, new-name, and CAA alerts
- Slack, Teams, Discord, and webhook
- CSV and printable inventory report
- API coming soon
Larger orgs
Contact for pricing
More domains and people than Team. Names found for a domain stay included with it.
Contact usGuides
Certificate expiry monitoring
Not-after dates from public logs, what stays after expiry, and when Pro and Team are alerted.
Certificate Transparency
How a logged certificate is found, what is stored, and why issuance is not the same as installation.
Renewed but not deployed
How a live check compares the certificate a host is serving with a later one in the logs, and how a two-thirds lifetime alert catches a renewal that never appeared.
Shorter certificate lifetimes
Expiry mail from a certificate authority is easy to lose. A 90-day, 64-day, or 47-day certificate needs a reminder timed to its own lifetime.
Free SSL certificate checker
Certificate expiry lookup and certificate transparency search for one public domain. Logs only, no probe.
SSL certificate expiry monitoring
Which not-after dates matter, what the public checker shows, and when a paid alert is worth it.
Certificate Transparency monitoring
What a log monitor records, what one page includes, and what an account keeps reading.
Choosing a monitoring tool
Certificate Transparency coverage, live checks, alerts, pricing, and privacy, and when another kind of tool may fit better.
Questions
Does the live demo probe its example domain?
No. It is an example domain from public Certificate Transparency logs. This page does not open a connection to that host.
Will a certificate appear if it is not installed?
Yes. Transparency logs record issuance, not deployment. A name can show up because someone requested a certificate, even if you never installed it.
Do names on subdomains count as extra domains?
No. You add the domain, and every name the logs return for it is included. An endpoint is a host you ask CertLantern to probe, and only those count toward the endpoint limit.
Who can see my inventory?
Only members of your organization. The public demo is the only organization inventory available without signing in. Anyone can look up one public domain on the certificate checker.
Read the docs for roles, refresh timing, and how sign-in links work. The FAQ answers the shorter questions.