Frequently asked questions.
Common questions about how CertMoni monitors your public TLS certificates — what we check, what we never touch, and how billing works. Public hosts are checked from the internet with nothing to install; internal hosts use our small private agent, which only connects outward. If your question is not answered below, email hello@certmoni.com and a real person will reply.
Do you need access to my servers or private keys?
No private keys, ever. Public hosts are checked from the internet with the same TLS handshake a browser makes. Internal hosts are checked by our private agent, a small script you run on a machine that can reach the ports your certificates are served on; it only connects outward.
What counts as one certificate?
Each endpoint you monitor, meaning a hostname and port, counts as one. A wildcard certificate served on three hostnames is three endpoints, because each can break on its own.
Can I monitor internal or private hosts?
Yes, with the private agent. Public hosts need nothing installed. For hosts that are not reachable from the internet you run our small agent script on any machine that can reach the ports the certificates are served on; it connects outward to CertMoni and never needs inbound access or your keys.
What happens when my plan runs out?
We email you a month, two weeks and one week before renewal. If it lapses, checks pause but your board and history stay put until you renew.
How do I pay?
By PayPal, a year or more in advance. You can buy 1, 2 or 3 years and top up with more certificates at any time.
Want the detail behind these answers? The feature list sets out every check we make, the pricing page explains exactly what one certificate costs, and our note on shorter certificate lifetimes covers why monitoring matters more every year. You can also start a free trial of five certificates without a card and see your first results within minutes.