One place for all your Let's Encrypt certificates. AutoCert issues them with DNS validation, installs them on IIS, VPN (RRAS), nginx, Apache or any application, and checks that every server really serves the new certificate. Not just that a renewal ran.
Runs on your own Windows server. Your keys and passwords never leave your network.
Works with the tools you already run
Certificates now live for months, not years, so renewal is a permanent job. Scripts run on one server, a scheduled task silently fails on another, and the first sign of trouble is a customer on the phone.
A renewal can succeed while IIS still serves the old certificate or a binding points to a certificate that is gone. AutoCert checks both the binding and the live TLS handshake.
Replacing a VPN certificate means restarting a service and dropping every connected user. AutoCert installs and restarts together, in a maintenance window you choose.
One list of every certificate, every server and every expiry date, with a clear status instead of a spreadsheet and good intentions.
The wizard has four short steps. After that AutoCert renews, installs and verifies on its own and tells you only when something needs a human.
Let AutoCert manage the certificate centrally, or let the server renew its own and have AutoCert watch it. Mix both in the same installation.
Pick the domain names (wildcards included), the DNS host, and where each certificate should go: an IIS site, the VPN service, a Linux site, or a folder for any application.
AutoCert renews well before expiry, installs, restarts at the right time and checks the result. You get a Teams or email message if something is off.
Real screens from AutoCert with demonstration data. They follow your light or dark setting.
Every certificate, where it is installed and when it expires. Problems are impossible to miss: a server that doesn't use the new certificate, a renewal that is due, a VPN that is waiting for its window.
Not everything is IIS or nginx. AutoCert writes the certificate as PFX, PEM or CRT + KEY into a folder on the AutoCert server, a network share or a Windows server, then runs your command, for example a service restart.
.bak, and every file is read back and checked.
For a VPN server the new certificate is installed and the service restarted together, at the time you pick: now, inside a daily window, or at an exact date and time. Until then everyone keeps working with the current certificate.
Four short steps: how it's renewed, the names, the details, and a summary before anything is created. Every choice says when to pick it. DNS providers and logins can be added without leaving the wizard.
AutoCert proves domain ownership by briefly creating a TXT record in your DNS zone. Add Azure DNS, Cloudflare or Google Cloud DNS, each with a token or key limited to that zone, tested when you save it.
Prefer that a server keeps renewing even when AutoCert is offline? AutoCert installs certbot or win-acme, and reads the status every hour. A renewed VPN certificate still waits for its window.
Everything an administrator would otherwise script, check by hand and forget about.
Certificates for internal names and wildcards, without opening port 80. The challenge record is created and cleaned up automatically.
Three DNS hosts, each with the least privilege it needs. Public zones, checked against what the internet really uses.
Let's Encrypt production and staging, a dry run before the first request, and a "Test automatic renewal" button that shows the real thing happen.
Renew a set number of days before expiry, globally or per certificate. Failed renewals retry, and short-lived certificates are handled sensibly.
Imports the certificate, creates or updates the https binding (SNI included) and removes the old one only if nothing else uses it.
SSTP and IKEv2. Install and restart happen together, immediately, in a window or on your go-ahead, so new connections never fail in between.
Over SSH: changes only the certificate lines, tests the configuration, reloads, and rolls back if the test fails. A site without HTTPS can get HTTPS on 443.
PFX, PEM or CRT + KEY into a folder, then your own command. For Java, Tomcat and Windows applications, appliances and shares.
AutoCert connects to the server and compares what it presents with what it issued, every hour and after every install.
Finds IIS and VPN bindings that point to a missing or old certificate, offers a one-click fix, and can repair by itself, at most twice.
Now, in the maintenance window, or at an exact date and time, for any server and in any mode. Cancel it whenever you like.
Rollback on failure, backups of replaced files, every written file read back and compared, and an activity log of who did what.
A message when a renewal fails, an install is stuck, a server serves the wrong certificate or one is close to expiring.
PRTG, Zabbix, Uptime Kuma, Prometheus, Nagios, Icinga and Checkmk see the same status AutoCert shows.
Sign in with your Windows account. Administrators change things, viewers can only look.
DNS credentials, server logins and PFX passwords are encrypted with Windows DPAPI and are write-only in the interface.
Pick where the domain lives and where the certificate has to go. Everything else is the same wizard.
A service principal with the DNS Zone Contributor role on the zone only, so it can't change anything else.
A token with Zone – DNS – Edit and Zone – Zone – Read, limited to the zone. AutoCert finds the zone by its name.
A service account with the DNS Administrator role on the project and a public Cloud DNS zone. Paste the JSON key once.
Plenty of products read their certificate from a file: Java and Tomcat based applications, Windows services, appliances behind a share. AutoCert requests the certificate and hands it over the way the application expects it.
.pfx, .p12, .keystore), PEM files, or CRT + KEY, in any combination.Restart-Service MyApp, in the window you set.Anything that has to restart waits for the maintenance window you set. Until then the application keeps working with the certificate it has.
Use both side by side. Both end up in the same dashboard with the same alerts.
AutoCert exposes its state to your existing tools, so a certificate problem shows up where you already look for problems. No new dashboard to watch.
# Example check output OK - All OK: 9 certificate(s), lowest 21 days left | lowest_days=21;20;7;0; errors=0;;1;0; failed_installs=0;;1;0; wrong_certificate=0;;1;0; expiring_soon=0;1;;0; minutes_since_check=4;;30;0;
AutoCert is a Windows service on a server you own. Certificates, keys and credentials are never sent to a cloud service.
Private keys, DNS credentials, server logins and PFX passwords are encrypted with Windows DPAPI for the service account. A copied data file is useless on another machine.
A saved secret is never shown again in the interface. Replace it or keep it, but nobody can read it back.
A DNS role or token limited to one zone. Servers are reached as a service account, or with a saved login you choose. Nothing is installed on the targets.
Sign in with Windows accounts. Administrators can change things, viewers can only look. Both are limited to the groups you name.
Every action is logged with the user who triggered it, and every certificate has its own history.
Rollback when an install fails, backups of replaced files, retries with limits, and a maintenance window for anything that restarts.
Your data stays with you. The only thing that leaves your network besides the Let's Encrypt and DNS requests is the license check, which handles the license and nothing else.
A scheduled script per server is a fine start. This is what changes when there are many servers and many kinds of target.
| Scripts and scheduled tasks | AutoCert | |
|---|---|---|
| Wildcards and internal names | Possible, built and kept up to date by you for every host. | Built in with DNS validation. |
| Installing | One script per kind of target. | One wizard for IIS, VPN, Linux and any application. |
| Did it work? | Usually a log file nobody reads. | Binding check and live TLS check, with a one-click fix. |
| Restarts | You pick a time and hope. | Install and restart together, in a window you set. |
| Overview | A spreadsheet, or nothing. | One dashboard and your monitoring system. |
| Alerts | Only if someone built them. | Teams, email, PRTG, Zabbix and more. |
| Secrets | In scripts or files. | Encrypted with DPAPI, write-only in the interface. |
Try AutoCert on your own servers first. Tell us how many servers you manage and we will send a trial license and a quote.
Licensed per managed server. Includes updates and support.
On a Windows server in your own network, as a Windows service with a web interface. Certificates, server logins and DNS credentials stay on that server.
Let's Encrypt, production and staging. You can do a dry run against the test server first.
Azure DNS, Cloudflare and Google Cloud DNS, for public zones. Each uses a token or key limited to the zone. If your domain is hosted elsewhere, tell us, or use a self-renewing server where the certificate is requested over HTTP on port 80 instead.
IIS websites and the RRAS VPN service (SSTP and IKEv2) on Windows over WinRM, nginx and Apache on Linux over SSH, and any other application through Copy to a folder: PFX, PEM or CRT + KEY files on the AutoCert server, a network share or a Windows server, followed by your own command, such as a service restart.
Yes, if the product reads its certificate from a file. Write a PFX (.pfx, .p12 or .keystore) into its folder with the password it expects, and let AutoCert restart its service in your maintenance window. Many products can import the first file through their own interface once, after which AutoCert replaces it at every renewal.
Only when you allow it. The new certificate is installed and RRAS restarted together, in the maintenance window you set for that server, or at a date and time you pick. Until then the current certificate keeps working. The same waiting applies to a folder target that runs a command.
AutoCert notices. It compares what the server really presents with what it issued, tells you what is wrong, offers a Fix button and can repair it automatically.
Self-renewing servers keep renewing on their own. Managed certificates are renewed as soon as AutoCert is back, and 30 days of margin before expiry is the default. Set the service to start automatically so it comes back after a reboot.
Yes. Sign-in uses Windows accounts. Administrators can change settings, viewers can only look, and the activity log shows who did what.
Per managed server, with a free trial. Without a valid license you can still browse the application, but renewing and installing are switched off.
Send us a short note about your environment and we will set you up with a trial.
Contact us