Getting started¶

What CertIntel does¶

CertIntel keeps track of TLS certificates so you don't have to remember where they all are. It watches expiry across everything your organization runs - public websites, internal servers, certificates issued through ACME - and gives you one place to see what's expiring, what failed, and what still needs attention.

How it gets certificate data¶

There's no single way certificates get into CertIntel, because there's no single kind of server that needs one. CertIntel pulls data in from four directions: it polls public websites directly, it hears from the Agent on hosts where one's installed, a small script can report from anywhere else, and it hears from the ACME renewal process itself. See How it works for the full picture with a diagram.

What the Agent does¶

The Agent is a small program you install on a Windows or Linux machine. Once it's running, it can do two things: watch certificates on that machine (or on internal servers you point it at) and report what it finds, and - if you want it to - handle the entire renewal process itself, requesting and installing new certificates before the old ones expire. You don't need the Agent everywhere; it's for machines CertIntel can't reach on its own, or ones you want it actively managing renewals for.

Installing it is one command copied from the dashboard's Install Tokens page - from the organization's own token, or from a one-time token minted for that one install (platform builds after 2026.10.28). See Windows Agent or Linux Agent. A newly installed agent waits for an administrator to click Approve on the Agents page before it can report.

To automate certificate delivery on Windows, start with Workflows → + New certificate workflow. The Workflow studio guide walks through templates, shared settings, installation steps, and verification with screenshots. On Linux, sudo certintel tui opens a terminal interface for the same day-to-day tasks.

Signing in¶

Your administrator gives you a sign-in link - either https://<slug>.app.certin.tel for your specific organization, or the shared sign-in page at https://app.certin.tel. The shared page always asks for your email and then your password, and takes you to your workspace once the password is right; it never says whether an address has an account. If you sign in with single sign-on, have accounts in more than one workspace, or your workspace requires its own sign-in address, use Email me my sign-in links on the shared page: it emails the sign-in link of each workspace your address belongs to (every address gets the same answer, If this address has an account, we've emailed its sign-in links.). If your organization uses single sign-on, see OIDC / SSO overview.

An account created by an administrator must change its password at first sign-in before doing anything else. After too many wrong attempts the page says Too many attempts. Wait a minute and try again.; eight wrong passwords in a row lock the account for 15 minutes.

If you turned on two-factor sign-in, or your workspace requires it, the next page asks for your security key or passkey, or the code from your authenticator app (or a recovery code); Sign in with a passkey on the sign-in page needs no password at all. A workspace that requires it, but where you have not set it up yet, shows a reminder and, after the grace period, takes you to Account security to set it up first.

On plans with the Appearance feature, your organization's own sign-in page shows the tenant's logo and colors, and you can pick your own light/dark mode and layout density under You → My appearance once signed in. On every plan, You → My preferences lets you pick the time zone the dashboard shows timestamps in (the default is set by your administrator). See Branding & appearance.

Invite a colleague¶

On Users (under Access), open Invite a user, enter your colleague's email address, choose the organization and a role, and click Send invitation. They get an email with a link to choose their own password (valid for 72 hours); Manage on their row sends it again or revokes it. For someone who should see certificates and alerts but change nothing, choose Observer. See Organizations, users & roles.

What to do first¶

To put a trusted certificate on one of your servers, click Get a certificate for a server on the dashboard's Overview. It walks you through every step, each with one next action: install the Agent on the server with the command it shows, approve the server, choose what it runs (NGINX, Apache, HAProxy, IIS, …) and the names, add one DNS record per name, and propose the certificate. The server then requests the certificate, installs it and renews it by itself. Step-by-step guides: Linux (NGINX and others) and IIS quick start.

To watch a certificate you already have, go to Public Endpoints in the dashboard and add any website your organization runs. No install, no key - CertIntel starts polling its certificate immediately. Under Hostname, enter a hostname such as www.example.com, or paste the site's URL: CertIntel takes its host, and its port when the URL names one (else the Port field, 443 by default), leaves out the path and says what it took (Added www.example.com:443. Took www.example.com:443 from https://www.example.com/shop; the path is not part of the check. First check queued.). A refused entry keeps the form open with what you typed and names the format expected. (It must be a public hostname. If the name resolves to a private or special-use address, the endpoint is added but its first check fails with This target cannot be monitored (resolves to a non-public or otherwise special-use address) - monitor such hosts with an Agent instead.) Click a row to open its details; Check interval there reads default (12 h) for an endpoint without an interval of its own (12 hours on the hosted service; another deployment shows its own default). The Edit endpoint section there lets anyone who can edit endpoints change the label. The hostname and port identify the endpoint and its check history, so they stay fixed - to monitor a different host or port, add a new endpoint and delete the old one. Each hostname and port is monitored once per organization: adding it again is refused with www.example.com:443 is already monitored in this organization. From there, How it works explains the other ways to bring certificates in, and the documentation home is a full map of every page in this wiki.