Self-Hosted SSL Certificate Monitoring

Never let a cert expire again.

A self-hosted dashboard that monitors every SSL certificate across your infrastructure — public domains, internal services, and hidden subdomains behind your firewall. One-command Docker install. Yours to own.

See How It Works
install.sh
$ curl -sSL https://cdn.zenworks.co.za/ssl/install.sh | bash   Docker daemon running Licence key validated Secrets generated Images pulled Database initialised Admin user created Scheduler started   ── Certificate scan results ────────── api.acme.co — 186 days portal.acme.co — 22 days legacy.acme.co — EXPIRED   Dashboard: http://your-server:80 $
1cmd from zero to monitoring
24h scan cycle — always current
subdomains discovered
0 cloud dependencies
Healthy Green
More than 30 days remaining
Warning Amber
Expiring within 30 days
Critical Red
Expiring within 7 days
Expired Expired
Certificate has lapsed
01

The problem
with certificates

SSL certificates expire silently. No warning. No dashboard. Just a downed service and an angry client at 2am.

😱
Silent Expiry

Certificates expire without warning. Your monitoring only catches it once the site is already down — usually when a client calls, not before.

Already too late
🔍
Hidden Services

Internal middleware, APIs, and admin portals behind your firewall run on SSL certificates too. Public scanners can't see them. You're flying blind on half your infrastructure.

Off the radar entirely
📋
Spreadsheet Hell

Teams track renewals in shared spreadsheets or rely on calendar reminders. Someone leaves. The spreadsheet goes stale. The cert doesn't know the reminder was deleted.

Breaks when you need it most
02

Everything you
need to stay ahead

Full visibility across your certificate estate. Public and private. Known and discovered.

🔒
Live TLS Scanning

Connects directly to each host, pulls the live certificate, and extracts issuer, expiry, SANs, key algorithm, fingerprint, and wildcard status. No agents. No plugins.

⚠️
Expiry Alerts

Sends alerts at 30 days, 7 days, and on expiry via Slack or any webhook. Configure per-channel. Multiple alert channels per plan.

🌐
Subdomain Discovery

Automatically discovers subdomains via crt.sh Certificate Transparency logs and a concurrent DNS wordlist scan. Runs weekly. Finds what you forgot you deployed.

🏢
Internal DNS Scanning

Point the scanner at your internal nameserver. Attempts a full AXFR zone transfer — dumps your entire internal zone in seconds. Falls back to wordlist if AXFR is refused.

👥
Multi-User RBAC

Admin, Editor, and Viewer roles. Admins manage users and settings. Editors add and scan domains. Viewers read everything. User seat count enforced by your plan.

📊
Renewal Workflow

Per-domain renewal status — Pending, In Progress, Renewed, Auto-Renewal, Manual. Add notes, contacts, and action items. Track the full lifecycle, not just the expiry date.

📥
CSV Import & Export

Bulk import your existing domain inventory from a spreadsheet. Export the full estate with cert details, status, and expiry dates for reporting or audit purposes.

📜
Certificate History

Every scan result, renewal status change, and user action is logged with timestamp and actor. Full audit trail per domain. Never lose track of what changed and when.

🐳
Docker Native

Three containers — FastAPI backend, React frontend via nginx, PostgreSQL. Runs on any Linux server. One compose file. No cloud account required.

☁️
Cloudflare Import

Connect your Cloudflare account via API token. SSL Dashboard fetches your zones and all A-record subdomains, lets you select exactly what to import, and bulk-adds them with a single click.

03

Up and running
in minutes

From bare server to full certificate visibility in one command.

1
Buy a Licence

Purchase a plan. You receive a licence key via email. Standard, Pro, or Enterprise — each unlocks different domain and user limits.

2
Run the Installer

One curl command on any Linux server with Docker. The script validates your key, pulls the images, generates secrets, and starts the stack.

3
Add Your Domains

Log in to the dashboard. Add domains one by one, bulk import via CSV, or let the subdomain scanner discover them automatically from your zone.

4
Get Alerts

Configure a Slack channel or webhook. Scans run daily. Alerts fire at 30 days, 7 days, and on expiry. You know before your clients do.

Pro + Enterprise Feature

See what public
scanners can't.

Most SSL monitors query public Certificate Transparency logs. If your service isn't publicly registered, they'll never find it. SSL Dashboard can point directly at your internal nameserver — on-prem, behind VPN, or on a private VLAN.

  • Set a per-domain DNS server (e.g. 192.168.1.53) in domain settings
  • Scanner attempts an AXFR zone transfer — if permitted, dumps the entire internal zone instantly
  • Falls back to wordlist brute-force resolved against your nameserver if AXFR is refused
  • crt.sh CT logs are automatically skipped for internal domains — no external queries
  • Works for any internal service — middleware, admin panels, staging environments, payment APIs
internal scan — acme.internal
── Internal DNS mode ───────────────── Nameserver: 192.168.10.53 Domain: acme.internal   AXFR zone transfer accepted 14 records retrieved from zone   ── Discovered subdomains ───────────── api.acme.internal — 210 days erp.acme.internal — 18 days payments.acme.internal — 89 days legacy-admin.acme.internal — EXPIRED gitlab.acme.internal — 156 days   ── Alert dispatched via Slack ───────── 2 alerts sent to #ssl-alerts $
05

Already on
Cloudflare?

Import your entire domain portfolio in seconds. No manual entry required.

All Plans

Your zones.
One click.

If your DNS is on Cloudflare, you already have the full list of your domains and subdomains sitting in their API. SSL Dashboard connects directly to your Cloudflare account, fetches every zone and every A-record, and lets you cherry-pick or bulk-import the lot.

  • Add your Cloudflare API token once in Settings — read-only Zone and DNS permissions
  • Preview all zones and their A-record subdomains before importing anything
  • Select individual hostnames or import an entire zone in one click
  • Imported domains are immediately queued for a live TLS cert scan
  • Tagged as cloudflare automatically so you can filter them later
Cloudflare Import
── Fetching zones ──────────────────── Token validated 3 zones found   ── acme.co.za ── 8 A records ───────── acme.co.za www.acme.co.za api.acme.co.za portal.acme.co.za staging.acme.co.za   ── Import selected ─────────────────── 5 domains imported Cert scans queued Tagged: cloudflare $
06

Simple pricing.
No surprises.

Annual licence. Runs on your infrastructure. No monthly SaaS bill. No per-domain charges.

Standard
Standard
R990
Per year · includes updates
  • Up to 30 domains
  • 3 user seats
  • 2 alert channels
  • Public subdomain discovery
  • Slack + webhook alerts
  • CSV import / export
  • Renewal workflow tracking
  • Email support
S
Enterprise
Enterprise
R4950
Per year · dedicated support
  • Unlimited domains
  • Unlimited users
  • Unlimited alert channels
  • Internal DNS scanning
  • AXFR zone transfer
  • All Pro features
  • Custom onboarding
  • Dedicated support contact
E
07

The honest
comparison

What you get with SSL Dashboard versus the alternatives.

Feature SSL Dashboard CertSpotter UptimeRobot Build Your Own
Self-hosted — you own the data
Internal / private domain scanning Build it
AXFR zone transfer discovery Build it
Subdomain discovery built-in Build it
Cloudflare zone import Build it
Renewal workflow tracking Build it
Multi-user RBAC Build it
One-command Docker install Build it
No per-domain pricing
Annual cost at 50 domains R990/yr $240+/yr $84+/yr Your time
Your cert data should live on your server. Not ours.
— The ZenWorks Philosophy

Most SSL monitoring tools are SaaS dashboards. You hand them a list of your domains. They scan them from their infrastructure, store the results in their database, and charge you monthly — forever — for the privilege.


SSL Dashboard is different. The scanner runs on your server. Your certificate data never leaves your infrastructure. Your internal services — the ones behind your firewall that SaaS tools can never reach — get monitored too.


When you renew next year, you're paying for continued updates and support — not for access to your own data. The data is yours, always.


And because it's self-hosted, it can see what no external tool ever could: your internal middleware, your payment APIs, your ERP system — every certificate on your network, not just the public ones.

Know before
it expires.

One command. Running in minutes. Your infrastructure, your data, your rules.

zenworks.co.za