Team
€199 / month
30-day trial (card checkout)
- Managed certificates
- 50
- Domains
- 10
- Deploy targets
- 5
- Discovery scans
- Daily
- Managed certificate estate
- Deployment workflows and scoped API keys
- Team access and core features
Automate Certificates
TLS renewal
without the hunt.
Tracks certificates, runs ACME renewal, and deploys to cloud and database targets.
GDPR · DORA · NIS2
Capabilities
Discovery, ACME renewal, and deployment to 21 targets
-
ACME issuance and renewal
Request Let's Encrypt certificates via ACME v2 with DNS-01 or HTTP-01 challenges; the cron job renews 30 days before expiry.
-
Tenant-wide discovery
Scan Azure subscriptions, Key Vaults, App Services, and App Gateways to surface certificates that never made it into your inventory.
-
Multi-target deployment
Push renewed certs to 21 target types: Azure Key Vault, App Service, App Gateway, AWS ACM, ALB, GCP load balancers, PostgreSQL, and more.
-
Expiry alerting
In-app alerts when a certificate has less than 7 days left or a renewal fails. Signed webhooks, set up through the API, send expiry, renewal and deployment events to your own tools.
-
Audit records per renewal
Append-only log with CSV export and webhook delivery for every issuance, deployment, and Marketplace lifecycle action.
-
Entra SSO and scoped API keys
Azure service principal authentication for tenant scans; OIDC sign-in with TOTP MFA and API keys scoped to specific operations.
In the product
The app.
Screenshots from a live workspace: dashboard, certificates, monitoring, alerts and sign-in.
From trial to first result.
What happens after you start a trial. The screenshots come from a trial workspace for a made-up company.
-
Start the trial
Enter your work email and company on the Spot Suite buy page, then add a card at Stripe checkout.
-
Wait for setup
Setup takes about 5 to 10 minutes, and the welcome email with your sign-in link arrives right after checkout.
-
Sign in
Use the link in the welcome email, or open yourcompany.automate-certificates.com and sign in with your work email or a passkey.
-
Find your certificates
Enter your domains, or connect your Azure tenant through a read-only service principal, and import what the scan finds.
-
See every expiry date
Each certificate shows its expiry date and days left; under 30 days it is marked expiring, and under 7 days the app raises an alert.
-
Add deployment targets
Add where your certificates are installed, such as Azure Key Vault, App Service, AWS, GCP, a database or a server over SSH, so certificates issued here can be deployed there.
-
Get an alert before expiry
Under 7 days before a certificate expires, the app raises a critical alert on the Alerts page, where you can acknowledge it. The same event can also go to your own systems as a signed webhook that you set up through the API.
-
Check the dashboard
The dashboard counts valid and expiring certificates, targets, deployments in the last 30 days and open alerts, and lists the next expiry dates.
-
See who did what
The audit log records sign-ins, scans, imports and other changes, with the user and the time.
Start a 30-day trial
30-day trial with card checkout. Billing after the trial stays off unless you switch it on.
Pricing.
From €199/month (Team), Business at €499/month, and MSP from €1,499/month. Monthly billing only. Every plan starts with a 30-day trial (card checkout). Invoice billing is paid from day one.
Business
€499 / month
30-day trial (card checkout)
- Managed certificates
- 250
- Domains
- 50
- Deploy targets
- All 21
- Discovery scans
- Hourly
- Larger estate and broader deployment coverage
- More API and member capacity
- Priority support and quarterly review
MSP
from €1,499 / month
30-day trial (card checkout)
- Managed certificates
- 1,000+
- Domains
- 250+
- Deploy targets
- All 21
- Discovery scans
- Hourly
- Customer-tenant certificate and deployment workflows
- Per-customer reporting
- White-label notification templates
Questions.
-
Where is certificate data stored?
One shared Cloudflare Worker serves every customer. Customer data sits in one Postgres database that Supabase, a subprocessor, hosts in the EU. On your own environment host (yourcompany.automate-certificates.com), certificate data is kept in a schema of its own. Data created through app.automate-certificates.com or the API at api.automate-certificates.com, Azure agent scan results, and accounts, sign-in sessions, and API keys live in a shared central schema, where every query is filtered by organization. There are three exceptions. Private keys and credentials are encrypted with AES-256-GCM and held in Cloudflare Workers KV, which is not limited to EU locations. Our hourly backup dump of the database is kept in Cloudflare object storage in Western Europe under Cloudflare's default jurisdiction, not its EU jurisdiction. Workspaces bought through Azure Marketplace are stored in the Azure region the buyer picks at purchase: North Europe, West Europe or a US region.
-
How does sign-in work?
Operators sign in through Spot Suite OIDC with passkeys, authenticator-app MFA, or Entra ID federation. Azure tenant scans authenticate via a service principal with RS256 JWKS validation; programmatic access uses scoped API keys with fine-grained permissions.
-
What compliance records does it produce?
DORA and NIST-aligned audit reports, per-renewal exports with CSV download and webhook delivery. The append-only log records every issuance, deployment, and Marketplace lifecycle action with reviewer identity and timestamp.
-
What does the 30-day trial include?
Every plan starts with a 30-day trial (card checkout). Invoice billing is paid from day one. Full ACME issuance, auto-renewal, and deployment. After the trial, choose Team at €199 per month, Business at €499 per month, or MSP from €1,499 per month.
Spot Suite
The rest of the suite.
Same Spot Suite login and invoice if you already run this one. Trials are 30 days; some products are waitlist.
-
Secure file exchange Move files over SFTP, S3, Azure Blob and more, with a custody record per transfer. xevolve.io Open -
Cloud cost and forecasts Daily spend from AWS, Azure, GCP and StackIT, with anomalies flagged before the close. Join waitlist -
Web content filtering Block risky domains on managed devices and log every decision. clear-screen.ai Open -
IP address management Plan CIDR blocks across Azure tenants and catch conflicts before they ship. Join waitlist -
Joiner, mover, leaver Onboard, move and offboard staff in Microsoft 365 or Google Workspace, with a log. Join waitlist -
UBO and sanctions screening Screen owners and counterparties against UBO and sanctions lists. Join waitlist
Stop hunting expired certificates
Connect a target and run a discovery scan. ACME handles renewal after that. Every plan starts with a 30-day free trial (card checkout). Invoice billing is available (paid from day one).