Getting started¶
What CertIntel does¶
CertIntel keeps track of TLS certificates so you don't have to remember where they all are. It watches expiry across everything your organization runs - public websites, internal servers, certificates issued through ACME - and gives you one place to see what's expiring, what failed, and what still needs attention.
How it gets certificate data¶
There's no single way certificates get into CertIntel, because there's no single kind of server that needs one. CertIntel pulls data in from four directions: it polls public websites directly, it hears from the Agent on hosts where one's installed, a small script can report from anywhere else, and it hears from the ACME renewal process itself. See How it works for the full picture with a diagram.
What the Agent does¶
The Agent is a small program you install on a Windows or Linux machine. Once it's running, it can do two things: watch certificates on that machine (or on internal servers you point it at) and report what it finds, and - if you want it to - handle the entire renewal process itself, requesting and installing new certificates before the old ones expire. You don't need the Agent everywhere; it's for machines CertIntel can't reach on its own, or ones you want it actively managing renewals for.
Installing it is one command copied from the dashboard's Install Tokens page - from the organization's own token, or from a one-time token minted for that one install (platform builds after 2026.10.28). See Windows Agent or Linux Agent. A newly installed agent waits for an administrator to click Approve on the Agents page before it can report.
To automate certificate delivery on Windows, start with
Workflows → + New certificate workflow. The
Workflow studio guide walks through templates,
shared settings, installation steps, and verification with screenshots. On
Linux, sudo certintel tui opens a terminal interface for the same
day-to-day tasks.
Signing in¶
Your administrator gives you a sign-in link - either https://<slug>.app.certin.tel
for your specific organization, or a shared login page that asks for your email and
routes you to the right place. If your organization uses single sign-on, see
OIDC / SSO overview.
An account created by an administrator must change its password at first sign-in before doing anything else. After too many wrong attempts the page says Too many attempts. Wait a minute and try again.; eight wrong passwords in a row lock the account for 15 minutes.
If you turned on two-factor sign-in, or your workspace requires it, the next page asks for the code from your authenticator app (or a recovery code). A workspace that requires it, but where you have not set it up yet, shows a reminder and, after the grace period, takes you to Account security to set it up first.
On plans with the Appearance feature, your organization's own sign-in page shows the tenant's logo and theme, and you can pick a personal theme and light/dark mode under You → My appearance once signed in. On every plan, You → My preferences lets you pick the time zone the dashboard shows timestamps in (the default is set by your administrator). See Branding & themes.
What to do first¶
The fastest way to see CertIntel do something useful: go to Public Endpoints in the dashboard and add any website your organization runs. No install, no key - CertIntel starts polling its certificate immediately. (It must be a public hostname. If the name resolves to a private or special-use address, the endpoint is added but its first check fails with This target cannot be monitored (resolves to a non-public or otherwise special-use address) - monitor such hosts with an Agent instead.) Click a row to open its details; the Edit endpoint section there lets anyone who can edit endpoints change the label. The hostname and port identify the endpoint and its check history, so they stay fixed - to monitor a different host or port, add a new endpoint and delete the old one. From there, How it works explains the other ways to bring certificates in, and the documentation home is a full map of every page in this wiki.