AutoCert MSP
Sign inGet started

SSL automation for MSPs & sysadmins

SSL certificates that renew and install themselves.

One dashboard for every customer's certificates. We renew through Let's Encrypt, a tiny agent installs them on Nginx, Apache and IIS with zero downtime, and you get an email only when something needs you.

Start automatingSee how it works
  • Wildcards included
  • Linux & Windows Server
  • Cancel anytime
Works withNginxApacheIISHAProxyLet's EncryptCloudflare DNSGoDaddy DNSUbuntu · RHEL · Windows Server

An expired certificate is an outage.

Browsers block the site, APIs stop talking, and the customer calls you first. Spreadsheets and calendar reminders don't renew anything. AutoCert MSP does.

Automatic renewal

Let's Encrypt certificates are renewed 30 days before expiry via DNS-01, so wildcards work and nothing needs an open port.

Zero-downtime install

The agent writes files atomically, runs your config test, reloads Nginx, Apache or IIS, and rolls back on its own if anything fails.

Find every certificate

Agents discover the certificates already on your servers, including the ones bought elsewhere that everyone forgot about.

Alerts before it hurts

One digest email when something needs you: expiring certificates, failing renewals, servers that stopped reporting.

Built for MSPs

Every customer, server and certificate on one dashboard, with per-plan quotas, roles, and self-service billing.

Secure by design

DNS credentials and keys are encrypted at rest. Agents only run commands defined on your server, never sent from the cloud.

How it works

Live in about ten minutes

  1. 1

    Connect your DNS

    Add a scoped Cloudflare token or a GoDaddy API key. It's verified, then stored encrypted.

  2. 2

    Install the agent

    One command on Linux or Windows Server. A single binary with no dependencies, running as a service.

  3. 3

    Forget about expiry

    Request a certificate, pick the server, done. Renewal and installation happen on their own, forever.

web-01: bash
$ curl -fsSL https://…/install.sh | sudo bash -s -- --token asl_enroll_…
Downloading autossl-agent-linux-amd64 … checksum ok
Enrolled web-01 as agent 2b09…7a1
AutoSSL agent is running.

# 3 days later, while you sleep
deployed shop.acme-retail.com → /etc/nginx/ssl
nginx -t ok · systemctl reload nginx ok

Your servers stay yours.

Most automation tools need root access from the cloud. We designed the opposite: the agent pulls, decides locally, and can always roll back.

  • No inbound ports: outbound HTTPS only
  • Reload commands live in your local config
  • AES-256-GCM encryption for keys & DNS tokens
  • Private keys never reach a browser
  • Single-use, expiring install tokens
  • Automatic rollback on failed reloads

Pricing

Pay per server, not per certificate

Unlimited certificates and domains on every plan. Monthly, cancel anytime.

Starter

For a single company's web servers.

$29/month

  • Up to 10 servers
  • Unlimited certificates & wildcards
  • Nginx, Apache & IIS agents
  • Expiry & failure alerts
  • Self-service billing & invoices
Choose Starter
Most popular

Pro

For growing IT teams and small MSPs.

$99/month

  • Up to 50 servers
  • Unlimited certificates & wildcards
  • Nginx, Apache & IIS agents
  • Expiry & failure alerts
  • Self-service billing & invoices
Choose Pro

MSP

For MSPs managing many customer environments.

$299/month

  • Up to 200 servers
  • Unlimited certificates & wildcards
  • Nginx, Apache & IIS agents
  • Expiry & failure alerts
  • Self-service billing & invoices
Choose MSP

Questions, answered

Which certificate authority do you use?+

Let's Encrypt, via the ACME protocol. Certificates are free, publicly trusted, and renewed automatically, so the short 90-day lifetime stops being your problem.

Do I need to open ports or expose my servers?+

No. We validate domains with DNS-01: a temporary TXT record is created through your DNS provider and removed right after. The agent only makes outbound HTTPS calls.

Can the cloud run commands on my servers?+

No. The dashboard can only announce that a new certificate is ready. Where it's written and which reload command runs are set in the agent's local config file, on your server.

What happens if a reload fails?+

The agent restores the previous certificate files, reloads again so your site keeps serving, and reports the error to the dashboard, which emails you.

Does it support wildcard certificates?+

Yes. DNS-01 validation is what makes wildcards (*.example.com) possible, and it's what we use for every certificate.

Can I cancel anytime?+

Yes. Plans are monthly and managed in a self-service billing portal: change plan, update your card, download invoices, or cancel at period end.

Never get the 2 a.m. expiry call again.

Connect your first server in minutes. Your future self will thank you.

Create your account