CertKit Pricing

A certificate is one managed identity, tracked by its private key lineage. Whether it covers one domain or fifty, whether it has been renewed twenty times or reissued last week, it counts as one certificate in your plan. We track the identity, not the individual files.

Yes. A wildcard certificate covers an unlimited number of subdomains but counts as one certificate. A certificate for *.example.com covering api.example.com, app.example.com, and a hundred others is still one certificate in your plan.

One certificate, regardless of how many domains are on it. A certificate covering ten domains in its Subject Alternative Names list counts the same as one covering a single domain. Adding or removing domains from a certificate does not change the count.

No. Renewals, reissuances, and rekeys all stay within the same certificate lineage. A certificate you have renewed fifty times is still one certificate. The count only increases when you bring a new managed identity into CertKit.

An agent is software you install on a server in your infrastructure. It watches for certificate updates from CertKit, deploys them to the right location, and triggers a service reload. One agent can manage multiple certificates on the same server.

Yes, one agent per server. Network appliances like load balancers and firewalls cannot run the agent; instead, an agent on one of your servers acts as a deployment hub and pushes certificates to them. You need at least one agent to deploy to appliances.

No. The Homelab plan is for personal, non-commercial use: your homelab, personal projects, and personal systems, with one account per person or organization. The details are in our Terms of Service.

Businesses evaluating CertKit get the full free 90-day trial. Consultants and MSPs managing certificates for clients need a paid plan; see the next question.

Professional or Business, with a certificate collection per company. Collections keep each company's certificates, access, and alerting separate inside one account.

If your companies need their own logins and audit trails, Business customers can have a multi-tenant account: each company gets its own sub-account under your control, purchased separately. MSPs get volume pricing, contact us for details.

You can add more certificates or agents at $2/month each, or upgrade to the next plan.

We will reach out before the trial ends to help you choose a plan and get set up. If you do not subscribe, your account deactivates: logins stop working, monitoring alerts stop, and CertKit no longer renews or deploys certificates. Certificates already deployed keep working on your infrastructure until they expire.

If your use is personal and non-commercial, you can move to the free Homelab plan instead. Get in touch if you need more time or want to talk through your options.

Yes. Upgrades take effect immediately. Downgrades take effect at the end of your current billing period.

Yes. Every paid plan can be paid by credit card or by invoice with NET30 terms. Contact us to set up invoice billing.

Your certificates keep running on your infrastructure after you cancel. CertKit already deployed them to your servers and they will continue to work until they expire. You will need to handle renewals manually after that, or resubscribe when you are ready.