Know about every certificate issued for your domains.
CAlert watches public Certificate Transparency logs and tells you by email or webhook as soon as a certificate for your domain appears, including the ones nobody on your team ordered.
Free for up to 3 domains. No credit card.
Set it up once, hear about every new certificate
Every publicly trusted certificate has to be published in Certificate Transparency logs before browsers accept it. CAlert reads those logs continuously, so nothing issued for your domain goes unnoticed.
-
Add your domains
Enter apex domains like
acme.com. Subdomains and wildcards are covered automatically, or you can limit monitoring to exact names. -
Choose where alerts go
Send alerts to team inboxes, to a webhook endpoint, or both. Route each domain to a different destination if you need to.
-
Get notified in minutes
When a matching certificate is logged, you get one alert with its names, issuer, validity dates and a link to the full certificate.
Alerts where your team already works
Wire alerts into your own tooling with signed webhooks, or keep it simple with email. Both carry the same data.
Webhooks
A JSON POST for every new certificate, ready for Slack, PagerDuty, your SIEM or a script of your own.
- HTTPS endpoints on port 443 or 8443
- Signed with HMAC-SHA256 so you can verify every request
- Automatic retries with backoff for up to 24 hours
- Delivery log with response codes and one-click redelivery
- Test events you can send from the dashboard
// POST https://hooks.acme.com/ct { "event": "cert.issued", "domain": "acme.com", "certificate": { "names": ["shop-staging.acme.com", "www.shop-staging.acme.com"], "issuer": "ZeroSSL ECC Domain Secure Site CA", "not_before": "2026-09-26T00:00:00Z", "not_after": "2026-12-25T23:59:59Z", "serial": "3f9a0c…e21b", "url": "https://ctlogs.dev/cert/…" }, "first_seen": "2026-09-26T12:04:17Z" }
Readable alerts for people, sent to individuals or shared addresses like security@ or the on-call alias.
- One email per certificate, with a summary instead when a domain gets more than 10 in an hour
- Precertificate and final certificate merged into one alert
- Plain subject lines that sort and filter well
- Unsubscribe per domain without touching other alerts
A certificate for acme.com was published in a Certificate Transparency log at 12:04 UTC.
| Names | shop-staging.acme.com, www.shop-staging.acme.com |
| Issuer | CN=ZeroSSL ECC Domain Secure Site CA, O=ZeroSSL GmbH, C=AT |
| Valid | 2026-09-26 to 2026-12-25 |
Keep the noise down
Exclude hosts you do not care about, such as www or a CI branch like *.preview.acme.com, or limit a domain to its exact name. More rules are on the way.
Simple pricing by number of domains
Every plan includes all subdomains of each monitored domain. Change or cancel anytime.
Free
For personal projects
- 3 domains
- Email and webhook alerts
- 30 days of alert history
Team
For companies with a few brands
- 50 domains
- Email and webhook alerts
- 1 year of alert history
Business
For large portfolios and MSSPs
- 500 domains, more on request
- Everything in Team
- Priority support
Questions
What is Certificate Transparency?
A public system of append-only logs. Browsers only trust a certificate if it has been submitted to these logs, so every publicly trusted certificate for your domain is visible there, no matter which CA issued it or who requested it.
How quickly will I get an alert?
Usually within a few minutes of the certificate being published in a log. CAs typically log a precertificate before the certificate is even delivered to whoever requested it.
Do I need to install anything or change DNS?
No. CAlert reads public logs, so there is nothing to install and no access to your servers or DNS is required. Just add a domain.
How do I verify a webhook came from CAlert?
Each request carries an X-CAlert-Signature header shaped like t=<unix>,v1=<hex>, where <hex> is the HMAC-SHA256 of "<t>." followed by the raw request body, keyed with your endpoint secret. Recompute it yourself, compare, and reject anything where the timestamp is more than five minutes old. Use the X-CAlert-Event-Id header to deduplicate retried deliveries.
Will renewals flood my inbox?
Not if you don't want them to. Exclude the hosts you don't need to hear about, and if a domain still gets more than 10 certificates in an hour you get one summary instead of a flood.