HSM integration
External HSM or cloud KMS for the vault master key.
Thanks. Your vote is recorded.
We couldn't record your vote. Please try again.
From installation hours to automation
Certificates have to be replaced more and more often. Choose the number of servers and see what it costs to stop installing them by hand.
50 servers: ≈ 215 installations a year from 2027 and ≈ 570 a year from 2029 that an administrator no longer does by hand.
Servers to automate
A server, load balancer, firewall or cloud service counts as one.
50 servers
|
100 active installation plans
Prices in EUR a year, excl. VAT.
| Capacity | ||||
| A server, load balancer, firewall or cloud service counts as one. | 5 | Up to 50 | Up to 50 | – |
| One certificate and the servers it is installed on. Certificates and issuances are at no extra charge, with a daily limit. | Up to 20 certificates a day from Let's Encrypt and 5 from Google. Orders above the limit wait in a queue and are issued automatically. | Up to 100 | Up to 100 | – |
| A domain is a registered domain such as company.com. www.company.com, mail.company.com and *.company.com all belong to company.com and count as one domain. | The CA's limits always apply. On top of that, we limit you to 100 SAN names per certificate and up to 2 different domains. | The CA's limits always apply. We set no limits on certificate content, for free and paid certificates alike. | The CA's limits always apply. We set no limits on certificate content, for free and paid certificates alike. | The CA's limits always apply. We set no limits on certificate content, for free and paid certificates alike. |
| Certificates | ||||
| Free DV certificates from Let's Encrypt. | Included | Included | Included | Included |
| Choose on a Let's Encrypt source which profile Let's Encrypt issues with: classic (90 days), tlsserver (45 days), shortlived (about 6 days) or the profiles Let's Encrypt adds. Free uses classic. | Not included | Included | Included | Included |
| Free DV certificates from Google Trust Services. | Included | Included | Included | Included |
| Choose on a Google Trust Services source in sslbrain Cloud how many days its certificates are valid, from 45 to 90. Without the choice they are issued with Google's default of 90 days. | Not included | Not included | Included | Included |
| A certificate covering every subdomain under a domain, such as *.example.com. | Included | Included | Included | Included |
| Order DV certificates from trusted CAs directly in sslbrain. FQDN and Wildcard. Requires SSL unit licenses. | Not included | € | € | € |
| Issue and auto-renew Danish VOCES, FOCES and MOCES certificates via MitID Erhverv. Enterprise add-on. | Not included | Not included | Not included | € |
| Use certificates from your Windows CA (AD CS) as a source. Enterprise add-on. | Not included | Not included | Not included | € |
| CA API & ACME features | ||||
| Use certbot, lego, simple-acme or cert-manager to order through acme.sslbrain.com with an EAB key. The clients order on the same certificate profiles and sources as in sslbrain Cloud, paid certificates billed in units included. Useful for external services, or suppliers that are not on your network. | Not included | Included | Included | Included |
| Issue from any ACME server reachable from the internet, such as ZeroSSL or DigiCert, with your account there. It is used as a source in your certificate profiles in sslbrain Cloud. | Not included | Not included | Included | Included |
| The appliance issues directly from an ACME server of your choice, such as a local ACME server on your own network. Free and Basic always get certificates through sslbrain Cloud. | Not included | Not included | Included | Included |
| Issue directly from your DigiCert CertCentral account via API, as a source in your certificate profiles in sslbrain Cloud. | Not included | Not included | Included | Included |
| A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails. | A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails. | A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails. | A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails. | A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails. |
| Issuance and automation | ||||
| A DNS CNAME delegation to an FQDN unique to your account, which can approve a whole domain with DigiCert, GeoTrust, Thawte and RapidSSL. For other CAs, one is created per name in the certificate. | Included | Included | Included | Included |
| Your account gets its own ACME account with each CA service, such as Let's Encrypt and Google, and uses that same account for every order there. | Included | Included | Included | Included |
| Put your DNS provider's API key in sslbrain Cloud (DNS access) or on the appliance. The sslbrain appliance creates the _acme-challenge record in your zone itself and removes it again, so no CNAME redirect is needed. Applies to certificates ordered through sslbrain Cloud and to ACME clients against sslbrain Cloud. The same DNS providers in both places. No separate licence. | Included | Included | Included | Included |
| Certificates are renewed automatically based on CA recommendation (ARI) or depending on certificate lifetime. No manual steps. | Included | Included | Included | Included |
| Scans your network and finds all certificates. Warns you before they expire. | Included | Included | Included | Included |
| The service agent on the Windows or Linux server fetches and installs the certificate itself (IIS, Apache, Nginx and more) without going over the internet. | Included | Included | Included | Included |
| The appliance installs on network devices and cloud services via API or SSH; nothing is installed on the device. | Included | Included | Included | Included |
| The service agent installs certificates on other servers and devices in its network via API or SSH, so the appliance does not need to reach them itself (relay). | Not included | Not included | Included | Included |
| For servers that cannot reach the appliance directly: the service agent connects via sslbrain Cloud (EU), encrypted all the way. Cloud can neither read nor change the messages. | Not included | Not included | Included | Included |
| Convert between certificate formats: PEM, DER, PFX/PKCS12, JKS (Java KeyStore). | Included | Included | Included | Included |
| Scan IP ranges and ports for certificates. Both local scanning from your sslbrain and online scanning via sslbrain Cloud. | Included | Included | Included | Included |
| Ready-made deployment scripts for IIS, Apache, Nginx, Exchange, F5, FortiGate, Cisco FDM, Kemp, NetScaler, PAN-OS and more, on every tier including Free. Written, signed and maintained by FairSSL. | Included | Included | Included | Included |
| Your own integrations install certificates on platforms the ready-made integrations do not cover. | Your own integration installs certificates on a platform the ready-made integrations do not cover. | Up to 3 of your own integrations for platforms the ready-made integrations do not cover. | No limit on the number of your own integrations. | No limit on the number of your own integrations. |
| Access and roles | ||||
| Sign in to sslbrain Cloud with Google, Microsoft or GitHub. No separate password to maintain. Available on every tier. | Included | Included | Included | Included |
| Number of concurrent logins to sslbrain. | Number of concurrent logins to sslbrain. | Number of concurrent logins to sslbrain. | Number of concurrent logins to sslbrain. | Number of concurrent logins to sslbrain. |
| Owner and Administrator come with every plan. | Not included | Not included | Included | Included |
| Log in with your existing AD/LDAP accounts. LDAP lookup for certificate matching. Also supports Kerberos. | Not included | Not included | Included | Included |
| Governance and NIS2 | ||||
| Every plan includes an audit log on the appliance. CSV or JSON export requires Professional or Enterprise. | Not included | Not included | Included | Included |
| Read status from your sslbrain into your monitoring system as JSON. | Not included | Status, certificate counts, service agents and recent installations as JSON from the appliance at /api/monitor with a token. For Zabbix, PRTG and Nagios. | Everything in the simple one, plus which certificates expire within 30 days and which service agents are offline. | Everything in the simple one, plus which certificates expire within 30 days and which service agents are offline. |
| Operations and infrastructure | ||||
| All data in sslbrain is encrypted on your server. Private keys, certificates and configuration never leave your machine. | Included | Included | Included | Included |
| sslbrain Cloud (EU) is hosted in the EU. The source code is on our own Git in the EU. Every sub-processor is listed at sslbrain.com/en/nis2/#sub-processors. | Included | Included | Included | Included |
| Allow cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com on port 443, using up to three IP addresses. No inbound ports from the internet. Other connections are listed under Security in the manual. | Included | Included | Included | Included |
| Define time windows when certificates may be renewed and installed, matching your operational schedule. | Not included | Not included | Included | Included |
| Service and guarantees | ||||
| Included support level. | Email us and we answer when we can. There is no guaranteed response time. | Email our team. We respond within 2 business days. | Priority email support. We respond by next business day. | Direct phone support and priority email with a dedicated contact for your organization. |
| Guaranteed per calendar month. Below 99.9% you get 10% of the month's price as a credit, below 99% 25%, on the next invoice. Measured externally by HetrixTools. Free and Basic have no uptime guarantee. | Not included | Not included | Included | Included |
| The guarantee covers the first purchase of a licence, annual or monthly: 30 days, or 90 days for an annual Enterprise licence. Email us within that period and we cancel the licence and release the authorisation or refund the payment. After that, monthly licences can be cancelled at any time. | The guarantee covers the first purchase of a licence, annual or monthly: 30 days, or 90 days for an annual Enterprise licence. Email us within that period and we cancel the licence and release the authorisation or refund the payment. After that, monthly licences can be cancelled at any time. | The guarantee covers the first purchase of a licence, annual or monthly. Email us within 30 days of the first order and we cancel the licence and release the authorisation or refund the payment. Used certificate units are non-refundable. After that, monthly licences can be cancelled at any time. | The guarantee covers the first purchase of a licence, annual or monthly. Email us within 30 days of the first order and we cancel the licence and release the authorisation or refund the payment. Used certificate units are non-refundable. After that, monthly licences can be cancelled at any time. | The guarantee covers the first purchase of an annual Enterprise licence; a monthly one has 30 days. Email us within 90 days and we cancel the licence and release the authorisation or refund the payment. Used certificate units are non-refundable. After that, monthly licences can be cancelled at any time. |
| Help with setup and first configuration, billed for the time used. | Not included | € | € | € |
| Guaranteed response times and dedicated support resources for your organization. | Not included | Not included | Not included | € |
Free
€0
Certificates for 5 servers.
- One certificate and the servers it is installed on. Certificates and issuances are at no extra charge, with a daily limit. Up to 20 certificates a day from Let's Encrypt and 5 from Google. Orders above the limit wait in a queue and are issued automatically.
- Included 100 SANs / 2 domains. The CA's limits always apply. On top of that, we limit you to 100 SAN names per certificate and up to 2 different domains.
- Included Free DV certificates from Let's Encrypt.
- Not included Choose on a Let's Encrypt source which profile Let's Encrypt issues with: classic (90 days), tlsserver (45 days), shortlived (about 6 days) or the profiles Let's Encrypt adds. Free uses classic.
- Included Free DV certificates from Google Trust Services.
- Not included Choose on a Google Trust Services source in sslbrain Cloud how many days its certificates are valid, from 45 to 90. Without the choice they are issued with Google's default of 90 days.
- Included A certificate covering every subdomain under a domain, such as *.example.com.
- Not included Order DV certificates from trusted CAs directly in sslbrain. FQDN and Wildcard. Requires SSL unit licenses.
- Not included Issue and auto-renew Danish VOCES, FOCES and MOCES certificates via MitID Erhverv. Enterprise add-on.
- Not included Use certificates from your Windows CA (AD CS) as a source. Enterprise add-on.
- Not included Use certbot, lego, simple-acme or cert-manager to order through acme.sslbrain.com with an EAB key. The clients order on the same certificate profiles and sources as in sslbrain Cloud, paid certificates billed in units included. Useful for external services, or suppliers that are not on your network.
- Not included Issue from any ACME server reachable from the internet, such as ZeroSSL or DigiCert, with your account there. It is used as a source in your certificate profiles in sslbrain Cloud.
- Not included The appliance issues directly from an ACME server of your choice, such as a local ACME server on your own network. Free and Basic always get certificates through sslbrain Cloud.
- Not included Issue directly from your DigiCert CertCentral account via API, as a source in your certificate profiles in sslbrain Cloud.
- Included 1 profile. A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails.
- Included A DNS CNAME delegation to an FQDN unique to your account, which can approve a whole domain with DigiCert, GeoTrust, Thawte and RapidSSL. For other CAs, one is created per name in the certificate.
- Included Your account gets its own ACME account with each CA service, such as Let's Encrypt and Google, and uses that same account for every order there.
- Included Put your DNS provider's API key in sslbrain Cloud (DNS access) or on the appliance. The sslbrain appliance creates the _acme-challenge record in your zone itself and removes it again, so no CNAME redirect is needed. Applies to certificates ordered through sslbrain Cloud and to ACME clients against sslbrain Cloud. The same DNS providers in both places. No separate licence.
- Included Certificates are renewed automatically based on CA recommendation (ARI) or depending on certificate lifetime. No manual steps.
- Included Scans your network and finds all certificates. Warns you before they expire.
- Included The service agent on the Windows or Linux server fetches and installs the certificate itself (IIS, Apache, Nginx and more) without going over the internet.
- Included The appliance installs on network devices and cloud services via API or SSH; nothing is installed on the device.
- Not included The service agent installs certificates on other servers and devices in its network via API or SSH, so the appliance does not need to reach them itself (relay).
- Not included For servers that cannot reach the appliance directly: the service agent connects via sslbrain Cloud (EU), encrypted all the way. Cloud can neither read nor change the messages.
- Included Convert between certificate formats: PEM, DER, PFX/PKCS12, JKS (Java KeyStore).
- Included Scan IP ranges and ports for certificates. Both local scanning from your sslbrain and online scanning via sslbrain Cloud.
- Included Ready-made deployment scripts for IIS, Apache, Nginx, Exchange, F5, FortiGate, Cisco FDM, Kemp, NetScaler, PAN-OS and more, on every tier including Free. Written, signed and maintained by FairSSL.
- Included 1 own integration. Your own integration installs certificates on a platform the ready-made integrations do not cover.
- Included Sign in to sslbrain Cloud with Google, Microsoft or GitHub. No separate password to maintain. Available on every tier.
- Included 1 user. Number of concurrent logins to sslbrain.
- Not included Owner and Administrator come with every plan.
- Not included Log in with your existing AD/LDAP accounts. LDAP lookup for certificate matching. Also supports Kerberos.
- Not included Every plan includes an audit log on the appliance. CSV or JSON export requires Professional or Enterprise.
- Included All data in sslbrain is encrypted on your server. Private keys, certificates and configuration never leave your machine.
- Included sslbrain Cloud (EU) is hosted in the EU. The source code is on our own Git in the EU. Every sub-processor is listed at sslbrain.com/en/nis2/#sub-processors.
- Included Allow cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com on port 443, using up to three IP addresses. No inbound ports from the internet. Other connections are listed under Security in the manual.
- Not included Define time windows when certificates may be renewed and installed, matching your operational schedule.
- Included Email. Email us and we answer when we can. There is no guaranteed response time.
- Not included Guaranteed per calendar month. Below 99.9% you get 10% of the month's price as a credit, below 99% 25%, on the next invoice. Measured externally by HetrixTools. Free and Basic have no uptime guarantee.
- Included –. The guarantee covers the first purchase of a licence, annual or monthly: 30 days, or 90 days for an annual Enterprise licence. Email us within that period and we cancel the licence and release the authorisation or refund the payment. After that, monthly licences can be cancelled at any time.
- Not included Help with setup and first configuration, billed for the time used.
- Not included Guaranteed response times and dedicated support resources for your organization.
Basic
€2.990 /yr
Excl. VAT
Replace your scripts.
- One certificate and the servers it is installed on. Certificates and issuances are at no extra charge, with a daily limit.
- Included ∞ SANs / ∞ domains. The CA's limits always apply. We set no limits on certificate content, for free and paid certificates alike.
- Included Free DV certificates from Let's Encrypt.
- Included Choose on a Let's Encrypt source which profile Let's Encrypt issues with: classic (90 days), tlsserver (45 days), shortlived (about 6 days) or the profiles Let's Encrypt adds. Free uses classic.
- Included Free DV certificates from Google Trust Services.
- Not included Choose on a Google Trust Services source in sslbrain Cloud how many days its certificates are valid, from 45 to 90. Without the choice they are issued with Google's default of 90 days.
- Included A certificate covering every subdomain under a domain, such as *.example.com.
- € Order DV certificates from trusted CAs directly in sslbrain. FQDN and Wildcard. Requires SSL unit licenses.
- Not included Issue and auto-renew Danish VOCES, FOCES and MOCES certificates via MitID Erhverv. Enterprise add-on.
- Not included Use certificates from your Windows CA (AD CS) as a source. Enterprise add-on.
- Included Use certbot, lego, simple-acme or cert-manager to order through acme.sslbrain.com with an EAB key. The clients order on the same certificate profiles and sources as in sslbrain Cloud, paid certificates billed in units included. Useful for external services, or suppliers that are not on your network.
- Not included Issue from any ACME server reachable from the internet, such as ZeroSSL or DigiCert, with your account there. It is used as a source in your certificate profiles in sslbrain Cloud.
- Not included The appliance issues directly from an ACME server of your choice, such as a local ACME server on your own network. Free and Basic always get certificates through sslbrain Cloud.
- Not included Issue directly from your DigiCert CertCentral account via API, as a source in your certificate profiles in sslbrain Cloud.
- Included 3 profiles. A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails.
- Included A DNS CNAME delegation to an FQDN unique to your account, which can approve a whole domain with DigiCert, GeoTrust, Thawte and RapidSSL. For other CAs, one is created per name in the certificate.
- Included Your account gets its own ACME account with each CA service, such as Let's Encrypt and Google, and uses that same account for every order there.
- Included Put your DNS provider's API key in sslbrain Cloud (DNS access) or on the appliance. The sslbrain appliance creates the _acme-challenge record in your zone itself and removes it again, so no CNAME redirect is needed. Applies to certificates ordered through sslbrain Cloud and to ACME clients against sslbrain Cloud. The same DNS providers in both places. No separate licence.
- Included Certificates are renewed automatically based on CA recommendation (ARI) or depending on certificate lifetime. No manual steps.
- Included Scans your network and finds all certificates. Warns you before they expire.
- Included The service agent on the Windows or Linux server fetches and installs the certificate itself (IIS, Apache, Nginx and more) without going over the internet.
- Included The appliance installs on network devices and cloud services via API or SSH; nothing is installed on the device.
- Not included The service agent installs certificates on other servers and devices in its network via API or SSH, so the appliance does not need to reach them itself (relay).
- Not included For servers that cannot reach the appliance directly: the service agent connects via sslbrain Cloud (EU), encrypted all the way. Cloud can neither read nor change the messages.
- Included Convert between certificate formats: PEM, DER, PFX/PKCS12, JKS (Java KeyStore).
- Included Scan IP ranges and ports for certificates. Both local scanning from your sslbrain and online scanning via sslbrain Cloud.
- Included Ready-made deployment scripts for IIS, Apache, Nginx, Exchange, F5, FortiGate, Cisco FDM, Kemp, NetScaler, PAN-OS and more, on every tier including Free. Written, signed and maintained by FairSSL.
- Included 3 own integrations. Up to 3 of your own integrations for platforms the ready-made integrations do not cover.
- Included Sign in to sslbrain Cloud with Google, Microsoft or GitHub. No separate password to maintain. Available on every tier.
- Included 3 users. Number of concurrent logins to sslbrain.
- Not included Owner and Administrator come with every plan.
- Not included Log in with your existing AD/LDAP accounts. LDAP lookup for certificate matching. Also supports Kerberos.
- Not included Every plan includes an audit log on the appliance. CSV or JSON export requires Professional or Enterprise.
- Included Simple. Status, certificate counts, service agents and recent installations as JSON from the appliance at /api/monitor with a token. For Zabbix, PRTG and Nagios.
- Included All data in sslbrain is encrypted on your server. Private keys, certificates and configuration never leave your machine.
- Included sslbrain Cloud (EU) is hosted in the EU. The source code is on our own Git in the EU. Every sub-processor is listed at sslbrain.com/en/nis2/#sub-processors.
- Included Allow cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com on port 443, using up to three IP addresses. No inbound ports from the internet. Other connections are listed under Security in the manual.
- Not included Define time windows when certificates may be renewed and installed, matching your operational schedule.
- Included Email. Email our team. We respond within 2 business days.
- Not included Guaranteed per calendar month. Below 99.9% you get 10% of the month's price as a credit, below 99% 25%, on the next invoice. Measured externally by HetrixTools. Free and Basic have no uptime guarantee.
- Included 30-day refund. The guarantee covers the first purchase of a licence, annual or monthly. Email us within 30 days of the first order and we cancel the licence and release the authorisation or refund the payment. Used certificate units are non-refundable. After that, monthly licences can be cancelled at any time.
- € Help with setup and first configuration, billed for the time used.
- Not included Guaranteed response times and dedicated support resources for your organization.
Recommended
Professional
€4.990 /yr
Excl. VAT
Make it auditable.
- One certificate and the servers it is installed on. Certificates and issuances are at no extra charge, with a daily limit.
- Included ∞ SANs / ∞ domains. The CA's limits always apply. We set no limits on certificate content, for free and paid certificates alike.
- Included Free DV certificates from Let's Encrypt.
- Included Choose on a Let's Encrypt source which profile Let's Encrypt issues with: classic (90 days), tlsserver (45 days), shortlived (about 6 days) or the profiles Let's Encrypt adds. Free uses classic.
- Included Free DV certificates from Google Trust Services.
- Included Choose on a Google Trust Services source in sslbrain Cloud how many days its certificates are valid, from 45 to 90. Without the choice they are issued with Google's default of 90 days.
- Included A certificate covering every subdomain under a domain, such as *.example.com.
- € Order DV certificates from trusted CAs directly in sslbrain. FQDN and Wildcard. Requires SSL unit licenses.
- Not included Issue and auto-renew Danish VOCES, FOCES and MOCES certificates via MitID Erhverv. Enterprise add-on.
- Not included Use certificates from your Windows CA (AD CS) as a source. Enterprise add-on.
- Included Use certbot, lego, simple-acme or cert-manager to order through acme.sslbrain.com with an EAB key. The clients order on the same certificate profiles and sources as in sslbrain Cloud, paid certificates billed in units included. Useful for external services, or suppliers that are not on your network.
- Included Issue from any ACME server reachable from the internet, such as ZeroSSL or DigiCert, with your account there. It is used as a source in your certificate profiles in sslbrain Cloud.
- Included The appliance issues directly from an ACME server of your choice, such as a local ACME server on your own network. Free and Basic always get certificates through sslbrain Cloud.
- Included Issue directly from your DigiCert CertCentral account via API, as a source in your certificate profiles in sslbrain Cloud.
- Included At no extra charge. A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails.
- Included A DNS CNAME delegation to an FQDN unique to your account, which can approve a whole domain with DigiCert, GeoTrust, Thawte and RapidSSL. For other CAs, one is created per name in the certificate.
- Included Your account gets its own ACME account with each CA service, such as Let's Encrypt and Google, and uses that same account for every order there.
- Included Put your DNS provider's API key in sslbrain Cloud (DNS access) or on the appliance. The sslbrain appliance creates the _acme-challenge record in your zone itself and removes it again, so no CNAME redirect is needed. Applies to certificates ordered through sslbrain Cloud and to ACME clients against sslbrain Cloud. The same DNS providers in both places. No separate licence.
- Included Certificates are renewed automatically based on CA recommendation (ARI) or depending on certificate lifetime. No manual steps.
- Included Scans your network and finds all certificates. Warns you before they expire.
- Included The service agent on the Windows or Linux server fetches and installs the certificate itself (IIS, Apache, Nginx and more) without going over the internet.
- Included The appliance installs on network devices and cloud services via API or SSH; nothing is installed on the device.
- Included The service agent installs certificates on other servers and devices in its network via API or SSH, so the appliance does not need to reach them itself (relay).
- Included For servers that cannot reach the appliance directly: the service agent connects via sslbrain Cloud (EU), encrypted all the way. Cloud can neither read nor change the messages.
- Included Convert between certificate formats: PEM, DER, PFX/PKCS12, JKS (Java KeyStore).
- Included Scan IP ranges and ports for certificates. Both local scanning from your sslbrain and online scanning via sslbrain Cloud.
- Included Ready-made deployment scripts for IIS, Apache, Nginx, Exchange, F5, FortiGate, Cisco FDM, Kemp, NetScaler, PAN-OS and more, on every tier including Free. Written, signed and maintained by FairSSL.
- Included At no extra charge. No limit on the number of your own integrations.
- Included Sign in to sslbrain Cloud with Google, Microsoft or GitHub. No separate password to maintain. Available on every tier.
- Included 10 users (RBAC). Number of concurrent logins to sslbrain.
- Included Owner and Administrator come with every plan.
- Included Log in with your existing AD/LDAP accounts. LDAP lookup for certificate matching. Also supports Kerberos.
- Included Every plan includes an audit log on the appliance. CSV or JSON export requires Professional or Enterprise.
- Included Detailed. Everything in the simple one, plus which certificates expire within 30 days and which service agents are offline.
- Included All data in sslbrain is encrypted on your server. Private keys, certificates and configuration never leave your machine.
- Included sslbrain Cloud (EU) is hosted in the EU. The source code is on our own Git in the EU. Every sub-processor is listed at sslbrain.com/en/nis2/#sub-processors.
- Included Allow cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com on port 443, using up to three IP addresses. No inbound ports from the internet. Other connections are listed under Security in the manual.
- Included Define time windows when certificates may be renewed and installed, matching your operational schedule.
- Included Priority email. Priority email support. We respond by next business day.
- Included Guaranteed per calendar month. Below 99.9% you get 10% of the month's price as a credit, below 99% 25%, on the next invoice. Measured externally by HetrixTools. Free and Basic have no uptime guarantee.
- Included 30-day refund. The guarantee covers the first purchase of a licence, annual or monthly. Email us within 30 days of the first order and we cancel the licence and release the authorisation or refund the payment. Used certificate units are non-refundable. After that, monthly licences can be cancelled at any time.
- € Help with setup and first configuration, billed for the time used.
- Not included Guaranteed response times and dedicated support resources for your organization.
Enterprise
–
From 100 servers
Excl. VAT
Enterprise setups.
- One certificate and the servers it is installed on. Certificates and issuances are at no extra charge, with a daily limit.
- Included ∞ SANs / ∞ domains. The CA's limits always apply. We set no limits on certificate content, for free and paid certificates alike.
- Included Free DV certificates from Let's Encrypt.
- Included Choose on a Let's Encrypt source which profile Let's Encrypt issues with: classic (90 days), tlsserver (45 days), shortlived (about 6 days) or the profiles Let's Encrypt adds. Free uses classic.
- Included Free DV certificates from Google Trust Services.
- Included Choose on a Google Trust Services source in sslbrain Cloud how many days its certificates are valid, from 45 to 90. Without the choice they are issued with Google's default of 90 days.
- Included A certificate covering every subdomain under a domain, such as *.example.com.
- € Order DV certificates from trusted CAs directly in sslbrain. FQDN and Wildcard. Requires SSL unit licenses.
- € Issue and auto-renew Danish VOCES, FOCES and MOCES certificates via MitID Erhverv. Enterprise add-on.
- € Use certificates from your Windows CA (AD CS) as a source. Enterprise add-on.
- Included Use certbot, lego, simple-acme or cert-manager to order through acme.sslbrain.com with an EAB key. The clients order on the same certificate profiles and sources as in sslbrain Cloud, paid certificates billed in units included. Useful for external services, or suppliers that are not on your network.
- Included Issue from any ACME server reachable from the internet, such as ZeroSSL or DigiCert, with your account there. It is used as a source in your certificate profiles in sslbrain Cloud.
- Included The appliance issues directly from an ACME server of your choice, such as a local ACME server on your own network. Free and Basic always get certificates through sslbrain Cloud.
- Included Issue directly from your DigiCert CertCentral account via API, as a source in your certificate profiles in sslbrain Cloud.
- Included At no extra charge. A certificate profile picks which CA sources a certificate comes from, and in which order. Your appliances and ACME clients order on it. Free has one, which sslbrain maintains: Let's Encrypt first, and Google Trust Services if Let's Encrypt fails.
- Included A DNS CNAME delegation to an FQDN unique to your account, which can approve a whole domain with DigiCert, GeoTrust, Thawte and RapidSSL. For other CAs, one is created per name in the certificate.
- Included Your account gets its own ACME account with each CA service, such as Let's Encrypt and Google, and uses that same account for every order there.
- Included Put your DNS provider's API key in sslbrain Cloud (DNS access) or on the appliance. The sslbrain appliance creates the _acme-challenge record in your zone itself and removes it again, so no CNAME redirect is needed. Applies to certificates ordered through sslbrain Cloud and to ACME clients against sslbrain Cloud. The same DNS providers in both places. No separate licence.
- Included Certificates are renewed automatically based on CA recommendation (ARI) or depending on certificate lifetime. No manual steps.
- Included Scans your network and finds all certificates. Warns you before they expire.
- Included The service agent on the Windows or Linux server fetches and installs the certificate itself (IIS, Apache, Nginx and more) without going over the internet.
- Included The appliance installs on network devices and cloud services via API or SSH; nothing is installed on the device.
- Included The service agent installs certificates on other servers and devices in its network via API or SSH, so the appliance does not need to reach them itself (relay).
- Included For servers that cannot reach the appliance directly: the service agent connects via sslbrain Cloud (EU), encrypted all the way. Cloud can neither read nor change the messages.
- Included Convert between certificate formats: PEM, DER, PFX/PKCS12, JKS (Java KeyStore).
- Included Scan IP ranges and ports for certificates. Both local scanning from your sslbrain and online scanning via sslbrain Cloud.
- Included Ready-made deployment scripts for IIS, Apache, Nginx, Exchange, F5, FortiGate, Cisco FDM, Kemp, NetScaler, PAN-OS and more, on every tier including Free. Written, signed and maintained by FairSSL.
- Included At no extra charge. No limit on the number of your own integrations.
- Included Sign in to sslbrain Cloud with Google, Microsoft or GitHub. No separate password to maintain. Available on every tier.
- Included At no extra charge. Number of concurrent logins to sslbrain.
- Included Owner and Administrator come with every plan.
- Included Log in with your existing AD/LDAP accounts. LDAP lookup for certificate matching. Also supports Kerberos.
- Included Every plan includes an audit log on the appliance. CSV or JSON export requires Professional or Enterprise.
- Included Detailed. Everything in the simple one, plus which certificates expire within 30 days and which service agents are offline.
- Included All data in sslbrain is encrypted on your server. Private keys, certificates and configuration never leave your machine.
- Included sslbrain Cloud (EU) is hosted in the EU. The source code is on our own Git in the EU. Every sub-processor is listed at sslbrain.com/en/nis2/#sub-processors.
- Included Allow cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com on port 443, using up to three IP addresses. No inbound ports from the internet. Other connections are listed under Security in the manual.
- Included Define time windows when certificates may be renewed and installed, matching your operational schedule.
- Included Phone and email. Direct phone support and priority email with a dedicated contact for your organization.
- Included Guaranteed per calendar month. Below 99.9% you get 10% of the month's price as a credit, below 99% 25%, on the next invoice. Measured externally by HetrixTools. Free and Basic have no uptime guarantee.
- Included 90-day refund. The guarantee covers the first purchase of an annual Enterprise licence; a monthly one has 30 days. Email us within 90 days and we cancel the licence and release the authorisation or refund the payment. Used certificate units are non-refundable. After that, monthly licences can be cancelled at any time.
- € Help with setup and first configuration, billed for the time used.
- € Guaranteed response times and dedicated support resources for your organization.
Every price is on this page, excluding VAT. More than 1,000 servers? Write to us.
-
Visa, Mastercard, American Express - IBAN
-
Bankgiro - FIK
-
Peppol -
NemHandel - PDF by e-mail
All prices excl. VAT. Pay yearly by card or bank transfer. Monthly payment by card costs 20% more per year. No lock-in period.
Add-ons
Price a year. The price follows the size of the licence, that is its number of servers.
| Add-on | Applies to | 50 | 100 | 250 | 500 | 1,000 |
|---|---|---|---|---|---|---|
| Windows CA | Add-on for Enterprise | – | €1.990 | €3.290 | €4.990 | – |
| Local ACME server | Add-on for Enterprise | – | €1.490 | €2.590 | €3.990 | – |
| HA (high availability) | Add-on for Enterprise | – | €4.490 | €6.290 | €8.790 | €12.490 |
| MitID Erhverv | Add-on for Enterprise | – | €1.990 | €1.990 | €1.990 | €1.990 |
MitID Erhverv: 10 certificates included, then €149 per certificate.
The columns are the licence's number of servers. All prices excl. VAT.
Add-ons are arranged with us and are not yet part of the purchase in sslbrain Cloud. The comparison above shows what each plan includes today.
Download, deploy, done
Download for free. Install in under a minute. Use it for free on up to 5 servers. Need more? Upgrade your licence. The first purchase of a licence has a 30-day right of return, including monthly licences (annual Enterprise: 90 days). Email us within that period and we cancel the licence and release the authorisation or refund the payment. Unused certificate units are also refunded. After that, monthly licences can be cancelled at any time.
From 1 to 12 certificate changes a year
Certificate lifetimes are dropping from 397 days (2025) to 47 days (2029). Renewed 15 days before expiry, each certificate has to be replaced about 11 times a year instead of once, on every server that uses it. The sslbrain appliance does it automatically. The price is per server, not per certificate or renewal.
Skip the sales call
You don't need to tell us how many servers you have, or what your budget is, to see the price. It's right here. You don't need a demo to try it. It's free. You don't need to commit to a licence count. Upgrade when you're ready. The sslbrain product is for engineers and consultants who want to install and get going.
Support & add-ons
Cloud uptime guarantee
99.9% uptime per calendar month on sslbrain Cloud (license, vault unlock, AutoDNS, ACME server). Below 99.9% you get 10% of the month's price as a credit, below 99% 25%, on the next invoice. The appliance and installed certificates keep running. Renewals that need Cloud wait and resume when Cloud returns. They start well before expiry. When sslbrain Cloud is down
Measured externally by HetrixTools: sslbrain since 29-10-2026, FairSSL since March 2026
Professional and Enterprise
Professional services
Direct access to the sslbrain development team for deployment planning, architecture review and integration assistance.
Onboarding
Help with the first setup, CA configuration, servers and the first automated certificate. Billed for the time used, on every paid plan.
Professional and Enterprise
Enterprise Support & SLA
Guaranteed email response times, dedicated account manager, and priority issue handling. Available for Professional and Enterprise.
Professional and Enterprise
Commercial SSL Certificates
Commercial DV certificates are bought in sslbrain Cloud and paid in units. The price depends on the number of names and wildcards, not on the CA.
One name (FQDN) 1 unit · One wildcard 3 units · Certificate with several names (SAN) +1 unit
| Units | Discount |
|---|---|
| 1–9 | – |
| 10–24 | 5 % |
| 25–49 | 10 % |
| 50–99 | 15 % |
| 100+ | 25 % |
€29 per unit excl. VAT, the same for every CA. The discount covers the whole purchase, and the total is rounded to whole currency units. www.<name> and the base domain beside a wildcard are free.
+20 % units when the domain can only be validated with DigiCert’s persistent TXT record. AutoDNS (CNAME) removes the surcharge.
On the roadmap
We don't promise dates. These are features we already have concrete designs for, scheduled for the next development cycles. Vote for what matters most to you.
SAML/OIDC SSO
Sign in via Entra ID, Okta, Ping Identity beyond Active Directory/LDAP.
Thanks. Your vote is recorded.
We couldn't record your vote. Please try again.
More notification channels
Slack, Microsoft Teams, webhooks in addition to email.
Thanks. Your vote is recorded.
We couldn't record your vote. Please try again.
Local SMTP server
Send notifications via your own SMTP server, not via FairSSL.
Thanks. Your vote is recorded.
We couldn't record your vote. Please try again.
REST API
Programmatic access to certificates, integrations, and audit log.
Thanks. Your vote is recorded.
We couldn't record your vote. Please try again.
CT log monitoring
Get alerted on unexpected certificate issuance for your domains.
Thanks. Your vote is recorded.
We couldn't record your vote. Please try again.
Audit log to SIEM/syslog
Real-time stream of lifecycle events to Splunk, Sentinel, or any SIEM.
Thanks. Your vote is recorded.
We couldn't record your vote. Please try again.
Bring your own commercial CA
Add your own direct CA contract on top of the ones already supported.
Thanks. Your vote is recorded.
We couldn't record your vote. Please try again.
Create free account
Free costs nothing and needs no credit card. You choose your edition once the account exists.
Frequently asked questions
Do the certificates cost anything?
Free certificates from Let's Encrypt and Google Trust Services are included in all licences, wildcards too, within the licence's installation plans and domains. Commercial certificates from DigiCert, Sectigo and GlobalSign cost extra via unit packages (see table above).
How does billing and cancellation work?
Licences are paid yearly by card or bank transfer, or monthly by card. You can switch automatic renewal off yourself, and the licence runs to the end of its period. The first purchase of a licence has a 30-day right of return from the first order, including monthly licences (annual Enterprise: 90 days).
Is the Free plan really free?
Yes. Free covers 5 servers, 10 installation plans and up to 2 domains with free certificates from Let's Encrypt and Google, and 1 user. The 10 plans cover every certificate the appliance manages, from Cloud, upload and self-signed; the appliance's own certificate does not count. Free costs nothing and needs no credit card.
What certificate authorities are included?
All plans support Let's Encrypt and Google Trust Services, both of which issue free DV certificates. Paid plans can also buy commercial DV certificates in sslbrain Cloud, paid in units.
Can I use ACME directly with Let's Encrypt?
Yes, on Professional and Enterprise: the appliance can speak ACME directly with any ACME server, such as an internal CA, Let's Encrypt or Google. Free and Basic get certificates through sslbrain Cloud, which adds AutoDNS and automatic failover between CAs. The certificates count against the same limits either way.
Does sslbrain phone home?
Private keys, local passwords, server credentials and vault contents stay on the appliance. Cloud cannot connect into it. Cloud receives heartbeats with disk usage and server counts, usage reports without hostnames, names on certificates ordered through Cloud and sign-ins through Cloud. The full list is under Security in the manual.
What are your own integrations?
An integration is the package that installs certificates on one type of service or device. Every integration in the catalogue is written, signed and maintained by FairSSL and is included on every plan. With your own integration you write the installation for a platform or application the ready-made integrations do not cover.
What happens if my subscription expires?
Your sslbrain automatically switches to the free Free tier without any action required. Already-issued certificates continue to work until they expire, and configured ACME clients on your servers keep working as normal. The sslbrain appliance runs only the number of servers and domains the Free tier allows, and servers beyond that stop renewing certificates. You receive warnings by email.
Can we upgrade or stop the licence along the way?
Yes. You can upgrade to more servers or a higher tier in Cloud during the period and pay only the difference for the rest of the period you have already paid for. The amount is shown before you accept, and the new licence applies once the payment is confirmed. You can switch automatic renewal off yourself; the licence then runs to the end of its period. An order not yet paid can be cancelled during the trial if there is no usage to settle, such as paid certificates. Cancelling after payment goes through support.
What if my paid SSL licenses run out or expire?
If your paid SSL licenses run out or expire, we automatically continue with free certificates, unless you have configured otherwise.
Why per server and not per certificate?
We provide free certificates and commercial certificates at our cost price. To keep pricing fair, we base it on the number of servers rather than the number of certificates. That means a server with 10-40 different certificates costs the same as one with a single certificate. For us that makes sense, and for you it means no surprises when you add more certificates.