Start free

Free covers 5 endpoints and 10 certificate plans for free, with unlimited renewals of certificates from Let's Encrypt and Google. You only pay when you need more.

Endpoints to automate

50 endpoints
100 active certificate plans

Free

Free

Automate 5 endpoints and 10 certificate plans for free

  • On 1 base domain
  • Let's Encrypt (free)
  • Google Trust Services (free)
  • Wildcard certificates (unlimited)
  • Paid DV certificates
  • Pre-validated OV/EV
  • MitID Erhverv certificates (add-on)
  • 10 cert/h
  • Auto-DNS validation
  • Persistent ACME account per domain
  • Apex Auto DNS
  • Built-in ACME proxy
  • Automatic renewal
  • Certificate discovery and monitoring
  • Automatic installation
  • Certificate tools (PEM, DER, PFX, JKS)
  • TLS/SSL port scanning, local and online
  • All FairSSL + community agents
  • 1 custom agent
  • Direct CA reseller account (€)
  • Custom ACME destination (add-on)
  • Local ACME server (add-on)
  • Windows CA certificates (€)
  • OAuth login (Google, Microsoft, GitHub)
  • 1 user
  • AD/LDAP login and lookup
  • Audit log with export
  • NIS2 evidence bundle
  • Policy enforcement
  • All data encrypted locally
  • EU-owned operations
  • Fixed outbound IPs
  • Scheduled maintenance windows
  • Offline operation (add-on)
  • HA nodes (add-on)
  • No support
  • 99.9% Cloud uptime guarantee
  • —
  • Optional one-time onboarding
  • Enterprise Support & SLA (add-on)
Join the list

Basic

€2.400 −20%
€1.920 /yr

€160/mo

Excl. VAT

Replace your scripts.

  • Unlimited renewals and reissues
  • Let's Encrypt (free)
  • Google Trust Services (free)
  • Wildcard certificates (unlimited)
  • € Paid DV certificates
  • Pre-validated OV/EV
  • MitID Erhverv certificates (add-on)
  • 50 cert/h
  • Auto-DNS validation
  • Persistent ACME account per domain
  • Apex Auto DNS
  • Built-in ACME proxy
  • Automatic renewal
  • Certificate discovery and monitoring
  • Automatic installation
  • Certificate tools (PEM, DER, PFX, JKS)
  • TLS/SSL port scanning, local and online
  • All FairSSL + community agents
  • 3 custom agents
  • Direct CA reseller account (€)
  • Custom ACME destination (add-on)
  • Local ACME server (add-on)
  • Windows CA certificates (€)
  • OAuth login (Google, Microsoft, GitHub)
  • 3 users
  • AD/LDAP login and lookup
  • Audit log with export
  • NIS2 evidence bundle
  • Policy enforcement
  • Monitoring API (simple)
  • All data encrypted locally
  • EU-owned operations
  • Fixed outbound IPs
  • Scheduled maintenance windows
  • Offline operation (add-on)
  • HA nodes (add-on)
  • Email
  • 99.9% Cloud uptime guarantee
  • 30 days, money back
  • Optional one-time onboarding
  • Enterprise Support & SLA (add-on)
Get early access
Recommended

Professional

€4.800 −20%
€3.840 /yr

€320/mo

Excl. VAT

Make it auditable.

  • Unlimited renewals and reissues
  • Let's Encrypt (free)
  • Google Trust Services (free)
  • Wildcard certificates (unlimited)
  • € Paid DV certificates
  • € Pre-validated OV/EV
  • € MitID Erhverv certificates (add-on)
  • 150 cert/h
  • Auto-DNS validation
  • Persistent ACME account per domain
  • Apex Auto DNS
  • Built-in ACME proxy
  • Automatic renewal
  • Certificate discovery and monitoring
  • Automatic installation
  • Certificate tools (PEM, DER, PFX, JKS)
  • TLS/SSL port scanning, local and online
  • All FairSSL + community agents
  • Unlimited custom agents
  • € Direct CA reseller account (€)
  • € Custom ACME destination (add-on)
  • Local ACME server (add-on)
  • Windows CA certificates (€)
  • OAuth login (Google, Microsoft, GitHub)
  • 10 users (RBAC)
  • AD/LDAP login and lookup
  • Audit log with export
  • NIS2 evidence bundle
  • Policy enforcement
  • Monitoring API (detailed)
  • All data encrypted locally
  • EU-owned operations
  • Fixed outbound IPs
  • Scheduled maintenance windows
  • Offline operation (add-on)
  • HA nodes (add-on)
  • Priority email
  • 99.9% Cloud uptime guarantee
  • 30 days, money back
  • € Optional one-time onboarding
  • Enterprise Support & SLA (add-on)
Get early access

Enterprise

€18.000 −20%
€14.400 /yr

€1200/mo

Excl. VAT

Enterprise setups.

  • Unlimited renewals and reissues
  • Let's Encrypt (free)
  • Google Trust Services (free)
  • Wildcard certificates (unlimited)
  • € Paid DV certificates
  • € Pre-validated OV/EV
  • € MitID Erhverv certificates (add-on)
  • 200 cert/h
  • Auto-DNS validation
  • Persistent ACME account per domain
  • Apex Auto DNS
  • Built-in ACME proxy
  • Automatic renewal
  • Certificate discovery and monitoring
  • Automatic installation
  • Certificate tools (PEM, DER, PFX, JKS)
  • TLS/SSL port scanning, local and online
  • All FairSSL + community agents
  • Unlimited custom agents
  • € Direct CA reseller account (€)
  • € Custom ACME destination (add-on)
  • € Local ACME server (add-on)
  • € Windows CA certificates (€)
  • OAuth login (Google, Microsoft, GitHub)
  • Unlimited users
  • AD/LDAP login and lookup
  • Audit log with export
  • NIS2 evidence bundle
  • Policy enforcement
  • Monitoring API (detailed)
  • All data encrypted locally
  • EU-owned operations
  • Fixed outbound IPs
  • Scheduled maintenance windows
  • € Offline operation (add-on)
  • € HA nodes (add-on)
  • Phone + priority email
  • 99.9% Cloud uptime guarantee
  • 90 days, money back
  • € Optional one-time onboarding
  • € Enterprise Support & SLA (add-on)
Get early access

All prices excl. VAT. Annual billing. No lock-in period.

Download, deploy, done

Download for free. Install in under a minute. Use it with up to 5 servers for as long as you want. Need more? Upgrade your licence. Not happy? Full refund on the paid licence within 30 days (Enterprise: 90 days). Unused certificate units and support hours are also refunded.

From 1 to 12 installs per year

Certificate lifetimes are dropping from 397 days (2025) to 47 days (2029). With best practice renewal at 1/3 of lifetime, that means 12 installations per year per certificate instead of 1. sslbrain automates all of it. Your price is per server, not per certificate or renewal.

Skip the sales call

You don't need to tell us how many servers you have, or what your budget is, to see the price. It's right here. You don't need a demo to try it. It's free. You don't need to commit to a licence count. Upgrade when you're ready. sslbrain is for engineers and consultants who want to install and get going.

Support & add-ons

Cloud uptime guarantee

99.9% uptime on sslbrain Cloud (license, vault unlock, auto-DNS, ACME server). Included in all paid licenses. Actual uptime over the last 3 years: 99.996%.

Professional services

Direct access to the sslbrain development team for deployment planning, architecture review and integration assistance.

One-time onboarding

Remote assistance with initial setup, CA configuration, server onboarding, and first certificate automation. Available for Professional and Enterprise.

Professional and Enterprise

Enterprise Support & SLA

Guaranteed email response times, dedicated account manager, and priority issue handling. Available for Professional and Enterprise.

Professional and Enterprise

Commercial SSL Certificates

Commercial SSL certificates are unit-based. Certificates from Sectigo, DigiCert, GlobalSign. Unit price depends on your plan.

Certificate Covers Units Price/yr
DV 1 domain (www + naked) 1 €25
DV Wildcard *.domain + all subdomains 5 €125
OV 1 domain, organization validated 5 €125
OV Wildcard *.domain, organization validated 15 €375
EV 1 domain, extended validation 10 €250

Indicative price per year. sslbrain automatically selects the best CA per order from DigiCert, GlobalSign and Sectigo.

FairSSL DigiCert Sectigo GlobalSign

On the roadmap

We don't promise dates. These are features we already have concrete designs for, scheduled for the next development cycles. Vote for what matters most to you.

HSM integration

External HSM or cloud KMS for the vault master key.

SAML/OIDC SSO

Sign in via Entra ID, Okta, Ping Identity beyond Active Directory/LDAP.

More notification channels

Slack, Microsoft Teams, webhooks in addition to email.

Local SMTP relay

Send notifications via your own SMTP server, not via FairSSL.

REST API

Programmatic access to certificates, agents, and audit log.

CT log monitoring

Get alerted on unexpected certificate issuance for your domains.

Audit log to SIEM/syslog

Real-time stream of lifecycle events to Splunk, Sentinel, or any SIEM.

Bring your own commercial CA

Add your own direct CA contract on top of the ones already supported.

Get early access

Join the list and get 20% off your first year of Basic, Professional or Enterprise.

We process this data in line with our Privacy Policy

Frequently asked questions

Do the certificates cost anything?

Free certificates from Let's Encrypt and Google Trust Services are included in all licences. Unlimited, including wildcards. Commercial certificates from DigiCert, Sectigo and GlobalSign cost extra via unit packages (see table above).

Is the Free plan really free?

Yes. Free covers full certificate management for up to 5 endpoints with 1 user account, including wildcards and free renewals on up to 10 active certificates. No credit card, no time limit.

Will it always be free?

As long as free CAs exist and we can cover the cost of the service through paying customers, we will have at least one free plan.

What certificate authorities are included?

All plans support Let's Encrypt and Google Trust Services, both of which issue free DV certificates. Paid plans add support for commercial CAs like DigiCert, Sectigo, and GlobalSign for OV and EV certificates.

Can I use ACME directly with Let's Encrypt?

Yes. All plans can configure ACME directly with any CA without restrictions from sslbrain. The ACME Cloud feature via sslbrain offers auto-DNS and automatic failover between CAs.

Does sslbrain phone home?

sslbrain does not share your data with sslbrain Cloud. sslbrain Cloud cannot by design connect to, control, or read data in your sslbrain instance. sslbrain connects to sslbrain Cloud to: send emails to you, maintain encryption and protection of local data, fetch license keys and paid SSL license information, issue certificates via the ACME server, discover your local sslbrain FQDN from agents on the same IP (can be disabled), and fetch signed updates when you request them. No data about your servers, certificates, logins, or agents is sent to sslbrain Cloud.

What are custom agents?

Agents are YAML-defined scripts that handle certificate deployment to specific platforms. All core and community agents are available on every plan. Custom agents let you write deployment logic for any platform or application.

What happens if my subscription expires?

Your sslbrain automatically switches to the free Free tier without any action required. Already-issued certificates continue to work until they expire, and configured ACME clients on your servers keep working as normal. sslbrain runs only the number of servers and domains the Free tier allows, and servers beyond that stop renewing certificates. You receive warnings by email.

What if my paid SSL licenses run out or expire?

If your paid SSL licenses run out or expire, we automatically continue with free certificates, unless you have configured otherwise.

Why per endpoint and not per certificate?

We provide unlimited free certificates and commercial certificates at our cost price. To keep pricing fair, we base it on the number of managed endpoints rather than the number of certificates. That means an endpoint with 10-40 different certificates costs the same as one with a single certificate. For us that makes sense, and for you it means no surprises when you add more certificates.