Start free

Free certificates from Let's Encrypt and Google Trust Services are included in all licences, wildcards too, within the licence's certificate plans and domains. The CA's own rate limits apply. Commercial certificates from DigiCert, Sectigo and GlobalSign cost extra via unit packages (see table above).

Yes. Free covers 5 endpoints, 10 certificate plans and up to 10 domains, with free certificates from Let's Encrypt and Google, 1 user and up to 10 certificates an hour. Each plan can hold as many names as the CA allows, and is renewed and reissued as often as it needs to be, at no extra cost. The 10 plans cover every certificate the appliance manages, from Cloud, upload and self-signed; the appliance's own certificate does not count. Free costs nothing and needs no credit card.

All plans support Let's Encrypt and Google Trust Services, both of which issue free DV certificates. Paid plans add support for commercial CAs like DigiCert, Sectigo, and GlobalSign for OV and EV certificates.

Yes, on Professional and Enterprise: the appliance can speak ACME directly with any ACME server, such as an internal CA, Let's Encrypt or Google. Free and Basic get certificates through sslbrain Cloud, which adds auto-DNS and automatic failover between CAs. The certificates count against the same limits either way.

sslbrain does not share your data with sslbrain Cloud. sslbrain Cloud cannot by design connect to, control, or read data in your sslbrain instance. sslbrain connects to sslbrain Cloud to: send emails to you, maintain encryption and protection of local data, fetch license keys and paid SSL license information, issue certificates via the ACME server, discover your local sslbrain FQDN from agents on the same IP (can be disabled), and fetch signed updates when you request them. No data about your servers, certificates, logins, or agents is sent to sslbrain Cloud.

Agents are YAML-defined scripts that handle certificate deployment to specific platforms. All core and community agents are available on every plan. Custom agents let you write deployment logic for any platform or application.

Your sslbrain automatically switches to the free Free tier without any action required. Already-issued certificates continue to work until they expire, and configured ACME clients on your servers keep working as normal. sslbrain runs only the number of servers and domains the Free tier allows, and servers beyond that stop renewing certificates. You receive warnings by email.

If your paid SSL licenses run out or expire, we automatically continue with free certificates, unless you have configured otherwise.

We provide free certificates and commercial certificates at our cost price. To keep pricing fair, we base it on the number of endpoints rather than the number of certificates. That means an endpoint with 10-40 different certificates costs the same as one with a single certificate. For us that makes sense, and for you it means no surprises when you add more certificates.