CA/B Forum SC-081
15 March 2027: your clients' certs start dying every 100 days.
That is 4x more cert swaps than the one-year certs you had until this year. Certrota renews and deploys certs on the boxes that can't do it themselves: GlobalProtect portals, UniFi consoles, RD Gateways and IIS. Across every client, from one screen.
Countdown to 15 March 2027.
until max cert life drops to 100 days · 15 Mar 2027 00:00 UTC
Founder deal: $99/month, locked for 12 months. 20 MSPs only.
| Host | Client | Device | Issuer | Expires | Left ↑ | |
|---|---|---|---|---|---|---|
| vpn.nordbakk.no:443 | Nordbakk | MANUAL · GlobalProtect | Sectigo | ---------- | EXPIRED 3d ago | |
| rdgw.fjordtann.no:443 | Fjordtann | MANUAL · RD Gateway | R11 | ---------- | 112d | |
| unifi.hagen-bygg.no:443 | Hagen Bygg | MANUAL · UniFi OS | R10 | ---------- | 141d | |
| mail.lindvik.as:443 | Lindvik | MANUAL · Exchange | DigiCert | ---------- | 164d | |
| remote.skogli-regnskap.no:443 | Skogli Regnskap | MANUAL · RDS | GoDaddy | ---------- | 188d | |
| portal.vestre-auto.se:443 | Vestre Auto | MANUAL · GlobalProtect | Sectigo | ---------- | 217d | |
| fw.solberg-el.no:443 | Solberg El. | ACME · FortiGate | R11 | ---------- | 271d | |
| nas.aasen-arkitekt.dk:443 | Aasen Arkitekt | ACME · Synology | E6 | ---------- | 283d |
200 days
now · since 15 Mar 2026
100 days
on 15 Mar 2027
47 days
in 2029
Certs used to be a once-a-year ticket. Not anymore.
Until March 2026 a public TLS cert could last 398 days. You renewed the firewall VPN cert once a year, swore a bit, and forgot about it.
The CA/Browser Forum changed that (ballot SC-081):
| From | Max cert life | Swaps per device per year |
|---|---|---|
| Before 15 Mar 2026 | 398 days | 1 |
| 15 Mar 2026 | 200 days | 2 |
| 15 Mar 2027 | 100 days | 4 |
| 15 Mar 2029 | 47 days | 8+ |
Web servers with certbot don't care. The trouble is everything else: the GlobalProtect portal, the RD Gateway, the UniFi console, the on-prem Exchange box someone promised to migrate in 2019. They don't do ACME, so a tech does it by hand. Export, import, bind, commit, test, forget the intermediate, test again.
Take an MSP with 40 clients and 3 such devices each. That is 120 devices, 480 manual swaps a year from March 2027. Each one is a ticket you can't really bill for, and each one you miss is a "VPN is down" call at 07:58 on a Monday.
Three steps. The third one is the one you stop doing.
01
Add your clients
Create a client, add its devices by hand or by CSV. We also check public CT logs for each client domain, so you find the certs nobody wrote down.
02
Run the agent at the client site
One small binary for Windows or Linux. Install it on a server or VM you already manage, through your RMM if you like. It talks to the devices on the local network and only makes outbound HTTPS calls to us. No inbound ports, no VPN to us.
03
We renew and deploy
We get the cert by ACME with DNS-01 (Cloudflare, Route 53, Azure DNS), or you upload a paid one. The agent installs it on the device, binds it where it belongs, and checks that the device actually serves the new cert with the full chain. If anything fails, you get an alert while the old cert is still valid, not after.
You get one countdown screen per client, alerts by email, Slack or Teams, and a monthly PDF report you can send to the client so they see what you do for the money.
Client network
Certrota (EU)
What we renew and deploy
Full renew + deploy (v1)
Coming next
Monitor and alert only
FortiGate, SonicWall (SonicOS 8.2.2+), Synology, MikroTik. These can do ACME themselves. We watch them, so you know when the built-in renewal quietly stopped.
Missing a device? Tell us. We pick the next target by how many MSPs ask for it.
Your client's firewall password stays at your client's site.
We know what we are asking. A tool that pushes certs to firewalls has to be careful, so here is exactly how it works:
Local agent.
Device logins (API keys, SSH keys, Windows accounts) are stored by the agent, on a machine inside the client network. They are never sent to us.
Outbound only.
The agent polls us over HTTPS. You open no inbound ports and set up no tunnels.
We hold as little as we can.
We store the ACME account and the DNS API token for DNS-01. Use a token that can only edit _acme-challenge records where your DNS host allows it.
Signed agent.
Windows and Linux builds are code-signed. You can check the hash before you install.
Rollback.
The old cert stays on the device until the new one passes the health check.
Audit log.
Every renewal, deploy and failure is logged per client, with who and when.
EU hosting.
Servers in the EU. The company is Norwegian.
Per device. Like everything else you buy.
$2 per device per month
$49/month minimum.
A "device" is one box we deploy to or watch: one firewall, one RD Gateway, one UniFi console. Not per cert, not per domain, not per tech.
Every plan has all features: unlimited clients, unlimited techs, the agent, alerts, PDF reports.
| Devices | Per month |
|---|---|
| Up to 24 | $49 |
| 50 | $100 |
| 150 | $300 |
No contract. Cancel in the app. The certs you already have stay on the devices.
Founder deal
Founder deal: $99/month, locked for 12 months.
For the first 20 MSPs. We set up your first 3 devices with you on a call, and you get a say in what we build next.
FAQ
FortiGate (and SonicWall) already does ACME. Why pay you?
If all your clients run FortiGates, you probably don't need us for renewals. Most MSPs we talk to have a mix: a FortiGate here, a Palo Alto there, RDS everywhere. For devices with built-in ACME we only monitor, at the same price per device. That catches the case where the built-in renewal broke three months ago and nobody looked.
We already use Certify The Web.
Good tool. It works well on one Windows server. It does not log into a Palo Alto or a UniFi console, and you still log into each client's server to see if it worked. Certrota gives you all clients on one screen. If Certify The Web runs fine on a box, keep it there and let us watch the result.
What if the agent breaks a firewall?
The agent only touches the cert: it imports the new one, points the service at it, and checks it. It does not change policies, rules or routes. The old cert stays until the new one passes. If the check fails, we roll back and alert you. On PAN-OS you can choose "import only" and do the commit yourself.
Why not just write a PowerShell script?
You can. Many of you have. Then the tech who wrote it leaves, it runs from a scheduled task on one server, and nobody knows it failed until the cert expires. And you need one script per vendor, per client. We are that script, with logging, alerts and someone else on the hook to fix it when Palo Alto changes their API.
Do we have to open firewall ports?
No. The agent only makes outbound HTTPS calls. We use DNS-01 for validation, so nothing needs to listen on port 80 either. That is also why it works for RDS boxes that only expose 443.
Our clients buy paid certs from a CA. Can we still use you?
Yes. Upload the cert (or let the agent make the CSR), and we deploy it like any other. Note: paid certs have the same 100-day limit from March 2027. Paying more does not get you a longer cert anymore.
You are a new company. What if you shut down?
Fair question. The certs are normal certs, stored on your devices. If we disappear, they keep working until they expire, and you are back to doing it by hand. You can export your device list and cert history as CSV at any time.
How is this different from CertKit or Certimate?
CertKit is good for servers you control. Certimate is open source and you host it yourself. Certrota is built for MSPs: many clients, many sites, one agent per site, and a focus on the appliances that are hardest to automate.
15 March 2027 is not moving.
Start with the free scanner. Paste your clients' domains and see which certs are on hand-installed boxes. It takes two minutes, and you will probably find one you forgot.
Founder deal: $99/month for 12 months. 20 spots.