Stop paying for SSL certificates
Trusted certificates from Let's Encrypt are free. They're trusted by every major browser and operating system, and they work for web sites, Exchange, Remote Desktop, VPNs and more. Census requests them, installs them, binds them to your services and renews them automatically. You never touch a certificate again.
What a certificate costs
The certificates are always free. Automatic renewal is free on your first server; more servers cost a one-time add-on.
Certificate lifetimes are shrinking fast
Browser makers and certificate authorities agreed (CA/Browser Forum ballot SC-081) to cut the maximum lifetime of every public TLS certificate, paid or free. Renewing by hand once a year is already over.
Until March 2026
About one renewal a year
Since March 15, 2026
Two renewals a year, per certificate
From March 15, 2027
About four renewals a year
From March 15, 2029
About eight renewals a year. Only automation keeps up.
Source: CA/Browser Forum, Ballot SC-081v3 (adopted April 2025).
Managed from one place, for every server
About 30 days before a certificate expires, Census renews it on its own and checks the result.
The key stays on the server
Each server creates its own private key and certificate request. The key never leaves the server, and Census never sees or stores it.
No open ports needed
Census proves you own the domain with a DNS record through your DNS provider's API: Cloudflare, Azure DNS, Route 53, Google Cloud DNS, GoDaddy, Namecheap, cPanel and more than 50 others. Your servers don't need to be reachable from the internet.
Installed, bound, verified
The server installs the certificate and binds it to the services you choose. Census then connects to each port to confirm it serves the new certificate. If anything fails, the previous certificate stays in place and you get an alert.
Wildcards and multiple names
One certificate for *.example.com, or for several names, the way your clients connect.
Remote sites included
Servers at branch offices are renewed through the site's remote scanner, the same way as at headquarters.
Test first, for free
Try every server with Let's Encrypt's test service, which is free on any number of servers, before you switch to real certificates.
Not just web sites
Most certificate tools stop at IIS or nginx. Census knows where the certificate goes for the services Windows and Linux admins actually run.
Windows Server
Linux
For nginx and Apache, Census edits only the certificate lines of the matching sites, tests the configuration, and puts everything back if the test fails.
Something else? Run your own command after each renewal, with the certificate's files, thumbprint and an optional PFX handed to it.
Know what expires before your users do
Census also inventories the certificates already on your network, including ones it doesn't manage. That covers Windows certificate stores, Linux server files, macOS keychains, and the certificate every web interface, printer, NAS, firewall and iLO/iDRAC presents on its TLS ports.
- Reports for certificates expiring in 30 days, already expired, and weak (short RSA keys, SHA-1, self-signed).
- Email alerts before each certificate expires.
- One click from a certificate to renew it automatically.
- The Census console gets its own free trusted certificate too, renewed automatically.
The certificates are free. Always.
Let's Encrypt doesn't charge for certificates, and neither do we. The add-on pays only for automating renewal on more than one server, and it's a one-time purchase.
Works with the free edition of Census too. Servers count once, however many certificates they have.
Add it to a quoteCertificate questions
Are Let's Encrypt certificates really as trusted as paid ones?
Yes, for encryption. Let's Encrypt is a nonprofit certificate authority trusted by all major browsers and operating systems, and it's used by hundreds of millions of web sites. Its certificates are domain-validated (DV), like most paid certificates. Paid certificates mainly add organization validation (OV/EV) details, which browsers no longer show prominently.
Do I need to open a port or make my server public?
No. Census uses the DNS challenge, so your servers can stay internal. You need a public domain you own, such as mail.example.com, and an API token for its DNS provider. Internal-only names such as server.corp.local can't get public certificates from any certificate authority.
Do I need a Let's Encrypt account?
No. Census creates the account itself, and no email address or password is needed.
What if a renewal fails?
The previous certificate stays bound, the problem appears on the Certificate renewal page and in the deployment history, and you get an alert. Since renewal starts about 30 days before expiry, there's plenty of time to fix it.
Can I keep my paid certificates?
Of course. Census inventories them and warns you before they expire. Switch servers over to free certificates whenever you're ready.
Your next certificate renewal could be your last manual one
Free certificates, automatic renewal, and your first server included.