Community is free and stays free. Pro and Enterprise are perpetual licenses sized to the estate you point CertCommand at, with a maintenance window that governs which builds you can upgrade to. A license is a signed text file you paste into the console. Nothing is activated over the network.
Subscription optional, never required Licensing never phones home No per-seat counting
A target is an enabled asset. One Windows host is one target no matter how many certificates it holds. One TLS endpoint, meaning a host and a port, is one target. Operators are not counted, so the whole team can have a login.
Community counts what you have enabled against 50 endpoints. Go past it and the console starts asking you to buy Pro on every page. That is the whole consequence. Probes run, alerts fire, and asset 51 gets added like asset 12 did.
Pro and Enterprise work the other way round. The band on the license is a contract limit the console enforces, so a Pro 100 license declines target 101 and names the band that covers you. Moving up is a new license file, not a reinstall.
A perpetual license has no expiry date. The separate maintenance date governs which builds you may upgrade to. The first year is included with every purchase, and when maintenance lapses the build you are on keeps running for good. Every paid edition is also sold on a dated subscription if capital spend is the problem.
A license is a signed block of text between BEGIN and END lines. You paste it into Settings and the console verifies the signature locally against a key built into the product. There is no activation server to reach.
Licensing gates what you can add and which features are switched on. It never switches the product off, deletes an asset, or hides history. A lapse is something you read on the page and fix with a new file, not an outage a user reports to you.
Community is gated by a soft line on how many endpoints you watch. Pro and Enterprise are gated by features and by a hard target band. The estate collection, the part that reaches into Windows hosts, is the paid line. Buy a paid edition outright, or take the same thing on a subscription.
Soft limit of 50 endpoints
Free
No license file to paste, no account with us, and no expiry date on it.
Up to 100 targets
$1,495
One time. First year of updates and support included, then $395/yr for maintenance.
Or subscribe: $79/month, or $790/yr on one invoice.
Up to 500 targets
$3,995
One time. First year of updates and support included, then $995/yr for maintenance.
Or subscribe: $199/month, or $1,990/yr on one invoice.
No target limit
$9,995
One time. First year of updates and support included, then $2,495/yr for maintenance.
Or subscribe: $499/month, or $4,990/yr on one invoice.
Every line above is in the build today. Renewal automation is included with Pro or Enterprise at no extra cost, for any license inside its maintenance window.
The subscription is there for starting small and for budgets that only hold operating money. A perpetual license is the better fit for an install you mean to keep, and it costs less to own over time.
Prices are in US dollars. Purchase orders are accepted, a written quote holds for 90 days, and a W-9 comes with it on request. There is no checkout on this site, so email the address on the card you want and we will send the paperwork.
The evaluation is how you see Pro and Enterprise working against your own domain before anybody signs a purchase order. It needs no key, no form, and no sales call.
No license file to request and nothing to enter. It runs once per installation, for 14 days, with no target cap at all, so a pilot can cover the whole domain rather than a sample of it.
Agentless WinRM collection, Active Directory and AD CS discovery, GPO rollout, webhook alerting, and renewal automation all run during the evaluation. The evaluation is the whole product, not a sample of it.
On day 15 the installation drops to Community and keeps monitoring. Assets, certificates, history, and alert rules stay exactly where they are, waiting for a license file if you decide to buy one.
Binaries are not on public download yet. Email sales@certcommand.app and we will send the installer, then you start the evaluation from inside the console.
It nags. Community counts the assets you have enabled, and once you are past 50 the console shows a notice on every page suggesting Pro. Nothing else happens. Probes run on their normal schedule, alert rules keep firing, and enabling asset 51 works the same way enabling asset 12 did. There is no countdown, no read-only mode, and no feature that quietly switches itself off.
No. Those are contract limits and the console enforces them. A Pro 100 license declines target 101 and tells you which band covers you. Everything already enabled carries on while you sort the paperwork out, and moving up a band is a new license file rather than a reinstall or a migration.
The estate collection, which is most of what makes this a Windows tool rather than an endpoint checker: agentless WinRM collection over JEA covering certificate stores, IIS, SQL Server, the RDP listener, the WinRM listener and HTTP.sys reservations; Active Directory and AD CS discovery; GPO fleet deployment; the off-domain push collector; and webhook alerting with escalation recipients. Community keeps TLS endpoint monitoring with full chain capture, subnet sweep and Certificate Transparency discovery, email alerting, and the whole dashboard.
It renews certificates across the estate from one console. Renewal for publicly trusted certificates over ACME is in Pro, covering HTTP-01, DNS-01, and wildcards, against Let's Encrypt, ZeroSSL, or any other RFC 8555 authority. Renewal against AD CS templates for internal PKI is in Enterprise, including templates that require a certificate manager to approve each request. Both are included at no extra cost for any license inside its maintenance window.
The private key is generated on the host that will use it and never leaves; the console only ever handles the signing request and the issued public certificate. After the new certificate is installed and every binding moved, the same monitoring you already run re-observes the host, and the renewal is only considered done when the new fingerprint is present at every binding with a valid chain. If it is not, the bindings go back to the old certificate.
Perpetual if you can get the money approved once, subscription if you cannot. That is most of the decision. The subscription suits starting small, and it suits a shop with operating money and no capital line to draw on. A perpetual license suits an install you mean to keep: it is yours once the payment clears, it keeps working whatever happens to us or to your budget, and it costs less to own over time.
Mechanically it is the same signed text file as a perpetual license, dated to the period you have paid through. We reissue it each time you renew and you paste the new block in. The dates carry a grace margin on purpose, because an invoice sitting in somebody's approval queue is normal and should not put a console into a warning screen over it. If a subscription does lapse for good, the installation drops to the Community feature set and keeps monitoring: nothing is switched off, deleted, or hidden, which is the same promise a lapsed perpetual maintenance window gets.
Either. The annual price is ten times the monthly, so a year on one invoice costs two months less than twelve monthly ones: $790 for Pro 100, $1,990 for Pro 500, and $4,990 for Enterprise. Public sector buyers almost always want the annual invoice, because it goes against a purchase order like everything else they buy. Monthly suits smaller shops that would rather start without a procurement round. There is no checkout on this site and no card billing behind it, so either way it is an invoice from us and a payment from you.
The product keeps running. Probes and alert rules carry on for what is already enabled, and nothing is deleted or hidden. What a lapsed license changes is what the installation can do next: it falls back to Community, so the Windows estate collection waits for a current license and growth past the soft line earns you a notice rather than a refusal. Paste a renewed file and it all comes back.
The same way it works everywhere else. A license is a signed text block you paste into Settings, and the console verifies it against a public key compiled into the build. There is no activation server, no online check, and no periodic revalidation, so a machine that has never had a route to the internet is licensed the same as one that has. The daily update check is a separate thing entirely and has no bearing on licensing. On an isolated network it fails quietly, or you turn it off and it never tries.
Yes. The in-console evaluation runs once for 14 days, but we can issue a short-dated license file that does the same job for a longer window. Ask for one at sales@certcommand.app and say roughly how many targets and how long. It installs like any other license and reverts to Community when it ends.
No. The license carries a licensee name, an edition, a target count, and its dates. There is no hardware fingerprint and no machine binding, so rebuilding the app server is a matter of pasting the same file back in.
Upgrades. Builds released inside the window are yours to install and keep running forever, including after the window closes. The first year comes with every purchase. Renewing after that is optional and priced per edition, and letting it lapse costs you newer builds and nothing else. It has no effect on monitoring, alerting, or your target count.
Email sales@certcommand.app with the edition and band you want, and whether you want it outright or on subscription, and we will send a quote you can attach to a purchase order. Quotes hold for 90 days, a W-9 comes with them on request, and purchase orders are accepted with no credit card anywhere in the process. Multi-year maintenance prepay is available on request, which is usually what a budget cycle wants rather than a small invoice every year.
A target is an enabled asset. A Windows host is one target however many certificates, stores, and bindings it turns out to hold. A TLS endpoint is one host and port pair. Disabling an asset frees its slot, and items sitting in the discovery review queue are not counted because nothing has contacted them yet.
No. Nothing reports what you monitor, how many assets you have, or who is signed in. Two features reach outward at all, both covered below: the update check, and the optional Certificate Transparency discovery source, which queries public CT data and ships off.
It checks a manifest over HTTPS once a day to see whether a newer build has been published. That is on by default and one setting in the console turns it off. If the manifest cannot be reached, the check gives up quietly and nothing changes, which is what happens on an isolated network. It never downloads or installs anything on its own. Applying an update is always a deliberate step an administrator takes.
The evaluation needs nothing from us but the build. When you are ready to buy, name the edition, the band, and whether you want it outright or on subscription, and we will send a quote your purchasing office can work from.
