Pricing

KrakenKey automates TLS certificate lifecycle management — issuance, renewal, monitoring, and revocation. Issue certificates via Let's Encrypt in ~4 minutes through the dashboard, REST API, or CLI. Monitor your TLS endpoints from distributed probes to catch expiring certs, broken chains, and misconfigurations before they cause outages.

The CA/Browser Forum approved Ballot SC-081v3, which phases TLS certificate maximum lifetimes from 398 days down to 47 days by March 2029. Shorter lifetimes reduce the window of exposure if a key is compromised. This makes automation essential.

Register any TLS endpoint (host:port) and KrakenKey scans it on a schedule using distributed probes. Each scan performs a real TLS handshake and reports connection health, certificate details, chain validation, and latency. Use our hosted probes for zero-ops monitoring from multiple regions, or run the open-source probe on your own infrastructure for internal services.

KrakenKey uses the WebCrypto API built into modern browsers to generate your Certificate Signing Request entirely client-side. Your private key is generated in your browser and never leaves your device. Only the CSR (which contains your public key) is sent to our servers.

Yes. Every action available in the dashboard is also available via REST API and the krakenkey CLI. Issue certificates, manage domains, configure endpoint monitoring, and export scan results — all programmatically. AI agent tool definitions are included for automated workflows.

No. The free tier includes ACME automation, certificate issuance, and 3 monitored endpoints with connected probes. Starter ($29/mo) adds 10 endpoints, 2 hosted probe regions, auto-renewal, and expiry alerts. Team ($79/mo) adds 50 endpoints, 5 hosted regions, organizations with RBAC, and 5-minute scan intervals.