Skip to main content
The CertWatch Agent is a lightweight monitoring daemon that runs on your infrastructure to monitor SSL/TLS certificates that aren’t publicly accessible.

​
Why Use the Agent?

Private Endpoints

Monitor certificates on internal services, VPNs, and private networks that CertWatch can’t reach from the cloud.

Behind Firewalls

No need to open inbound ports. The agent connects outbound to sync data.

On-Premise

Perfect for air-gapped environments, data centers, and compliance-restricted networks.

Real-time Sync

Certificate data syncs to your CertWatch dashboard automatically.

​
How It Works

​
Features

  • Single Binary - No dependencies, just download and run
  • Config-Driven - Define certificates in a simple YAML file
  • Interactive Setup - cw-agent init wizard guides configuration
  • State Persistence - Agent ID survives restarts
  • Secure - Runs without root, uses TLS for all communication
  • Lightweight - Minimal CPU and memory footprint

​
Quick Start

1

Install

curl -sSL https://certwatch.app/install.sh | bash
2

Configure

cw-agent init
3

Start

cw-agent start -c certwatch.yaml

Full Installation Guide

See all installation options including Docker, Homebrew, and manual download.