Pricing that fits
2–10 BIG-IPs.

Try it free for 30 days, then pay per device. HA pairs count as one cluster, not two devices. All prices exclude VAT.

Save about 16% with annual billing

Trial

The full product, for evaluation

€0

30 days, up to 2 devices

  • Every feature, no restrictions
  • Includes the guided swap with rollback
  • License key by email within 24 hours
  • Simply expires, nothing to cancel
Request a trial

Standalone

Per single device

€58 / month & device

billed annually (€696 / year)

  • Full monitoring, impact chain & dashboard
  • Escalating alerts (email, Slack, Teams)
  • Guided certificate swap with rollback
  • Audit log & blast radius
  • Email support
Start free trial

Cluster

Per HA pair (2 devices)

€91 / month & pair

billed annually (€1,092 / year)

  • Everything in Standalone
  • HA-aware monitoring without double counting
  • Config sync tracking during swaps
  • About 1.6× instead of 2× the device price
Start free trial

Enterprise & MSP

From 10 devices, or for service providers

Custom

volume pricing, partner model

  • Everything in Cluster
  • Multi-tenancy on request
  • Priority support
  • Available through reseller partners
Talk to us

The fairness rule: CertFlow is a subscription because continuous updates are the core of the product. If your subscription ends, you lose nothing: the dashboard and all your data remain accessible, only new scans and the swap pause until a new key is entered. Paid licenses get a 14-day grace period, and the license check works fully offline.

Frequently asked questions

Why a subscription instead of a one-time purchase?
Because a monitoring tool without maintenance quickly becomes worthless: new BIG-IP versions, new TLS requirements, new alert channels. The subscription funds exactly that ongoing work. And if you cancel, the dashboard and your data remain accessible; only new scans and the swap pause.
Why self-hosted and not SaaS?
Management networks are never reachable from the internet, for good reason. A SaaS would either need a tunnel into your management network or store your credentials. Neither is a good idea. That's why CertFlow runs as a container on your side.
Which permissions does CertFlow need on the BIG-IPs?
For monitoring, an account with the Auditor role (read-only) is enough. For the certificate swap, the separate write account needs the Resource Administrator role, because client SSL profiles are modified. The Certificate Manager role is not sufficient for that.
What counts as a "device"? How do HA pairs count?
A device is one managed BIG-IP instance (hardware, VE or vCMP guest). An HA pair of two devices is booked as one cluster at the pair price. CertFlow detects HA pairs automatically via certificate fingerprints.
Can CertFlow renew certificates automatically?
The guided swap with validation, dry-run and rollback is included today. Fully automatic renewal via ACME is next on the roadmap and will ship as an update within your subscription.
How does licensing and payment work?
You receive a license key that you enter in the dashboard. The check works offline, CertFlow never phones home. On renewal you simply get a new key that replaces the old one. Payment is by invoice, monthly or annually. Annual billing saves about 16%.

Not sure which model fits?

Describe your environment briefly. We'll work it out together, no sales pressure.

Talk to us