Certificate reports for audits

Every certificate, the daily record of every check, revocation, TLS versions and certificate changes, in one PDF and CSV files.

Choose Pro Download the sample report (PDF)

Page 1 of the sample report: the report ID, the summary, a note from the account and the certificate inventory, with issuer, dates, key, signature, revocation, serial, fingerprint and alert settings

Page 2: the rest of the inventory, with owners, purposes and groups, and an account note on an accepted risk

Page 3: the daily record with the days per status, the days that were not OK with the account's notes, and the TLS versions each endpoint accepts

* Sample report for a made-up company with example data.

What's in the report

Certificate inventory: Each endpoint's certificate: subject, names, issuer, valid from and to, key, signature algorithm, serial number, SHA-256 fingerprint, and its alert settings now and on each day of the period.
Daily record: Every day of the period: how many checks ran and each day's worst status, with the days that were not OK and why.
Revocation: The certificate authority's answer, by OCSP or CRL, with its signature verified.
TLS versions: Which of TLS 1.0 to 1.3 each endpoint accepts, tested every day, and any weak cipher.
Certificate changes: Each replaced certificate: when, the issuer, a new key or not, names added or removed, routine or unexpected.
Names you don't monitor: Names under your domains with certificates in the public Certificate Transparency logs.
Owners and groups: Who owns each endpoint, what it is for, and its group, such as a client or a team. One report per group, owner or purpose if you like.
Notes for your auditor: Your own explanation next to a day that wasn't OK, a certificate change or an endpoint, printed in the report and kept for later reports.
Verifiable files: Each report has an ID. Your auditor can check at certavert.com/verify that a file is the one CertAvert generated, unchanged.

Any period in your history, as a PDF or as CSV files with every day of the record. Pro keeps 2 years of daily history (up to 5 years): $150 per year for 50 domains.

Where it may serve as evidence

Standard	Reference	In short
PCI DSS v4.0.1	4.2.1	Strong cryptography and security protocols safeguard PAN during transmission over open, public networks; this includes confirming that certificates are valid and not expired or revoked, and that only secure protocol versions are supported.
PCI DSS v4.0.1	4.2.1.1	An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained.
ISO/IEC 27001:2022	Annex A 5.9	Inventory of information and other associated assets.
ISO/IEC 27001:2022	Annex A 8.24	Use of cryptography.
SOC 2 (AICPA Trust Services Criteria)	CC6.7	Restricting and protecting information during transmission, movement or removal; its points of focus include encryption or secure channels for data in transmission.

The report records what CertAvert observed from the public internet about the endpoints you add. It is not an assessment or attestation of compliance; your assessor decides what evidence is sufficient.