Getting Started

Logging In

SwiftCert Pro uses secure signed sessions. After you sign in, the browser receives a protected session cookie; your email address and password are not sent again on each page request.

Signing in

1. Navigate to the portal Go to https://clm.swiftcomputing.co.za/login
2. Enter your credentials Type your email address and password, then click Sign In.
3. MFA prompt (if enabled) If your account has two-factor authentication enabled, you'll be redirected to enter your 6-digit code.
4. You're in You'll land on your dashboard showing certificate inventory, agent status, and recent activity.

Session management

Your session automatically refreshes while you're active. If you remain idle for an extended period your session will expire and you'll be asked to log in again. To explicitly end your session click your profile and select Log Out.

Session cookies are protected from JavaScript access. SwiftCert also checks the session on the server, so logging out invalidates the session rather than only hiding it in the browser.

Invitations and password setup

When an administrator invites you, SwiftCert sends a secure password setup link to your email address. No shared temporary password is displayed in the portal. Open the link within 10 minutes, choose your password, and then sign in normally.

If the link expires, ask an administrator to send a new invitation or password setup email. Never forward a setup link or enter it on a website other than your SwiftCert portal.

Getting Started

Two-Factor Authentication

Two-factor authentication (2FA/MFA) adds a second layer of security by requiring a time-based one-time code from your phone in addition to your password.

Setting up MFA for the first time

If your administrator has enabled MFA for your account, you'll be taken through setup on your next login.

1. Install an authenticator app Download Google Authenticator, Authy, or 1Password on your phone.
2. Scan the QR code Open your authenticator app and scan the QR code shown on the Set up MFA page.
3. Enter the 6-digit code Type the current 6-digit code shown in your app and click Confirm. The code changes every 30 seconds.
4. MFA is now active Every future login will require both your password and a fresh 6-digit code.

Logging in with MFA

After entering your email and password you'll be taken to the verification page. Open your authenticator app, find the SwiftCert Pro entry, and enter the 6-digit code shown. The code is valid for 30 seconds — if it expires just wait for the next one.

Lost access to your authenticator?

Contact your administrator. They can reset your MFA secret from the admin panel, allowing you to re-scan a new QR code and set up your authenticator app again. Your account and data are not affected.

MFA safety

Your authenticator code changes frequently and should never be shared with support staff. SwiftCert does not ask you to send a six-digit code by email or chat. Keep your phone clock set automatically so codes remain synchronized.

Getting Started

Your Dashboard

The dashboard is your central hub. It shows an at-a-glance view of your certificate inventory, agent node health, recent activity, and quick action shortcuts.

Dashboard sections

Certificate inventory summary

Shows a count of active, expiring, and expired certificates. Click View Inventory to manage individual certificates. Certificates expiring within 30 days are highlighted in amber.

Agent node status

Displays all registered agent nodes with their online/offline status, last heartbeat time, and resource usage (CPU, memory). agents that haven't sent a heartbeat in over 2 minutes are marked offline.

Recent activity log

A time-ordered list of all actions taken in your account — logins, certificate requests, DNS confirmations, downloads, and team changes. All entries are immutable and include the acting user's email.

Quick actions

Shortcuts to the most common tasks: request a new certificate, start a discovery scan, or invite a team member.

Navigation

The top navigation bar provides access to all major areas:

• Inventory — All certificate requests and issued certificates
• Installations — Agent nodes registered to your account
• Configurations — Domain settings and certificate discovery tools
• Settings — Account and team management

Certificates

How Certificates Work

Every certificate follows the same high-level lifecycle, but the selected CA determines how the order is submitted, which validation or approval is required, and how issuance is confirmed.

The shared lifecycle

1. Choose the CA profile — Select an enabled provider and environment that match your trust, product, and account requirements.
2. Submit certificate details — Provide a common name, optional SANs, contact and subject details, and key settings. SwiftCert prepares the request and its CSR where the selected workflow supports it.
3. Complete the provider's validation — Let’s Encrypt DNS profiles use DNS-01; GoDaddy and DigiCert use their own order, domain-control, organization, and approval requirements. Follow the request status and instructions shown for that order.
4. Confirm issuance — SwiftCert completes ACME issuance automatically after validation. For GoDaddy and DigiCert, use the request's Sync Status action to check the CA order and retrieve the certificate when it is ready.
5. Manage the issued certificate — Download it, deploy it through a configured agent, monitor expiry, and renew it using a supported workflow for the original CA.

Certificate status lifecycle

Certificate validity

Certificate validity, price, product, and renewal requirements are set by the issuing CA and your account entitlement. SwiftCert tracks expiry and renewal metadata for certificates from all supported providers. See each provider section for its integration details.

Certificates

Certificate Providers

SwiftCert supports three CA integrations. Each has its own provider guide below, including supported profiles, what you configure, how requests progress, and what to expect during validation or issuance. Availability depends on the profiles enabled for your customer and the products your CA account is entitled to order.

What is a Certificate Authority?

A Certificate Authority is a trusted organisation that verifies your domain ownership and cryptographically signs your certificate. When a browser or device sees your certificate, it trusts it because it was signed by a CA that it already recognises and trusts.

Different CAs offer different certificate types and validation levels:

• Domain Validated (DV) — Proves you control the domain. Fast, automated, often free (e.g. Let's Encrypt). Trusted by all browsers.
• Organisation Validated (OV) — Proves the domain belongs to a verified legal entity. Manual identity check, typically paid.
• Extended Validation (EV) — Highest assurance level with strict identity verification. Often used for financial and e-commerce services.

Choose a provider section for detailed instructions: Let's Encrypt, GoDaddy, or DigiCert. SwiftCert DNS methods are documented separately under DNS Providers. Managed DNS automation is currently for Let's Encrypt DNS-01 requests; GoDaddy and DigiCert validations follow their CA order workflows.

Certificate Provider

Let's Encrypt

Let's Encrypt issues Domain Validated (DV) certificates through ACME. SwiftCert supports production and staging DNS-01 profiles, a manual workflow, and a separate staging-only DNS-PERSIST profile.

Available profiles

• Production — Live, browser-trusted certificates; subject to Let's Encrypt production rate limits.
• Staging — Test issuance and DNS workflow; certificates are not trusted by browsers.
• Manual — Manual CSR and certificate completion workflow for restricted or externally managed issuance.
• DNS-PERSIST Staging — Optional persistent DNS authorization for testing only; the available profile issues untrusted staging certificates. DNS-PERSIST Production is not supported.

Account setup

Under Settings → CA & DNS Providers, configure the ACME contact email and enable the profile. SwiftCert creates or reuses a customer ACME account for the selected environment. To automate TXT publication, separately add and enable a Cloudflare DNS connection; manual DNS is also supported.

Request, validation, and issuance

1. Create the request — In Inventory, select the Let's Encrypt profile, enter the domain and optional SANs, and submit.
2. Publish each DNS challenge — For a DNS-01 profile, choose manual or an enabled Cloudflare connection. SwiftCert provides each exact TXT record; Cloudflare mode publishes it, while manual mode requires you to add it.
3. Validate and wait — Click Validate Now. SwiftCert retries public DNS checks, checks CAA readiness, submits the challenge to ACME, and monitors issuance in the background. No separate Complete action is required for the DNS-validated ACME flow.
4. Open the issued certificate — Active Requests updates automatically. When status becomes Completed, use the success notice's View certificate link.

Renewal and key details

Let's Encrypt certificates are typically short-lived (currently 90 days). A renewal can require new DNS challenges. The certificate remains available while its renewal request is processed. Review Renew & Automate for manual and automatic renewal controls.

DNS provider overview · Manual DNS · Cloudflare · Connect a provider

Certificate Provider

GoDaddy

SwiftCert connects to your GoDaddy certificate account to submit certificate orders, check their status, and retrieve an issued certificate. GoDaddy controls product eligibility, pricing, domain validation, and approval.

Available profiles

• GoDaddy OTE — Operational Test Environment for testing the API integration. It is a sandbox, not a browser-trusted certificate issuer, and the GoDaddy account still needs the required test certificate product provisioned.
• GoDaddy Production — Submits live orders against the configured production account. Orders may incur charges and depend on product entitlement.

Account setup

In Settings → CA & DNS Providers, select the GoDaddy environment, enter the API key and paired API secret, optionally set a Market ID, and enable the profile. Confirm API access and certificate product entitlement with GoDaddy before requesting a live certificate. Credentials are stored by SwiftCert for your customer.

Request, validation, and issuance

1. Create the request — Choose the enabled GoDaddy profile in Inventory and provide the domain, SANs if needed, and required contact details. SwiftCert generates a key and CSR and submits an order.
2. Complete GoDaddy's order requirements — Track the order in Active Requests and complete any domain-control, account, or approval steps GoDaddy requires. DNS validation for GoDaddy is handled under GoDaddy's order workflow, not through the SwiftCert Cloudflare integration.
3. Sync the order — Select Sync Status in Active Requests to check the CA order. When GoDaddy has issued the certificate, SwiftCert retrieves it and the request becomes Completed.
4. Download or deploy — Open the issued certificate in Inventory and download it or select it in a deployment profile.

Renewal and reissue

A new renewal order and a reissue of an eligible existing GoDaddy order are different actions. Renewal timing is controlled by the profile's configured renewal window; reissue requires the original supported provider order. GoDaddy may revoke a replaced certificate after issuing its replacement, so deploy and verify a reissue promptly.

Connect a GoDaddy profile · Read renewal guidance

Certificate Provider

DigiCert

SwiftCert connects to DigiCert CertCentral to submit an entitled certificate product order, check its status, and retrieve an issued certificate. DigiCert controls organization validation, product eligibility, pricing, and approvals.

Available profiles

• DigiCert Staging — Test profile using the staging API endpoint supplied for your account. Staging certificates are not trusted by browsers. SwiftCert requires an explicit staging API base URL and will not silently direct a staging request to Production.
• DigiCert Production — Places live orders against the configured CertCentral account. Charges, organization approval, and product entitlement are governed by DigiCert.

Account setup

In Settings → CA & DNS Providers, configure the API key, numeric Organization ID, entitled Product Name ID, Server Platform ID, payment method, and any profile option required by your DigiCert account. Use the numeric organization identifier—not the Account ID or a friendly name. Configure the DigiCert-provided test API base URL for Staging, then enable the profile.

Request, validation, and issuance

1. Create the request — Choose the enabled DigiCert profile in Inventory and provide the domain, SANs, contact, and organization details. SwiftCert prepares a CSR and submits the selected product order.
2. Complete DigiCert's order requirements — Track the order in Active Requests and satisfy any required organization, domain-control, or approval tasks in CertCentral. DNS validation is part of the DigiCert order workflow; the Cloudflare connection in SwiftCert is not used for DigiCert validation.
3. Sync the order — Select Sync Status in Active Requests to check the order. After DigiCert issues it, SwiftCert retrieves the certificate and marks the request Completed.
4. Download or deploy — Open the issued certificate in Inventory and download it or select it in a deployment profile.

Renewal and reissue

A new DigiCert renewal order and a reissue of an eligible existing DigiCert order are different actions. The configured renewal window controls when a new order is available; native reissue requires a supported existing order. Check product, organization, payment, and validity options before submitting.

Connect a DigiCert profile · Read renewal guidance

Certificates

Connect a Certificate Authority

Connect the certificate authority account you already use. Once a provider is configured and enabled, it appears in the certificate request and renewal forms.

Before you begin

• Ask a customer owner to configure the integration in Settings → CA & DNS Providers.
• Have credentials for the CA account and confirm that the account is entitled to order the certificate products you need.
• Use a staging or sandbox profile first when available. Production orders may be subject to the CA's charges, approval rules, and rate limits.
• For GoDaddy OTE, confirm that the account has the required test certificate product provisioned before placing an order.

Set up a provider

1. Open Settings → CA & DNS Providers — Choose New and select the certificate authority and environment you want to add.
2. Enter provider-specific account details — Configure the Let's Encrypt ACME contact email; GoDaddy API key, secret, and optional Market ID; or DigiCert API key, numeric organization ID, product, and order options. DigiCert Staging also requires the test API base URL supplied for your account. Use each provider's guide for field definitions.
3. Configure provider-specific renewal settings — GoDaddy renewal windows are 1–90 days and DigiCert windows are 1–397 days. These control when SwiftCert allows a new renewal order; native reissue of an eligible existing order is separate. Let's Encrypt uses its ACME renewal workflow.
4. Save, then enable the profile — Provider credentials are stored encrypted. A provider must be enabled before it is offered for new requests or renewals.
5. Start with a test environment when available — Let's Encrypt Staging, GoDaddy OTE, and DigiCert Staging each use their provider's test service. Test certificates are not for live production use; confirm account and product prerequisites before switching to Production.
6. Choose the provider in Inventory — Open Inventory → New Request and select the enabled provider profile. For GoDaddy and DigiCert, SwiftCert submits the order and displays its progress under Active Requests.

Open CA Provider settings

Certificates

Requesting a Certificate

Use the same Inventory form to start orders with any enabled CA. The selected provider determines which account fields are needed and which validation or approval steps follow.

Step-by-step

1. Open the Inventory page Click Inventory in the top navigation, then click the New Request button.
2. Enter domain details Type the primary domain (e.g. example.com). Add alternative names (SANs) if you need one certificate to cover multiple names like www.example.com or *.example.com.
3. Enter a contact email The CA may use this address for order notices. SwiftCert notifications are configured separately in Settings.
4. Choose Certificate Authority and environment Choose an enabled profile and the appropriate environment. Review the matching Let's Encrypt, GoDaddy, or DigiCert guide for environment trust, account setup, and product requirements.
5. Submit Click Request Certificate. SwiftCert prepares the provider order and displays its required next step in Active Requests. That may be DNS validation, external CA action, or status synchronization.

What happens next?

After submission, follow the status and action shown in Active Requests. Let’s Encrypt DNS profiles display the TXT challenge and offer Validate Now. GoDaddy and DigiCert display their CA order status; complete any required CA-side validation or approval, then choose Sync Status to check issuance. The page polls request status automatically and shows a certificate link when issuance completes.

DNS Providers

DNS Providers

Domain validation proves that you control a requested name. For Let's Encrypt DNS-01, SwiftCert offers two DNS methods. Each has its own guide below. GoDaddy and DigiCert validation stays with those certificate authorities and does not use these DNS connections.

Open the guide for the method you use: Manual DNS or Cloudflare. Manual entry stays available even when a Cloudflare connection is enabled.

Other certificate authorities

GoDaddy and DigiCert orders follow the validation and approval rules of the selected product and account. Complete any email, DNS, file, organization, or approval step in that CA's portal, then return to Inventory and select Sync Status. Those orders do not use the SwiftCert Cloudflare connection. Use the GoDaddy or DigiCert guide for that provider.

Shared checks

• Follow the instructions on the current order. Requirements differ by CA, product, and validation method.
• For DNS-01, every TXT name and value must match the request, and public DNS must be able to see the records.
• Use the request's console and error details to decide whether to retry, correct DNS, or finish a step in the CA portal.

DNS Provider

Manual DNS

Manual DNS is for Let's Encrypt DNS-01 requests when you publish each challenge TXT record yourself. It is always available, including when a Cloudflare connection is already saved.

Challenge records

On the Inventory page, a pending Let's Encrypt DNS request shows each record to add:

Log in to the DNS host for that domain (Cloudflare, Route53, GoDaddy, cPanel, or another host) and add each TXT record with the exact name and value shown. A request with several names can require more than one record.

Waiting for DNS propagation

After adding the record, wait 5–10 minutes before confirming. DNS changes can take time to propagate. You can check that the record is visible with:

When the command returns the expected value, the record has propagated.

Confirm the challenge

1. Choose Manual On the Inventory page, click Validate Now and choose Manual after you have published the TXT records.
2. SwiftCert checks public DNS SwiftCert checks every required TXT record against public DNS resolvers, retries while records propagate, checks CAA readiness, then submits the challenge and monitors the order until issuance or an explicit failure. If a record is still not visible after the retries, wait and validate again.
3. Let's Encrypt validates When the records are found, SwiftCert notifies Let's Encrypt. The request moves to Validating while the CA checks the challenge and issues the certificate.
4. Wait for issuance SwiftCert monitors the ACME order in the background. DNS-validated Let's Encrypt requests do not need a separate Complete button.

Use Cloudflare instead · Let's Encrypt

DNS Provider

Cloudflare

Cloudflare DNS automation publishes Let's Encrypt DNS-01 TXT records for you. A customer owner connects Cloudflare under Settings → CA & DNS Providers. GoDaddy and DigiCert orders do not use this connection.

Connect Cloudflare

Create an API token scoped to the zones SwiftCert should manage, with Zone:Read and DNS:Edit permissions. Follow Cloudflare's guide to creating an API token, then add a named connection in Settings → CA & DNS Providers.

For an account-owned API token, also enter the Cloudflare Account ID. SwiftCert verifies the token with that account's token-verification endpoint and limits zone discovery to that account. User API tokens can leave Account ID blank. If you use separate tokens for different zones or accounts, add one connection per token and select the matching connection when you request or validate a certificate.

SwiftCert encrypts the token, creates only the required TXT values, and removes only records it created after validation finishes. If the automated update fails, the request stays available for manual DNS and shows the error.

How zones are chosen

For each challenge, SwiftCert matches the TXT record name to an active Cloudflare zone the API token can access. For example, _acme-challenge.api.example.com uses the api.example.com zone when that zone is managed separately; otherwise it uses the example.com zone. A certificate that covers names in several zones can use all of them when the token has Zone:Read and DNS:Edit on each zone.

Confirm the challenge

1. Choose Cloudflare On the Inventory page, click Validate Now and choose Cloudflare plus the enabled connection that can edit the domain's zone. Cloudflare appears only after a customer owner saves and enables that connection.
2. SwiftCert publishes and checks DNS SwiftCert creates the TXT records, then uses the same ACME checks as manual validation: public DNS resolvers, propagation retries, CAA readiness, challenge submission, and order monitoring. If a record is still not visible after the retries, wait and validate again.
3. Let's Encrypt validates When the records are found, SwiftCert notifies Let's Encrypt. The request moves to Validating while the CA checks the challenge and issues the certificate.
4. Wait for issuance SwiftCert monitors the ACME order in the background. DNS-validated Let's Encrypt requests do not need a separate Complete button.

Open CA & DNS Provider settings · Publish records manually

Certificates

Downloading Certificates

Once a certificate is issued you can download it in any standard format directly from the Inventory page — regardless of how or where it was deployed.

Available formats

Password-protected downloads

For .pfx, .p12, and .key formats, a password is required before download. The file is encrypted using your chosen password and the password is never stored by SwiftCert Pro. The modal closes automatically and your file downloads once the password is accepted.

Certificates deployed to an agent

When a certificate is deployed through an agent, SwiftCert Pro keeps the certificate lifecycle available through protected customer workflows so that authorized downloads and renewals remain manageable from the portal.

Choosing the right format

Platform	Recommended format
Nginx / Apache / Linux	.pem or .crt + .key
Windows IIS / Exchange	.pfx (with password)
Java / Tomcat	.cer or .p12
Cloudflare / CDN	.pem or .crt + .key
Load balancer (F5, Citrix)	.pfx or .pem
Agent-deployed (auto)	Delivered directly by SwiftCert Agent

Certificates

Renew a Certificate

A renewal creates a new certificate request linked to the current certificate. The existing certificate stays available while the new request moves through issuance.

Renew manually

1. Open Inventory → Certificates — Find the active certificate you want to renew.
2. Choose an action — A new CA renewal order starts a separate provider order and may incur charges. It is available within the renewal window configured on the GoDaddy or DigiCert profile. A reissue reuses the existing GoDaddy or DigiCert order and does not submit a new order; it is available only with the original provider and a saved CA order ID.
3. Review key and domain details — SwiftCert carries forward the certificate's domain names and contact details and creates a new private key and CSR. GoDaddy SAN changes are supported only for UCC products.
4. Complete any CA validation — For Let's Encrypt, use Manual DNS or Cloudflare for this renewal, then click Validate after the records are visible. For DigiCert or GoDaddy, follow the steps in that provider's guide.
5. Issue and deploy the replacement — Confirm the replacement is issued, then deploy it to the target profile. SwiftCert archives the predecessor when the replacement is issued; certificate lineage remains available in Inventory.

Issuing a renewal does not require an online agent. An agent is needed only for agent-based deployment; you can also download the new certificate and install it yourself.

Turn on automatic renewal

1. Configure account defaults — A customer owner opens Settings → Certificate Automation, enables automatic renewal, selects how many days before expiry to start, and optionally selects a default enabled provider.
2. Choose which certificates follow the defaults — In Inventory → Certificates, use the certificate's automatic-renewal settings. Keep Follow global settings on to inherit the account defaults, or turn it off to set an override.
3. Monitor the renewal request — SwiftCert creates a linked request and reports its status in Active Requests. Complete the workflow for the selected CA: publish and validate DNS for a Let's Encrypt DNS-01 order, or complete the CA's required actions and use Sync Status for GoDaddy or DigiCert.

Open Certificate Automation settings

Certificates

Deploy a Certificate

Use an online SwiftCert Agent as the deployment worker. The agent connects outward to SwiftCert and reaches the target server using the network path and credentials you configure.

Before you start

• Install and verify a SwiftCert Agent on a Linux host that can reach the deployment target.
• Issue the certificate first. Keep an independent, secure backup of its private key.
• Prepare a least-privilege target account and allow the required connection from the agent host.

Create a deployment profile

1. Open Installations → Certificate Deployment — Create a new profile and give it a recognizable name, such as Production website.
2. Choose the platform — Select Microsoft IIS, Nginx, Apache HTTP Server, pfSense, or Generic Linux Service. Each platform has its own installation strategy and connection requirements.
3. Select the certificate and online agent — Pick the issued certificate and the agent that can reach the target host.
4. Enter target details — Add the server address, required port, username, and secret or a saved credential. Use Test Connection to check access before deployment.
5. Save, then queue the deployment — Review the platform-specific settings and choose Queue Deployment when ready. Follow the task status and result in the portal.

Validation and rollback

The agent reports the deployment result. SwiftCert validates the live service where the platform workflow supports it; failed validation can trigger restoration of the previous certificate. Review the deployment history and rollback reason before retrying. Keep target credentials restricted and rotate them according to your security policy.

Open Certificate Deployment · Add an agent

Certificates

Managing Certificates

The Inventory page lists all your certificate requests and issued certificates. You can archive completed certificates and delete failed requests.

Archiving a certificate

Archiving moves a certificate out of the active list without deleting it. Use this for expired or replaced certificates you want to keep for audit purposes. Archived certificates still show in the Archive tab, but downloads are disabled.

To archive: click the Archive button on a certificate card and confirm.

Deleting a request

Failed or unwanted requests can be permanently deleted. This removes the record from SwiftCert Pro. This action is irreversible.

Renewing a certificate

To renew, create a new certificate request for the same domain. The workflow is identical to the original request. Once the new certificate is issued you can archive the old one. If you use an agent, the renewed certificate is delivered and installed through the configured deployment workflow.

Certificate family and renewal comparison

Open a certificate's Details panel in Inventory to view its certificate family: the original certificate followed by each renewal. Each version shows its issued date, expiry, provider, fingerprint, deployment status, agent custody, and renewal reason.

When a renewal completes, SwiftCert compares the old and new certificate. It warns if SANs disappear, the issuer or key algorithm changes, the key size changes, the validity period shortens, or a deployment target may no longer be compatible. Warnings appear in the certificate details, audit log, and dashboard notices.

Deployment safety and rollback

Certificate Deployment profiles validate the live service after installation. SwiftCert checks the HTTPS handshake, served certificate fingerprint and expiry, hostname/SAN, negotiated TLS version, service availability, and expected HTTP response.

If the live check fails, the agent restores the previous certificate files or IIS binding automatically. Deployment attempts, rollback reasons, and outcomes are retained in the deployment history. Authorized customer owners can use Rollback Previous from an existing deployment profile when a manual rollback is needed.

Discovery

What is the Hunter Engine?

The Hunter Engine discovers public hostnames and certificate records for a monitored domain by searching Certificate Transparency (CT) logs. It does not see private certificates that are not submitted to public CT logs.

What are Certificate Transparency logs?

Every certificate issued by a public CA (like Let's Encrypt, DigiCert, Comodo, etc.) is recorded in publicly accessible CT logs. These logs are immutable and permanent — a certificate cannot be un-logged once it's been issued.

The Hunter Engine queries crt.sh, a search engine that indexes all major CT logs, to find certificates for your domains.

After the first scan establishes a baseline, saved domains are checked daily for newly observed CT entries. You can also request a manual rescan. New certificate alerts are sent only when the CT discovery email preference is enabled in Settings.

What can it find?

• Publicly logged certificates whose names match the monitored root domain and its subdomains
• Certificate issuer, serial, DNS names, validity dates, CT timestamp, and first-seen history
• Whether a discovered hostname currently resolves in public DNS
• Subdomains you may not be aware of that appear in certificate records

Use cases

Discovery

Starting a Discovery Scan

A discovery scan searches CT logs for public certificate records matching one root domain. Results are stored as a baseline and refreshed daily.

How to start a scan

1. Go to Configurations Click Configurations in the top navigation.
2. Choose Basic Discovery Start a CT Logs discovery job for the domain you want to monitor.
3. Enter domains Enter one root domain (for example, example.com) per job. Matching subdomains are collected from certificate names.
4. Start the scan Click Start Discovery. The scan runs in the background; its status appears in the discovery list.

Rescanning

Saved domains are rescanned daily. Use the rescan control to check sooner. Previously stored CT entries are deduplicated; newly observed entries after the initial baseline can generate an email alert.

The CT provider can occasionally return a timeout or gateway error. SwiftCert retries transient errors up to three times. If a scan still fails, check its status and retry later; the daily monitor will try again on a later cycle.

Discovery

Reading Scan Results

Scan results list discovered hostnames and their DNS status. Select a hostname to open its CT certificate history.

Host and certificate details

The host panel shows the hostname, resolved IP address when available, discovery type, first-seen date, and last scan. Certificate history includes the common name, issuer, serial number, DNS names, validity period, CT log timestamp, and when SwiftCert first observed the entry.

DNS status only confirms whether the hostname resolves. It is not a live HTTPS probe and does not prove that a discovered certificate is currently installed on that host.

What to look for

Team & Account

Inviting Team Members

Add colleagues to your account so they can collaborate on certificate management. Each user has their own login and is assigned a role that controls what they can do.

How to invite a user

1. Go to Settings → Team
2. Click "Invite Member" Enter the person's email address and choose their role.
3. Send invite An invitation is created. The administrator provides login credentials to the new member. They can change their password on first login.

Removing a user

Go to Settings → Team, find the user and click Remove. Their account is disabled immediately — any active sessions are invalidated within seconds. Their activity history is preserved in the audit log.

Team & Account

Roles & Permissions

SwiftCert Pro access is enforced by customer account roles. Access is split between Account Owners and Team Members.

Role comparison

Feature	Account Owner	Team Member
View dashboard	✓	✓
Request certificates	✓	✓
Download certificates	✓	✓
Archive completed certs	✓	✓
Start discovery scans	✓	✗
Invite team members	✓	✗
Manage team access	✓	✗
Manage agent nodes	✓	✗

Changing a user's role

Go to Settings → Team, click the role badge next to a user and select the new role from the dropdown. The change takes effect immediately on their next request (or within seconds for active sessions).

Team & Account

Account Settings

The Settings page lets you configure MFA, manage your team, and view your account details.

Event log filters

The Event Log in Settings supports filters by severity and component so you can quickly focus on the entries you care about. Use severity to narrow to errors or warnings, and component to focus on the area involved.

Profile settings

View and update your profile details. If you forget your password, use Forgot password? on the login page or ask your administrator to send a new secure setup link. Passwords are never shown in the portal.

SMTP and notification setup

Customers can use the native SwiftCert system SMTP2GO platform for outbound mail. In practice, this means you configure a sender address, verify that mailbox access is available for the address being used, and ensure the sender domain can receive the verification message that SwiftCert sends.

Basic setup requirements typically include a valid sender address, access to that mailbox so the verification email can be completed, and a working mail delivery path for the sender domain. Notification preferences can include certificate requests, first issuance, renewals, expiry, deployments, discovery, team changes, and auto-renewal alerts.

Enable Certificate issued for first-issuance messages, Certificate renew for renewal messages, and New CT discovery item for newly observed public Certificate Transparency records after a discovery baseline. A CT alert is a review signal, not proof of unauthorized activity, and does not report certificate revocation.

If a Let’s Encrypt auto-renewal needs re-authorization, the platform can also raise a notification so the customer is aware that the renewal flow needs attention.

MFA settings

Enable or disable two-factor authentication for your account. If you have lost access to your authenticator device, your administrator can reset your MFA secret so you can set up a new device.

Team management

If you are an Account Owner, the Team section shows all members, access status, and recent account activity. You can invite, remove, and update team access from here. Invitations are delivered by email as one-time password setup links.

Agents

What is the SwiftCert Agent?

The SwiftCert Agent is a service that runs on a Linux server you manage. It connects out to SwiftCert Pro over HTTPS so the portal can send approved work without requiring an inbound connection to the agent.

What can it do?

• Report the server's connection status and basic health information to the portal.
• Receive certificate deployment tasks and report whether they succeeded.
• Run supported deployment integrations and return task results to the portal.
• Receive signed SwiftCert component updates and supported Linux operating-system update tasks.

Where does the agent run?

An agent runs on a Linux server that you manage. It keeps a secure outbound connection to SwiftCert Pro and performs only the tasks you approve from the portal. It is designed to act on a trusted host, not to scan your entire network automatically.

The agent is a deployment worker, not a general network scanner. SwiftCert's discovery feature looks at public certificate sources for the domains you manage; it does not inventory every private server or certificate store in your environment unless you explicitly configure a deployment target.

When should I install an agent?

Install an agent when you want SwiftCert to deploy certificates to a Linux server or platform that the host can reach. If you only need to request and download certificates, you can often do that from the portal without installing an agent.

Agents

Install a SwiftCert Agent

Use the customer portal's setup wizard to connect a supported Linux server to your SwiftCert account. The wizard provides account-specific installation details.

What you'll need

• A server running Ubuntu 24.04 or later and an account with sudo access
• An active SwiftCert Pro account and access to the customer portal
• Outbound access to the Ubuntu package repositories used by the installer
• Outbound HTTPS access on port 443 to clm.swiftcomputing.co.za

Install and verify

1. Open Installations → Add an agent — Sign in to the portal and open the setup wizard.
2. Download the installer — On the Ubuntu server, copy and run the download command shown in the wizard.
3. Run the interactive installer — Use chmod +x install.sh && sudo ./install.sh. Enter the account ID and API key when prompted. The API key prompt does not display what you type. Choose a name for the server when asked.
4. Save the recovery key — Store the one-time recovery key printed by the installer in your password manager. Do not share it in email or support tickets.
5. Confirm it is online — Run sudo systemctl is-active swiftcert-agent; it should print active. Then return to Installations → Agents and wait for the agent to report Online.

After installation

Configure a certificate deployment profile before selecting this agent as a target. If the agent does not come online, check its service with sudo systemctl status swiftcert-agent and review its recent log with sudo journalctl -u swiftcert-agent -n 50 --no-pager.

Open the Add an agent wizard

Agents

Agent Health & Status

The Installations page shows each registered agent's connection status, recent check-in, version, and available health information.

Agent log verbosity

Account owners can set agent log verbosity in the Installations page using standard levels: ERROR, WARN, INFO, and DEBUG. Most customers should use INFO for day-to-day operation and switch to DEBUG only during active troubleshooting.

Status indicators

Status	Meaning
Online	Heartbeat received within the last 2 minutes
Offline	No heartbeat for over 2 minutes — agent may be down or disconnected
Pending	Registered but not yet sent a heartbeat (normal immediately after install)

Certificate delivery tracking

When a certificate is queued for an agent, SwiftCert Pro tracks each stage of delivery:

Stage	Meaning
Awaiting issuance	Certificate request in progress, not yet issued
Ready for delivery	Certificate issued, queued for the agent to collect
Delivered	Agent has collected the certificate package
Installed	Agent confirmed installation — audit trail complete
Failed	Agent reported an install error — review agent diagnostics in the portal

If an agent goes offline

Check that the server is running, then run sudo systemctl status swiftcert-agent and review sudo journalctl -u swiftcert-agent -n 50 --no-pager. Confirm outbound HTTPS access to SwiftCert Pro is allowed.

Agents

Agent Updates

Use the portal to update SwiftCert components on a connected agent or manage supported Linux package and kernel updates.

Triggering an update

1. Go to Installations — find the agent you want to update. If a newer version is available an Update Available badge appears next to the agent name.
2. Choose an update and action — install now or schedule it for a maintenance window. Review reboot options before submitting operating-system updates.
3. Check the update history — the portal shows whether the task is queued, running, completed, or failed. The agent must be online to receive and report the task.

Cancelling a scheduled update

If you scheduled an update but want to cancel it before it runs, click Cancel Update on the agent card. This removes the pending task. The agent will not receive the update instruction at its next heartbeat.

Help

Frequently Asked Questions

Certificates

How long does it take to get a certificate?

Timing depends on the provider, DNS propagation if required, any customer or CA approval, and the selected certificate product. Active Requests shows the latest status; GoDaddy and DigiCert orders can be checked with Sync Status.

Can I get a wildcard certificate?

Wildcard availability depends on the CA product. Let's Encrypt supports wildcards through DNS-01; check GoDaddy or DigiCert product eligibility and validation instructions. A wildcard covers subdomains, not the root domain itself; add both names if both are required.

My DNS is confirmed but the challenge still failed. Why?

For Let's Encrypt DNS-01, check the TXT name and value, selected DNS zone, Cloudflare connection permissions, and public propagation; then wait and choose Re-Validate. For GoDaddy or DigiCert, check the CA order for pending domain-control, organization, or approval tasks, then use Sync Status. Use Console View for the request's current error detail.

Can I renew a certificate before it expires?

Renewal availability depends on the selected CA and provider profile. SwiftCert displays the configured renewal window for GoDaddy and DigiCert; automatic renewal timing can be set in Certificate Automation. Plan renewal early enough to complete the CA's validation and approval steps.

What is staging mode?

Staging or sandbox environments test a provider workflow and generally issue certificates that browsers do not trust. Let's Encrypt Staging and DNS-PERSIST Staging, DigiCert Staging, and GoDaddy OTE each use their provider's test system; setup and product prerequisites differ. Production certificates use the live CA service and are subject to its pricing, approval, entitlement, and rate-limit rules.

Certificate Deployment

Why do I pick platform in New and not again in the form?

The platform is now chosen once from New (for example, IIS or Nginx). The profile form stays locked to that platform to avoid duplicate steps and accidental mismatches.

What does "leave blank to keep saved secret" mean?

When editing an existing deployment profile, you can keep the current secret by leaving the password box empty. If you type a new password, SwiftCert rotates the saved profile secret.

Can I reuse credentials across multiple deployments?

Yes. Use Stored Credential in the deployment profile panel to select a reusable credential entry. This avoids retyping secrets across multiple profiles and keeps your workflow consistent.

What is Windows Domain used for?

For IIS targets, Windows Domain identifies the account context used during remote certificate operations. Use your AD domain (for example CORP) or a local-machine context (for example .) depending on how your IIS host is managed.

What does "Selected agent does not have a deployment public key yet" mean?

That agent has not completed key registration for deployment tasks. Open Installations, run Update Now for that Linux agent (or reinstall it), wait for it to check in, then queue the deployment again.

Discovery

How far back does CT log data go?

CT logs started around 2013 when they became mandatory for major CAs. The Hunter Engine returns all historical records from crt.sh which goes back to 2013 for most domains.

I see certificates I didn't issue. Should I be worried?

Not necessarily. Many certificates are issued by hosting providers, CDNs (Cloudflare, Fastly), and SaaS platforms automatically on behalf of your domain. If you see a certificate you truly can't account for, investigate the issuing CA and when it was issued.

Account & Team

I forgot my password. How do I reset it?

Contact your account administrator. They can reset your password from the admin panel. Self-service password reset is not available to prevent account takeover without MFA.

Can I have multiple users sharing one account?

No — each person should have their own login. Sharing credentials is a security risk and makes the audit log unusable. Use the team invite feature to add colleagues with their own credentials.

Help

Troubleshooting

Certificate request stuck in "Pending"

Pending means SwiftCert or the CA order is still being prepared. Check the provider selected and the request's Console View. For GoDaddy or DigiCert, confirm that the API profile is enabled, credentials are valid, and the account has the requested product entitlement. If it remains pending:

• Allow the order provider time to respond, then reopen Active Requests.
• For GoDaddy or DigiCert, select Sync Status and check for provider-side prerequisites.
• For Let’s Encrypt, confirm the selected Production or Staging profile and check the displayed DNS challenge.
• Do not delete a request until you have reviewed its provider-side order state.

Let's Encrypt DNS validation does not pass

Check the following. Manual publication is covered in Manual DNS, and automated publication is covered in Cloudflare.

• The record name is _acme-challenge.yourdomain.com — some DNS providers auto-append the domain, so you may only need to enter _acme-challenge
• The record type is TXT (not A, CNAME, or any other type)
• The value is copied exactly — including any trailing characters or equals signs
• Verify the DNS record is publicly visible using a DNS lookup tool before retrying

Can't log in (login page loops)

• Clear browser cookies and cached data for this site (Ctrl+Shift+Del)
• Try in a private/incognito window
• Ensure cookies are not blocked in your browser settings

Agent shows as offline but the server is running

• Connect to the server and check that the swiftcert-agent service is running
• Confirm outbound HTTPS (port 443) is not blocked by a firewall
• Confirm DNS resolves clm.swiftcomputing.co.za from the server
• If the agent credentials are no longer valid, remove the agent from the portal and re-register it

Help

Contact Support

Our support team is available 24/7 to help with any issues you encounter. Please provide as much detail as possible to help us resolve your issue quickly.

What to include in a support request

• Your account email address
• The domain name you're working with
• The certificate request ID (shown in the Inventory page)
• The exact error message or a screenshot
• Steps you've already tried