SSL Certificate Inventory Without the Spreadsheet: A Signed PDF From Your Mac or iPhone
Short version. An auditor asking for your certificate inventory wants three things a spreadsheet cannot prove: that the list is complete, that it was current on the date shown, and that nobody edited it afterwards. PingKit Guardian Plus exports a PDF inventory of every monitored domain, cites ISO/IEC 27001:2022 controls A.5.37, A.8.15 and A.8.8, and signs the file with an Ed25519 key whose public half is printed on every page. Cert Monitor itself is free for one domain; the export is Plus, at $4.99 a month on Mac or $9.99 on iPhone.
What an Inventory Has to Answer
Strip the audit language away and a certificate inventory answers five questions for every TLS endpoint you are responsible for: what is it, who issued it, when does it expire, is the chain valid today, and when did you last check. A sixth question sits over the whole document: can I trust that this list is what you actually had on the date it claims. Every certificate inventory template you can download covers the first five. Almost none covers the sixth, and the sixth is the one that decides whether the auditor accepts the document or asks you to prove it another way.
Why the Spreadsheet Fails
- It is stale on arrival. A spreadsheet records what someone typed, on the day they typed it. The expiry date in cell D7 was true in March; it says nothing about whether the certificate was renewed since, or whether the chain still validates.
- It has no provenance. Anyone with the file can change any cell, and there is no way to tell. That is not a theoretical concern to an auditor; it is the first thing they think.
- It is not evidence of a process. ISO 27001 wants to see that checking certificates is a documented, repeated operation, not an annual afternoon. A spreadsheet with a "last updated" column is a record of the afternoon.
- It cannot say "checked". A monitoring log has timestamps for every observation. A spreadsheet has the date someone remembered to open it.
What the PingKit Inventory Contains
The export is generated from Cert Monitor's live data, not typed. For every monitored domain it prints the host and port, subject and issuer, expiry date and days remaining, chain validity with the error when the chain fails, subject alternative names, public key algorithm and size, signature algorithm, whether the certificate is self-signed, when it was last checked and how long it has been monitored. Above the table, an at-a-glance block gives the count of domains, how many need attention and the days to the nearest expiry, or "Expired" in red if one already has. If you use Uptime Watch, its targets are listed too, with status and last check.
Two short sections make it an audit document rather than a printout. A scope statement says what the report is and is not: it evidences continuous monitoring of the listed certificates and endpoints, records what was observed at the times stated, and makes no claim about any system not named in it. And a control reference names the standard and the three Annex A controls it supports, so the auditor does not have to map it themselves.
The Signature
This is the answer to the sixth question. The PDF carries its own Ed25519 signature: after the file's final %%EOF there is one more line, a PDF comment holding the base64 signature over every byte before it. The signing key was generated on the device that exported the report and its private half never leaves that device's keychain. The public key, base64, is printed in the footer of every page and in the Verification section at the end, together with the report's unique ID.
To verify, split the file at the signature marker and check the signature against the preceding bytes using the printed public key, with any Ed25519 implementation. Any change to the PDF, including re-saving it from a viewer, breaks the signature. So the document proves what the spreadsheet cannot: that these bytes are what the monitor produced, at the time printed in the header, from the data it had.
Which Controls It Evidences
The report cites ISO/IEC 27001:2022 Annex A controls A.5.37 (documented operating procedures: a repeatable, automated check rather than an ad hoc one), A.8.15 (logging: every observation timestamped and retained) and A.8.8 (management of technical vulnerabilities: an expiring or broken chain found and reported before it becomes an incident). It deliberately does not claim A.8.24, the cryptography control, which is about key management policy and algorithm choice rather than monitoring. The reasoning behind that mapping, at length.
Exporting From the Mac or the iPhone
On a Mac, open the free PingKit Agent, go to the Reports pane, and export the compliance report; you choose where the single PDF is saved. On an iPhone, the export is on the Reports screen and shares like any other file. Set the organisation name once in settings and it appears in the running header and the PDF's metadata. The report is in English regardless of your device language, by design: Annex A control identifiers are English, and an audit file with one translated word in it is worse than one with none.
The export is a Guardian Plus feature. Cert Monitor itself watches one domain free, so you can see what the monitor records before paying for the document; Plus watches 25. Guardian Plus is $4.99 a month or $39.99 a year in the Mac Agent, $9.99 a month or $79.99 a year on iPhone and iPad, with a 1-week trial on every plan except the Mac yearly one. A Plus subscription bought on the iPhone unlocks the Mac Agent through iCloud; one bought inside the Mac Agent covers that Mac only.
Honest Limits
- The inventory covers the domains you added to Cert Monitor. It is not a discovery tool and will not find certificates you did not know about.
- It records what the connection is served. It does not read the negotiated TLS version or cipher suite, and it does not inspect your private keys or their storage, which is what A.8.24 is about.
- It is English only, on purpose.
- Twenty-five domains is the cap. A fleet larger than that needs a different class of tool.
Frequently Asked Questions
What should a certificate inventory include?
For every TLS endpoint: the host and port, subject and issuer, expiry date, chain validity, subject alternative names, key and signature algorithms, and when it was last checked. For the document itself: the date it was produced, its scope, and a way to prove it was not edited afterwards.
Is a spreadsheet acceptable as a certificate inventory for ISO 27001?
Often, for a first audit, with questions. The problems are that a spreadsheet is only as current as the last time someone typed in it, records no timestamps for actual checks, and can be edited without trace. A signed export from a monitor answers all three.
Which ISO 27001 controls does the PingKit compliance PDF cite?
A.5.37 (documented operating procedures), A.8.15 (logging) and A.8.8 (management of technical vulnerabilities), from ISO/IEC 27001:2022 Annex A. It does not claim A.8.24, the cryptography control, which concerns key management rather than monitoring.
How is the PDF signed, and how do I verify it?
With Ed25519, generated on the exporting device. The signature is appended after the PDF's final %%EOF as a comment line, and the public key is printed in the footer of every page. Split the file at the marker and verify the signature over the preceding bytes with the printed key. Any edit, including re-saving from a viewer, invalidates it.
Do I need Guardian Plus to use Cert Monitor?
No. One domain is monitored free, with push alerts. Guardian Plus raises that to 25 domains and unlocks the signed compliance PDF. It is $4.99 a month or $39.99 a year on Mac and $9.99 a month or $79.99 a year on iPhone and iPad.
Export the inventory from your Mac.
The Mac Agent is free to download and monitors one domain free. Guardian Plus is $9.99 a month or $79.99 a year on iPhone and iPad, $4.99 a month or $39.99 a year on Mac. Every plan has a 1-week trial except Mac yearly.
Get PingKit Agent for Mac