1.5.46

Released 23 Aug 2026

New

Discover certificates from cloud DNS (Cloudflare and Google Cloud DNS). Discovery gains a new source type, Cloud DNS Provider, for DNS you host in the cloud where a zone transfer (AXFR) isn't available: it lists a zone's records through the provider API and probes each host to find every live certificate. Connect Cloudflare with a read-only API token or Google Cloud DNS with a service-account key (DNS Reader). Manage the provider connections and the discovery resolvers under a new Settings → Discovery section.
cPanel / WHM is now a distribution target — the sixteenth module. Install a managed certificate straight onto a cPanel or WHM server's domains, over either the cPanel account API or the WHM root/reseller API. One target can serve many certificates, the list of domains to install onto can be overridden per distribution, and — like the other modules — a previous version can be rolled back to.
See where a certificate is actually deployed — the new Discovery tab. A managed certificate's detail page gains a Discovery tab listing every live endpoint your discovery sources have observed serving that certificate. It confirms a distribution really landed, reveals a copy on a host you didn't expect, and flags any endpoint still serving an older version after a renewal so you can chase down a target that wasn't updated. An empty tab means discovery hasn't scanned that location — not that the certificate isn't deployed there.

Scan a subset of zones per AXFR / cloud DNS source, and edit a source after creating it. An AXFR or Cloud DNS Provider source can now target specific zones instead of every zone its resolver or connection covers, so a large estate can be split across several discoveries. Discovery sources also gain a full Edit page — change ports, schedule, tuning and add zones — while scope-defining fields (a CIDR range, a hostname, the resolver or connection) stay fixed to keep discovery history consistent.
Discovered endpoints are grouped by IP address, with expandable detail. An IP that fronts many hostnames (a wildcard certificate, an ingress) now collapses into a single row you click to expand and see each name — instead of a long wall of near-identical rows — on both the source and certificate views. The count reads as both endpoints and distinct IPs so the two are never confused. Names that merely fall through to a server's default certificate (a reverse-DNS hostname, an address a wildcard doesn't cover) and CertAutoPilot's own internal probe name are no longer shown as their own rows, so each row is a name the certificate genuinely serves.
Delayed jobs show a "scheduled" status. A job waiting for its scheduled run time is now labelled scheduled instead of looking like a stuck pending job.

Discovered endpoints now show as managed when their certificate is. A certificate that CertAutoPilot manages was correctly labelled Managed on the Certificates view, but every one of its endpoints still read unmanaged — the endpoint status never reflected the certificate. Endpoints served by a managed certificate now show managed (a failed probe still shows failed), across the source, inventory and certificate views.