Torito Explore GitHub
CertPatrol Orchestrator / Open-source monitoring

Every search.
One clear view.

Coordinate CertPatrol workers, follow new domains,
and keep your investigations together.

Install OrchestratorView on GitHub
Independent searches.
Shared context.Explore the dashboard
01 / Your monitoring workspace

See the work.
Follow the discoveries.

Launch isolated searches, review new domains, and manage workers from one dashboard. Projects and results are stored in SQLite for reporting and automation.

CertPatrol Orchestrator dashboard showing projects, searches and discovered domains.
CertPatrol Orchestrator dashboard · screenshot from the project repository
01 / Coordinate

Keep searches independent.

Launch and supervise separate CertPatrol processes. Each search has its own pattern, checkpoints, and process tracking.

02 / Organize

Give every result context.

Group searches into named projects. Review discoveries with the patterns and project information that produced them.

03 / Automate

Work beyond the dashboard.

Use the CLI and REST API to manage searches and retrieve results. SQLite keeps your project history available between sessions.

02 / Get started

Install. Initialize.
Start investigating.

Install the package, initialize your database, and start the dashboard. Create a project, add your patterns, and launch the searches you need.

Read the project documentation

Install and start

pip install certpatrol-orchestrator
certpatrol-orch init
certpatrol-orch server

Create a project and search

certpatrol-orch add-project "Workers.dev Monitoring" -d "Monitor workers.dev domains"
certpatrol-orch add-search "Workers.dev Monitoring" "Workers Search" "workers\\.dev$"

Run and inspect a search

certpatrol-orch start <search_id>
certpatrol-orch status

Choose a database

certpatrol-orch server --db ./data/orchestrator.sqlite

03 / How it works

From public logs
to project history.

Dedicated workers read the certificate logs. The manager captures their output, stores the results, and serves the dashboard and API.

  1. 01 / Workers

    Spawn isolated searches.

    Each CertPatrol process runs with its own checkpoint file and PID tracking.

  2. 02 / Capture

    Collect each discovery.

    Background threads read worker output and forward structured results to the manager.

  3. 03 / Storage

    Keep a shared record.

    SQLite stores projects, search metadata, and results. The Flask UI and REST API read from that database.

04 / Run it your way

Your infrastructure.
Your investigation.

The project includes a Waitress server and supports reverse proxy setups. Configure the runtime for the environment where you run your workers.

Web server
Waitress serves the Flask application. See the project documentation for reverse proxy configuration.
Runtime settings
MANAGER_HOST, MANAGER_PORT, MANAGER_DEBUG, and MAX_CONCURRENT_SEARCHES.
Database location
Use -f, --db, or --database to select a SQLite file for your commands.
05 / Field notes

Before you
start your fleet.

How is CertPatrol Orchestrator different from CertPatrol?

CertPatrol tails Certificate Transparency logs for a single pattern. CertPatrol Orchestrator spins up and manages many CertPatrol workers, adds a live dashboard, centralizes storage, and exposes automation-friendly APIs and CLI commands.

Do I need to install CertPatrol separately?

Yes. The Orchestrator launches CertPatrol subprocesses, so the certpatrol package must be present. Installing certpatrol-orchestrator with pip brings in CertPatrol automatically as a dependency in most setups.

Can I automate everything without the web UI?

Definitely. Every task—init, project creation, search control, and status checks—has a matching CLI command (certpatrol-orch ...) and REST endpoint under /api/*, ideal for CI/CD pipelines or cron jobs.

How do I point at a shared SQLite database?

Use -f, --db, or --database flags with any command. For example, certpatrol-orch server --db ./data/orchestrator.sqlite runs the UI on a custom file, and certpatrol-orch list-projects --database /mnt/shared/certpatrol.sqlite lets other hosts read the same state.

Is there an API for integrations?

Yes. The Orchestrator ships REST endpoints like /api/projects, /api/searches, /api/searches/<id>/results, and /api/status. Use them to trigger alerts, sync with ticketing systems, or feed data into custom dashboards.

Start with a single search

Meet CertPatrol.

Follow certificate logs and filter domains directly from your terminal.

Explore CertPatrol
Open source. Ready to explore.

Keep the whole
investigation in view.

View Orchestrator on GitHub