Here's an uncomfortable truth: the most expensive ticket your MSP will ever work is the one generated by a client whose website just went dark because someone forgot to renew an SSL certificate 90 days ago. The chaos is entirely preventable, and the fix is already sitting in your Autotask instance.
Most MSPs know this pain. An expired cert takes down a client site, the client calls screaming, you spend two hours in emergency mode tracking down the certificate vendor, and then you eat the labor cost because there's no graceful way to bill for something that was your responsibility to prevent. Multiply that by even three incidents a year across your client base, and you're looking at a meaningful revenue leak with zero upside.
The good news is Autotask has native domain and SSL certificate tracking. The frustrating news is most MSPs have never turned it on.
Let's put a number on this. A typical SSL emergency runs two to four hours of technician time once you account for diagnosing the issue, coordinating with the client, tracking down the renewal, deploying it, and verifying everything is back up. At $125/hour fully burdened, that's $250 to $500 per incident in labor alone.
Add the soft costs:
Most MSPs do this firefighting for free because there's no pre-existing ticket or contract line capturing it. You're absorbing a cost that your client never sees as billable work, which means it doesn't appear on any report that would prompt a pricing conversation.
The other problem is systemic. If SSL certificates aren't tracked as assets in your PSA, you have no visibility into how many certificates are expiring across your client base at any given time. You're flying blind.
Autotask has two system device categories specifically built for this: Domain and SSL Certificate. These aren't just label fields. When you create a device using the Domain category and enter a domain name, Autotask automatically retrieves DNS entries and expiration dates. If an SSL certificate is found, it will prompt you to auto-create a child device for it.
The SSL Certificate category works similarly. Enter the certificate, and Autotask pulls public details automatically. You can also add private key data and intermediate chain information via user-defined fields (UDFs), which Autotask recommends handling through UDFs since they support encryption and view tracking for sensitive data.
The catch: this feature is not activated by default. You have to go to Left Navigation Menu > Admin > Admin Categories > Activations to turn it on. It's also not included in the Essentials contract tier, so if you're on Essentials, the automated retrieval of WHOIS, DNS, and SSL data is disabled.
That activation step is why most Autotask shops have never used this. It's not intuitive, it's not mentioned prominently, and nobody went looking for it because the old way (manual UDFs, spreadsheets, or just hoping someone remembers) technically worked. Until it didn't.
To get started:
If you already have devices tracking domains through custom UDFs, you can migrate them by exporting in import template format, updating the category column to Domain or SSL Certificate, and re-importing. Once updated, use the bulk Update Domain Details and Update SSL Certificate Details actions to force-refresh the data.
Tracked assets are only valuable if they trigger action. An SSL certificate record sitting in Autotask with an expiration date is marginally better than a spreadsheet. What you want is a workflow rule that generates a ticket automatically as that date approaches.
Autotask's workflow rules let you fire on configuration item field values, including expiration dates. A reasonable setup:
Each ticket should reference the device record so technicians can see all the certificate details without hunting for them. More importantly, each ticket should be tied to the correct client contract so the labor gets captured and billed.
If you're already doing ticket triage work, the patterns here are the same ones that make AI-driven tools accurate. Clear issue types, consistent queue assignment, and tickets that contain actual context (not just "SSL cert expiring") create a service desk that runs on data instead of institutional memory.
Once asset tracking and renewal workflow automation are in place, you have everything you need to package this as a formal service line. Right now, most MSPs absorb SSL and domain management as overhead. The work happens, the time gets lost, and the client has no visibility into the value being delivered.
Packaging it properly means:
A simple structure: charge a flat monthly fee per domain managed (covering monitoring and renewal coordination) with pass-through on certificate costs plus a handling fee. For a client with five domains and associated certs, that might be $75 to $150 per month. Across 50 clients, that's a service line worth $45,000 to $90,000 annually that previously generated zero revenue.
The Autotask Contracts module supports recurring billing structures that can tie directly to the assets and tickets you're already generating. The workflow you built to create renewal tickets should be configured to associate those tickets with the appropriate contract, so time entries flow into billing automatically rather than requiring manual cleanup at month end.
If you've been tracking domains and certs through custom UDFs or spreadsheets, migration is straightforward but requires attention to detail. The key constraint to know upfront: once you assign the Domain or SSL Certificate system category to a device, you cannot change it. Get the category right before you import.
The migration process in brief:
One thing to watch: if hundreds of records are scheduled for update simultaneously, Autotask may not complete all of them in the first pass. Failed updates get rescheduled an hour later automatically, so don't panic if your initial refresh looks incomplete.
SSL and domain management is costing your MSP money in two directions simultaneously: emergency labor you're eating on incidents, and recurring management work you're not billing for. Autotask's native domain and SSL tracking eliminates both problems, but only if you turn it on and build the workflow around it.
The activation is in Admin > Activations. The rest follows logically:
That's the difference between a cost center that occasionally blows up in your face and a managed service line with predictable revenue and zero client surprises.