Skip to main content

Certificate Automation

Overview​

Certificate Lifecycle Management (CLM) is the public name for TokenTimer's existing CertOps architecture. Technical references retain the certops namespace, including API paths, configuration, and agent protocols.

CLM automates supported certificate workflows. The control plane schedules the work, signs the job, and records what happened. Execution stays where the certificates live. Agents connect outbound from your environment, and the control plane never receives certificate private keys.

Three execution modes can be mixed in one workspace:

  • TokenTimer agent: outbound-only daemon on your hosts. Install an agent.
  • cert-manager controller: you run TokenTimer's controller image against your cluster (observe or opt-in provision). CLM with ACME and cert-manager.
  • External executors: your scripts report against jobs with a machine API token. Executor API.

Certificate Management opens onto Jobs, Certificates, Renewals, Agents, and Settings. /certops/operations redirects to Jobs. Issue a first certificate from Issue a certificate. Diagnose a certificate that never auto-renews from Renew certificates automatically. Badge meanings live on Certificates.

Scheduled renewals​

The control plane creates a renew job when a managed certificate is due. A job is only scheduled when the certificate has a complete renewal profile, so automation never creates unexecutable work. Agents claim signed jobs over outbound HTTPS. A workspace approval gate can hold a job at pending_approval until a non-requester signs off.

An in-flight cap bounds renewals per CA per workspace. Manual jobs and bulk renew use the same counter (409 CERTOPS_RENEWAL_PER_CA_CAP_EXCEEDED when full). Renewal jobs also draw against the monthly quota on Plan limits. Failed renewals raise cert_renewal_failed; see Certificate renewal failures.

Kill switch. Pause on any Certificate Management tab blocks new jobs and dispatch. Inventory, audit, and evidence keep working while paused. Retrying a stuck renewal setup, detaching a profile, and approving or rejecting an already-queued job stay reachable while paused. Only workspace admins (certops.kill_switch.manage) can toggle it.

The Renewals tab (/certops/renewals) lists renewal profiles and their on/off switches. Renewal timing and previous attempts appear with each certificate in the inventory. On describes the profile, not the kill switch: a certificate can show On while the workspace is paused.

Bulk renew​

POST /api/v1/workspaces/{id}/certops/jobs/bulk-renew queues a renew job for up to 100 certificates. Each item uses the same path as a single manual job (role, kill switch, approval, per-CA cap). The response is 200 with a per-item outcome even when some items failed. Only a malformed body, more than 100 ids, or duplicate ids return 400.

Pass dryRun: true to preflight without writing. Pass a fresh request-level idempotencyKey whenever you intend a new attempt. Without a request-level key, each call creates fresh work; repeated submissions are not idempotent.

Plan availability​

Pro and up

CLM, agents, machine tokens, and the executor API are on Pro and Team. Free returns HTTP 402 PLAN_FEATURE_REQUIRED. A frozen workspace returns HTTP 403 WORKSPACE_FROZEN before the plan check.