Skip to main content

Renew certificates automatically

Check the certificate first​

Open Certificates, select the exact managed registration and inspect Certificate management. An active inventory record or a successful issue job alone does not prove automatic renewal. Confirm a linked profile, automation enabled, the renewal lead time and an agent that can act on that target. Renewals lists profiles and AD CS issuers; use Certificates for certificate details.

Follow the issuer's path​

  • ACME: successful issuance normally derives a profile from the proven CA, DNS, command and deployment settings. For an agent-discovered filesystem certificate, Set up renewal requires its recorded deployment path and performs a real renewal. An imported PEM alone has neither that path nor proof of key access. See ACME derivation and adoption.
  • Microsoft AD CS: prepare the local enrollment rule and discovered IIS target, check the CA, independently confirm its key, pin it and run a fresh post-pin check on the enrollment agent. Create New AD CS profile and attach it to the correct management registration with automation enabled. Follow the AD CS walkthrough.
  • Vault publication: the issuer renews and publishes a version. Publication is not installation on consumers; follow Vault distribution for readiness, rollout approvals and per-listener verification.

Confirm eligibility​

  1. The profile is enabled, complete for its issuer and attached to the intended registration. The certificate is inside its lead time and is not retired/revoked.
  2. An online agent declares the required target and capabilities and has the local permissions, credentials and key custody needed by that issuer. AD CS also requires the safe post-pin CA check on that agent.
  3. Workspace pause, approval policy and edition entitlements permit execution. A pending approval is not a running renewal.
  4. The maintenance worker is running. Self-hosted operators check the existing worker-certops service or Helm CertOps CronJob; Cloud operates its control-plane worker. See worker diagnostics.

Maintenance scheduling​

Hosted TokenTimer operates the maintenance worker. Check the certificate's renewal eligibility, workspace state and job/approval status first; the diagnostic reference explains those outcomes.

Inspect execution and the service​

Follow the job timeline and read-only Agent output. Then inspect the host's installed certificate and make a fresh TLS connection to the actual endpoint with correct hostname and trust validation. Compare the new fingerprint and expiry. For IIS this is IIS rebinding, not a blanket restart; for Vault verify each consumer independently.

A bulk-renew request with dryRun: true previews admission/profile resolution without writing jobs. A signed no-op checks dispatch/reporting; neither proves issuance, installation or reload. AD CS preflight is a real read-only inspection, not a signed dry-run enrollment.

Make failures visible​

Route renewal-failure notifications to a deliverable contact group and check delivery separately. A saved route or eligible alert is not a recorded delivery. See renewal diagnostics and API reference for scheduler outcomes, profile controls, logs and failure routing.

Open renewal diagnostics and API reference.