Skip to main content

Use the Cloud setup guide

The Cloud 0.18 setup guide helps you reach one useful result, then find it in the same workspace. Use a workspace administrator account for the full procedure and the host access listed by each certificate task.

These steps accompany the Cloud 0.18 rollout. If Setup guide is not yet visible in your account, use the manual Quickstart.

Watch on YouTubeWatch the full series

The video follows the shared setup workflow. Cloud handles platform email and workers; scheduled provider sync is available only in self-hosted editions.

Open the guide​

Use Preferences → Setup guide → Open setup guide. For certificate work, use Certificate Management → Settings → CertOps quickstart. An existing session offers Continue instead of starting a new one. Keep the selected workspace when following links.

Choose the result you need:

  • Track assets: monitor a website, enter asset metadata, import a file, or scan a supported service.
  • Alerts: configure recipients, thresholds and delivery timing.
  • Certificate Management: discover certificates, issue and renew with ACME, connect Microsoft AD CS, or share a certificate through Vault.

Certificate operations require a Pro or Team workspace. On Free, use website SSL monitoring, manual assets, file imports and the available service scans; CertOps setup offers an upgrade path or directs a workspace member to its billing owner. Before certificate operations begin, the guide checks the selected workspace's entitlement and your role. Monitor setup shows remaining token capacity, and imports enforce the insertion limit when saving selected assets. A saved CertOps session remains resumable after upgrading, but cannot continue certificate operations while the workspace is on Free. Hosted TokenTimer operates the control-plane workers and email transport; configure recipients and delivery preferences in the guide, while the agent and certificate services stay on your network.

First website and alert route​

  1. Choose Monitor a website certificate, enter a reachable HTTPS URL, and review its check interval and optional health checks.
  2. Submit and inspect the actual certificate expiration returned by the endpoint.
  3. Select the contact group for this asset. Creating a group makes it available; selecting it assigns this asset's notification route.
  4. Review inherited or overridden thresholds and the workspace delivery window/timezone. Positive threshold days are before expiry, zero is the expiry date, and negative days are after it.
  5. Read the guide's verification results, finish, and find the same certificate and monitor in Asset Inventory and Endpoint & SSL monitoring. Reload to confirm the saved result.

The guide checks saved state. Selecting an email channel or seeing SMTP configured is not proof of delivery. Use the first-asset email check to test transport, routing, queue processing and the inbox.

Certificate setup: guide, host, result​

For a first setup, keep the guide open while you follow its generated host instructions:

  1. Prepare the local configuration, then install/register the agent or choose My agent is already set up. Merge changes into an existing configuration; preserve its enrolled identity and permissions.
  2. Run the signed no-op test with execution.enabled: true and execution.dryRun: true. Dry-run complete for a no-op proves signed dispatch/reporting, not the permissions or outcome of a later issuance or deployment.
  3. Complete the goal-specific checks. AD CS additionally needs read-only CA/template checks, independent pin comparison and a fresh post-pin check.
  4. Before issuance, enrollment or deployment, deliberately set local execution.dryRun to false, restart only the agent, and return to the same guide.
  5. Follow the actual operation and inspect the service independently. Finishing the guide is not proof that a replacement is served live.

Continue with Linux ACME, Windows/IIS, Microsoft AD CS, or Vault distribution. Existing agents can also perform OS trust-store operations; that is not a separate onboarding goal.

Use the host editor and terminal to merge the guide's generated configuration, save it, restart the agent and verify the live service. After confirming the CA certificate, choose Run post-pin check in the guide. It dispatches a fresh read-only CA/template check on the selected Windows agent; profile setup waits for its safe result. Refresh check result retries a failed status read without creating another check. For Vault, it also runs signed checks, assigns consumers, returns their configuration revisions and deploys the selected published version, with timelines and read-only Agent output in place. At consumer preparation, choose Distribute certificate files only or Distribute and reload a service. Files-only delivery needs no web service or TLS listener and completes from fresh installation evidence; service delivery additionally reloads and verifies the listener. Terminal TokenTimer API commands are not required for this first distribution. Return to the same saved guide after each host action.

Start again without deleting records​

Preferences → Setup guide → Start over resets your guide progress, not workspace inventory or job history. For a new Vault distribution, leave existing-distribution reuse off; reusing a verified distribution is a separate explicit choice. If a supposedly new step is already Done, inspect the selected distribution and session before submitting again. Repeating an identical idempotent request can return an earlier job; it does not prove a fresh operation.