Certificate Automation
Overview
CertOps renews certificates end to end. The control plane schedules the work, signs the job, and records what happened. Execution stays where the certificates live. TokenTimer never connects into your network and never touches private keys.
Three execution modes can be mixed in one workspace:
- TokenTimer agent: outbound-only daemon on your hosts. Install an agent.
- cert-manager controller: you run TokenTimer's controller image against your cluster (observe or opt-in provision). CertOps with ACME and cert-manager.
- External executors: your scripts report against jobs with a machine API token. Executor API.
Certificate operations opens onto Jobs, Certificates, Renewals, Agents, and Settings. /certops/operations redirects to Jobs. Issue a first certificate from Issue a certificate. Diagnose a certificate that never auto-renews from Renew certificates automatically. Badge meanings live on Certificates.
Enabling automation
CERTOPS_ENABLED=true
Restart the API and worker. When CertOps is off, token, agent, and executor routes return 404 and the Certificate operations tabs are unreachable. There is no plan gating. See Configuration and Enable CertOps.
Scheduled renewals
The control plane creates a renew job when a managed certificate is due. A job is only scheduled when the certificate has a complete renewal profile, so automation never creates unexecutable work. Agents claim signed jobs over outbound HTTPS. A workspace approval gate can hold a job at pending_approval until a non-requester signs off.
An in-flight cap bounds renewals per CA per workspace. Manual jobs and bulk renew use the same counter (409 CERTOPS_RENEWAL_PER_CA_CAP_EXCEEDED when full). Set the cap with CERTOPS_RENEWAL_PER_CA_CAP. Failed renewals raise cert_renewal_failed; see Certificate renewal failures.
Kill switch. Pause on any Certificate operations tab blocks new jobs and dispatch. CERTOPS_ENABLED remains a separate deployment-wide gate. Inventory, audit, and evidence keep working while paused. Retrying a stuck renewal setup, detaching a profile, and approving or rejecting an already-queued job stay reachable while paused. Only workspace admins (certops.kill_switch.manage) can toggle it.
The Renewals tab (/certops/renewals) lists every renewable certificate and the profile on/off switch. On describes the profile, not the kill switch: a certificate can show On while the workspace is paused. On also does not reflect CERTOPS_ENABLED. See Kill switch vs the platform flag.
Bulk renew
POST /api/v1/workspaces/{id}/certops/jobs/bulk-renew queues a renew job for up to 100 certificates. Each item uses the same path as a single manual job (role, kill switch, approval, per-CA cap). The response is 200 with a per-item outcome even when some items failed. Only a malformed body, more than 100 ids, or duplicate ids return 400.
Pass dryRun: true to preflight without writing. Pass a fresh request-level idempotencyKey whenever you intend a new attempt. Omitting it derives bulk-renew:auto:<certificateId>, which is reused forever and will replay or conflict on a later batch of the same certificates.