Certificate Automation
Overview
Certificate Lifecycle Management (CLM) is the public name for TokenTimer's existing CertOps architecture. Technical references retain the certops namespace, including API paths, configuration, and agent protocols.
CLM automates supported certificate workflows. The control plane schedules the work, signs the job, and records what happened. Execution stays where the certificates live. Agents connect outbound from your environment, and the control plane never receives certificate private keys.
Three execution modes can be mixed in one workspace:
- TokenTimer agent: outbound-only daemon on your hosts. Install an agent.
- cert-manager controller: you run TokenTimer's controller image against your cluster (observe or opt-in provision). CLM with ACME and cert-manager.
- External executors: your scripts report against jobs with a machine API token. Executor API.
Certificate Management opens onto Jobs, Certificates, Renewals, Agents, and Settings. /certops/operations redirects to Jobs. Issue a first certificate from Issue a certificate. Diagnose a certificate that never auto-renews from Renew certificates automatically. Badge meanings live on Certificates.
Enabling automation
CERTOPS_ENABLED=true
Restart the API and worker. When CLM is off, token, agent, and executor routes return 404 and the Certificate Management tabs are unreachable. See Configuration and Enable CLM.
Scheduled renewals
The control plane creates a renew job when a managed certificate is due. A job is only scheduled when the certificate has a complete renewal profile, so automation never creates unexecutable work. Agents claim signed jobs over outbound HTTPS. A workspace approval gate can hold a job at pending_approval until a non-requester signs off.
An in-flight cap bounds renewals per CA per workspace. Manual jobs and bulk renew use the same counter (409 CERTOPS_RENEWAL_PER_CA_CAP_EXCEEDED when full). Set the cap with CERTOPS_RENEWAL_PER_CA_CAP. Failed renewals raise cert_renewal_failed; see Certificate renewal failures.
Kill switch. Pause on any Certificate Management tab blocks new jobs and dispatch. CERTOPS_ENABLED remains a separate deployment-wide gate. Inventory, audit, and evidence keep working while paused. Retrying a stuck renewal setup, detaching a profile, and approving or rejecting an already-queued job stay reachable while paused. Only workspace admins (certops.kill_switch.manage) can toggle it.
The Renewals tab (/certops/renewals) lists every renewable certificate and the profile on/off switch. On describes the profile, not the kill switch: a certificate can show On while the workspace is paused. On also does not reflect CERTOPS_ENABLED. See Kill switch vs the platform flag.
Bulk renew
POST /api/v1/workspaces/{id}/certops/jobs/bulk-renew queues a renew job for up to 100 certificates. Each item uses the same path as a single manual job (role, kill switch, approval, per-CA cap). The response is 200 with a per-item outcome even when some items failed. Only a malformed body, more than 100 ids, or duplicate ids return 400.
Pass dryRun: true to preflight without writing. Pass a fresh request-level idempotencyKey whenever you intend a new attempt. Without a request-level key, each call creates fresh work; repeated submissions are not idempotent.