Skip to main content
Version: 0.18

Renew certificates automatically

Check the certificate first​

Open Certificates, select the exact managed registration and inspect Certificate management. An active inventory record or a successful issue job alone does not prove automatic renewal. Confirm a linked profile, automation enabled, the renewal lead time and an agent that can act on that target. Renewals lists profiles and AD CS issuers; use Certificates for certificate details.

Follow the issuer's path​

  • ACME: successful issuance normally derives a profile from the proven CA, DNS, command and deployment settings. For an agent-discovered filesystem certificate, Set up renewal requires its recorded deployment path and performs a real renewal. An imported PEM alone has neither that path nor proof of key access. See ACME derivation and adoption.
  • Microsoft AD CS: prepare the local enrollment rule and discovered IIS target, check the CA, independently confirm its key, pin it and run a fresh post-pin check on the enrollment agent. Create New AD CS profile and attach it to the correct management registration with automation enabled. Follow the AD CS walkthrough.
  • Vault publication: the issuer renews and publishes a version. Publication is not installation on consumers; follow Vault distribution for readiness, rollout approvals and per-listener verification.

Confirm eligibility​

  1. The profile is enabled, complete for its issuer and attached to the intended registration. The certificate is inside its lead time and is not retired/revoked.
  2. An online agent declares the required target and capabilities and has the local permissions, credentials and key custody needed by that issuer. AD CS also requires the safe post-pin CA check on that agent.
  3. Workspace pause, approval policy and edition entitlements permit execution. A pending approval is not a running renewal.
  4. The maintenance worker is running. Self-hosted operators check the existing worker-certops service or Helm CertOps CronJob; Cloud operates its control-plane worker. See worker diagnostics.

Confirm the maintenance worker​

For Docker Compose, check the existing worker-certops service; for Helm, check the CertOps CronJob and its recent runs. If no sweep runs, eligible certificates will not produce renewal jobs. See the worker checks for commands and configuration.

Inspect execution and the service​

Follow the job timeline and read-only Agent output. Then inspect the host's installed certificate and make a fresh TLS connection to the actual endpoint with correct hostname and trust validation. Compare the new fingerprint and expiry. For IIS this is IIS rebinding, not a blanket restart; for Vault verify each consumer independently.

A bulk-renew request with dryRun: true previews admission/profile resolution without writing jobs. A signed no-op checks dispatch/reporting; neither proves issuance, installation or reload. AD CS preflight is a real read-only inspection, not a signed dry-run enrollment.

Make failures visible​

Route renewal-failure notifications to a deliverable contact group and check delivery separately. A saved route or eligible alert is not a recorded delivery. See renewal diagnostics and API reference for scheduler outcomes, profile controls, logs and failure routing.

Open renewal diagnostics and API reference.