Skip to main content
Version: 0.18

Use the setup guide

The setup guide helps you reach one useful result, then find it in the same workspace. It does not replace the host prerequisites for certificate operations.

Use a workspace administrator account for the full configuration workflow. Ask your instance administrator to check email delivery if it has not been configured yet.

Watch on YouTubeWatch the full series

Open the guide​

Use Preferences → Setup guide → Open setup guide. For certificate work, use Certificate Management → Settings → CertOps quickstart. An existing session offers Continue instead of starting a new one. Keep the selected workspace when following links.

Choose the result you need:

  • Track assets: monitor a website, enter asset metadata, import a file, or scan a supported service.
  • Alerts: configure recipients, thresholds and delivery timing.
  • Certificate Management: discover certificates, issue and renew with ACME, connect Microsoft AD CS, or share a certificate through Vault.

Only goals supported by your edition and role are available. Complete installation and enable CertOps on the API and maintenance worker before an automation goal. Core and Enterprise use this same guided host workflow; Enterprise entitlements still govern its additional features.

First website and alert route​

  1. Choose Monitor a website certificate, enter a reachable HTTPS URL, and review its check interval and optional health checks.
  2. Submit and inspect the actual certificate expiration returned by the endpoint.
  3. Select the contact group for this asset. Creating a group makes it available; selecting it assigns this asset's notification route.
  4. Review inherited or overridden thresholds and the workspace delivery window/timezone. Positive threshold days are before expiry, zero is the expiry date, and negative days are after it.
  5. Read the guide's verification results, finish, and find the same certificate and monitor in Asset Inventory and Endpoint & SSL monitoring. Reload to confirm the saved result.

The guide checks saved state. Selecting an email channel or seeing SMTP configured is not proof of delivery. Use the first-asset email check to test transport, routing, queue processing and the inbox.

Certificate setup: guide, host, result​

For a first setup, keep the guide open while you follow its generated host instructions:

  1. Prepare the local configuration, then install/register the agent or choose My agent is already set up. Merge changes into an existing configuration; preserve its enrolled identity and permissions.
  2. Run the signed no-op test with execution.enabled: true and execution.dryRun: true. Dry-run complete for a no-op proves signed dispatch/reporting, not the policy or success of a later issuance or deployment.
  3. Complete the goal-specific checks. AD CS additionally needs read-only CA/template checks, independent pin comparison and a fresh post-pin check.
  4. Before issuance, enrollment or deployment, deliberately set local execution.dryRun to false, restart only the agent, and return to the same guide.
  5. Follow the actual operation and inspect the service independently. Finishing the guide is not proof that a replacement is served live.

Continue with Linux ACME, Windows/IIS, Microsoft AD CS, or Vault distribution. Existing agents can also perform OS trust-store operations; that is not a separate onboarding goal.

Use the host editor and terminal to merge the guide's generated configuration, save it, restart the agent and verify the live service. The guide runs the AD CS post-pin check inline. For Vault, it also runs signed checks, assigns consumers, returns their configuration revisions and deploys the selected published version, with timelines and read-only Agent output in place. At consumer preparation, choose Distribute certificate files only or Distribute and reload a service. Files-only delivery needs no web service or TLS listener and completes from fresh installation evidence; service delivery additionally reloads and verifies the listener. Terminal TokenTimer API commands are not required for this first distribution. Return to the same saved guide after each host action.

Start again without deleting records​

Preferences → Setup guide → Start over resets your guide progress, not workspace inventory or job history. For a new Vault distribution, leave existing-distribution reuse off; reusing a verified distribution is a separate explicit choice. If a supposedly new step is already Done, inspect the selected distribution and session before submitting again. Repeating an identical idempotent request can return an earlier job; it does not prove a fresh operation.