Appendix: Automatic tasks and timings · 23.1

Automatic tasks: standard cases

Task	When	What happens
Renewal time	When the renewal window of the certificate opens. TLSPilot presets the window to one third of the validity, at most 30 days.	TLSPilot stores a random time in the first tenth of the window, or of the ARI window of the CA, not later than the end of that day. It draws a new time only when the window changes. In the last cycle before the certificate expires there is no random time. The time stored for a window for the first time is the start of the window if that is still ahead, or the moment of storing if the window is already open; a time stored earlier keeps. If it is less than 1 hour before that cycle, or after it, renewal and deployment run together at that time; exactly 1 hour before still deploys in the cycle. The column shows Renewal: and that time.
Renewal	At the stored time, between the cycles.	Renews the certificate and does not deploy it. The column shows Deploy: and the time of the next cycle, the tile Deployments counts Awaiting deploy if the deployment has a completed health check whose last result is not faulty.
Retry after a failed renewal	15 minutes after the failure, up to Max. renewal attempts (default 3, from 1 to 10). If the certificate expires earlier, the last attempt is 5 minutes before expiry.	The column shows Retry renewal: and the time, in red. After the last attempt it shows Retry: and the time of the next cycle, in orange, and the backstop of each cycle tries again until a renewal succeeds.
Cycle	Daily at the Daily cycle time (default 02:00, local time of the management host). Run deployment & health cycle now starts it at once.	Deploys, checks the health of every deployment, issues certificates set to Next cycle and runs the backstop. It does not run the regular renewal. A missed cycle is not repeated.
Deploy at the next cycle	In the next cycle after a renewal.	Deploys the renewed certificate to every target, without a health check first. Then the health check after the deployment runs.
Health check in the cycle	In every cycle, for every deployment, also when nothing was renewed.	Healthy: nothing to do. Drift: TLSPilot deploys the current certificate again, then checks the health after the deployment.
Health check after a deployment	Right after each deployment, from the cycle or started by you.	Healthy ends the deployment. Drift or Unreachable does not count yet: the check runs again after 60 seconds. If Drift remains, the deployment is marked Manual check needed.
Manual health check	When you click Check Now or Health Check….	Clears Manual check needed before the check and checks the target.
Alerts	After each event that is switched on under Notify On in an alert profile.	Automatic tasks alert every active profile. Actions that you start yourself, also Run deployment & health cycle now, alert only profiles with Trigger: Cycle and Manual. Renewal failures are throttled, see chapter Alerts.
Weekly report	Weekly at the Weekday and Time under Weekly report (default Monday 08:00, local time of the management host), only when it is enabled.	Mails the Upcoming week report as a PDF file to the Recipients through the selected Mail channel. If sending fails, TLSPilot tries again after 5 minutes. See chapter Create alerts.