Renewal
| Case | When | What happens |
|---|
| Target certificate expires before the next cycle | As soon as the certificate held on a target expires before the next cycle. | Renews and deploys at once. If a newer certificate already exists, TLSPilot only deploys it. The column shows Renew & Deploy: and the time, in orange. |
| CA pulls the ARI window forward | When the CA moves the window forward. | Renew immediately on CA emergency ON: renews and deploys at once. OFF: stores a new random time in the first tenth of the new window, renews then and deploys at the next cycle. |
| Force renew, Renew from API / CLI / PowerShell | When you start it. A Renew without Force issues only when the certificate is due. | Renews and deploys at once. |
| New certificate | With Issue now at once, with Next cycle in the next cycle. | Issues and deploys the certificate. |
| Manual DNS-01 | When the order starts; checks the TXT record every 15 minutes. | Sends the TXT records to the mail channel at the start of the order, a reminder at the remaining lifetime set under Reminder (remaining lifetime) and then every 24 hours. The column shows Waiting and the time of the next check. |
| Enterprise CA waiting for approval | In every cycle. | The column shows Waiting for CA approval. It is not a failure and sends no failure alert. The cycle asks the CA again. After the approval, the next cycle deploys. |
Deploy
| Case | When | What happens |
|---|
| Deployment fails | During a deployment. | Sends Failed deploy. There is no retest. The next cycle tries again. |
| Certificate is busy | When another operation runs on the same certificate. | Each certificate has its own lock; the others stay usable. The column shows Renewal in progress, Health check in progress or Deployment in progress, in blue. |
| Custom deployment without health check script | In every cycle. | Deploys only when the target does not hold the current certificate. Drift cannot be detected. |
Cycle
| Case | When | What happens |
|---|
| Run deployment & health cycle now | When you start it. | Runs the same cycle at once. For alerts it counts as an action that you start, see chapter Alerts. |
| Run deployment & health cycle now while a cycle runs | When you start it. | The request is rejected. |
| Certificate is busy during the cycle | Another operation holds the lock of the certificate. | The cycle tries that certificate again after 30 seconds, up to 20 times. The alert Cycle finished with failures waits for these retries. |
| License expired | At the cycle time. | The cycle is skipped (event 1106). |
Health, Drift and Manual check needed
| Case | When | What happens |
|---|
| Drift in the cycle | Health check in the cycle. | Deploys the current certificate, then checks the health after the deployment. |
| Unknown in the cycle | The target holds the current certificate. | No deployment. Sends Deploy warnings. |
| Unreachable in the cycle | Health check in the cycle. | No deployment. Before the renewal threshold of the certificate on the target: Deploy warnings. At the threshold or expired: Failed deploy. |
| Never deployed | In the cycle. | Deploys, unless the target is unreachable. |
| Drift remains after the retest | 60 seconds after a deployment. | Sets Manual check needed and sends Deploy warnings. |
| Unreachable at the retest | 60 seconds after a deployment. | No mark and no alert from this check. The result is stored as the health of the deployment. |
| Previous state not fully restored | A deployment reports that it could not fully restore the previous state. | Sets Manual check needed at once, without a retest, and sends Deploy warnings. |
| Manual check needed in the cycle | Every cycle, also Run deployment & health cycle now. | Exactly one deployment attempt, without a health check first, then the health check with its retest after 60 seconds. Healthy clears the mark. Otherwise the mark and the Deploy warnings alert stay, and the next cycle tries again. The cycle attempt does not clear the mark beforehand. |
| Deployment started by you | When you deploy. | Clears Manual check needed before the attempt. Then the health check with its retest after 60 seconds, as in the cycle. |
Backstop and expiry rescue
| Case | When | What happens |
|---|
| Backstop | In every cycle. | Renews a renewal that is overdue or has failed, asks again for an Enterprise CA request that is waiting for approval, and continues a manual DNS-01 order that is waiting for its TXT record. A renewal from the backstop is deployed in the same cycle. |
| Newer certificate exists, deployment fails | A target holds a certificate that expires before the next cycle, a newer certificate exists, and the attempts are not exhausted. | Deploys the newer certificate at once. If that fails, it tries again after 15 minutes. |
| Expiry rescue after exhausted attempts | The attempts are exhausted and an active target holds a certificate that has expired or expires before the next cycle. | Exactly one immediate attempt: Renew & Deploy, or only a deployment if a newer certificate already exists. Success resets the retry state. If it fails, there is no further attempt until the next cycle, also not after a restart of the service; then the backstop takes over. Manual DNS-01 orders and Enterprise CA requests waiting for approval do not start it. |
Service restart
| Case | When | What happens |
|---|
| Missed renewal | Shortly after the service starts. | A renewal whose stored time has passed runs at once, without a new time. It deploys at the next cycle, unless a case from chapter When renewal and deployment run together applies. |
| Missed cycle | After the service starts. | Not repeated. The next cycle runs at the next configured time. |
| Missed weekly report | After the service starts. | If the time of the weekly report passed while the service was stopped, the report is sent once, also after several missed weeks. It covers the seven days from the send time. |
| Health | After the service starts. | No health check at the start. The stored health state stays. |
Alerts
Each alert is sent only if its entry is switched on under Notify On in an active alert profile. Trigger: Cycle covers the cycle and the other automatic tasks. With Cycle and Manual, the profile also alerts for actions that you start yourself, for example Renew, Deploy, a health check or Run deployment & health cycle now. The column Trigger shows which setting a case needs.
| Alert (Notify On) | When it is sent | Trigger |
|---|
| Failed issue / renew | The first failure of a renewal at once. Retries send nothing. When the attempts are exhausted, one alert. After that, the backstop alerts at most once per day (UTC). A successful renewal resets this; the state survives a restart. | Cycle. Your own actions: Cycle and Manual. |
| Successful issue / renew | After a successful issue or renewal. | Cycle. Your own actions: Cycle and Manual. |
| Successful deploy, Failed deploy | After a deployment. At most one deployment alert per target and cycle. | Cycle. Your own actions: Cycle and Manual. |
| Deploy warnings | From the cycle (Unknown, Unreachable before the threshold, previous state not fully restored, Manual check needed stays) and when Drift remains after the retest. | Cycle. Your own actions: Cycle and Manual. |
| Failed health check | Only after a health check that you start: Drift or Unknown at once. Unreachable sends Deploy warnings while the certificate on the target is before the renewal threshold and Failed deploy at the threshold or expired, if that entry is switched on; otherwise Failed health check when the Unreachable results in a row reach Failures before notify (default 2). | Only Cycle and Manual. Automatic checks never send it. |
| Certificate expiring soon | After a cycle, for the certificate on the targets, from the middle of its renewal window, once per certificate version. | Cycle. Run deployment & health cycle now: Cycle and Manual. |
| Cycle finished with failures | After a cycle with failed deployments or health checks. There is no success summary. | Cycle and Cycle and Manual, also for Run deployment & health cycle now. |
Mail channels send at most 10 alert mails per minute. Further mails wait and go out later; the recipients of the active alert profiles get the notice Alert emails are throttled. Other channel types are not throttled.
