Skip to content

Knowledge Base · Category 7

Keep it renewing

9 articles

Once a certificate is issued, TLSPilot renews it and deploys it as two separate steps. The renewal runs at its own time and does not deploy. The new certificate is deployed at the next cycle, except when the cycle itself renews it. That renewal deploys in the same cycle. This chapter describes that timing.

Articles in this category

  1. 7.1

    Deployment & health cycle

    The deployment & health cycle runs at the daily cycle time (local time of the management host, default 02:00).

  2. 7.2

    When the renewal runs

    For a certificate that is already issued, TLSPilot stores one random UTC instant and renews at that instant.

  3. 7.3

    When renewal and deployment run together

    Renewal and deployment run together in the cases below, and when this cycle renews as the backstop.

  4. 7.4

    Renew immediately on CA emergency

    The switch is in the settings on the tab ACME providers, under DNS-01 propagation wait.

  5. 7.5

    After an outage or an upgrade

    When the service starts, a renewal whose stored time has passed is run immediately.

  6. 7.6

    Enterprise CA waiting for approval

    An Enterprise CA request that is waiting for a CA manager is the state Waiting, in the same way as a manual DNS TXT order.

  7. 7.7

    Retry and failure alert

    A renewal that fails is retried under the renewal attempt limit (settings, tab General, Max. renewal attempts, default 3, from 1 to 10).

  8. 7.8

    Where you see the state

    Desktop, WebUI and Get-TLSPilotCertificate show the same times. A date and time uses the culture of that computer or browser and always has a four-digit year.

  9. 7.9

    What to monitor

    Create at least one alert profile with Trigger: Cycle and switch on Failed issue / renew, Certificate expiring soon, Failed health check, Deploy warnings and Failed deploy, and under System the entries Cycle finished with failures and Service failed.