Skip to content

Knowledge Base · Category 17

PowerShell module

14 articles

TLSPilot includes its own PowerShell module, which is installed on the same host as TLSPilot, the management host.

Chapter overview

The module is built for unattended automation, such as scheduled tasks, CI/CD pipelines, runbooks and monitoring probes. Tasks you perform once with a form in front of you, such as creating tenants, configuring alert channels, assigning roles or restoring a backup, remain in the Desktop Admin console and the WebUI. The module exports the commands listed in Table Commands of the PowerShell module. Each command runs as the Windows account you are signed in with, so your TLSPilot role decides what you are allowed to do, see chapter RBAC.

Articles in this category

  1. 17.1

    Requirements

    To use the module, the following requirements must be met:

  2. 17.2

    Import the module and check the connection

    Import the module and check that the management service answers:

  3. 17.3

    Find the commands and their help

    All commands follow the PowerShell verb-noun convention and include full help with examples:

  4. 17.4

    Check health, license and logs

    Commands with the parameter -CertificateId, and -Id of the certificate commands, expect the id of the certificate, not its name.

  5. 17.5

    Create a certificate and add a deployment

    Create the certificate first, then add one or more deployments to it.

  6. 17.6

    List and check the CNAME records of DNS-01 Alias Mode

    Two commands help you prepare the CNAME records for DNS-01 Alias Mode before you create the certificate, or hand them to the team that manages the production zone.

  7. 17.7

    Renew a certificate and run the cycle

    TLSPilot renews a certificate at its planned time and deploys it on the next cycle, see chapter Keep it renewing.

  8. 17.8

    Export a certificate

    Some systems cannot be reached by a deployment and need the key material as a file. -OutFile writes the file.

  9. 17.9

    Roll back or revoke after an incident

    TLSPilot keeps previous versions of a certificate. If a new certificate causes a problem, list the versions and activate an earlier one:

  10. 17.10

    Rotate a credential

    Credentials are the one setting that is regularly changed by a script. Set-TLSPilotCredential creates, updates or renames a credential, depending on what you pass.

  11. 17.11

    Create backups on a schedule

    A nightly backup is a typical scheduled task:

  12. 17.12

    Distribute the Private CA certificate and the CRL

    Every client that has to trust certificates of the built-in Private CA needs the CA certificate and ideally also the certificate revocation list.

  13. 17.13

    Command reference

    The following table lists all commands of the module, what they do and which permission they require.

  14. 17.14

    Limits and safety notes

    Some tasks are deliberately left to the user interface, and some commands cannot be undone: