When the renewal runs

For a certificate that is already issued, TLSPilot stores one random UTC instant and renews at that instant. The instant is not chosen again while the renewal window stays the same.

• Without ARI (Private CA, Enterprise CA, or ACME with no usable CA window): a random instant in the first tenth of the renewal window, and not later than the end of the day on which the window opens, in the local time of the management host.
• With ARI: the same rule, applied to the CA suggested window. The CA window takes precedence over the slider.

The instant is stored with the certificate. TLSPilot draws a new one only when the window changes: the slider is edited, an Enterprise CA template follow changes the window, or an ARI window moves by more than one hour. A shift of one hour or less keeps the stored instant.

In the last cycle before the certificate expires there is no random draw. When TLSPilot stores the planned renewal for a window for the first time, it is the start of the window if that is still ahead, or the moment of storing if the window is already open. A planned renewal stored earlier for the same window keeps its time. The renewed certificate is deployed in that last cycle. If the planned renewal is less than 1 hour before that cycle, or after it, renewal and deployment run together at the planned renewal. A planned renewal exactly 1 hour before that cycle still deploys in the cycle. ARI windows follow the same rules.

The renewal does not deploy. The new certificate is deployed at the next cycle, because the certificate on the target differs from the current one. The manual DNS TXT alert is sent when that renewal actually starts. There is no business-hours limit on that alert.