Keep it renewing · 7.8
Where you see the state
Desktop, WebUI and Get-TLSPilotCertificate show the same times. A date and time uses the culture of that computer or browser and always has a four-digit year. The Next action column is wide enough for the full text.
| Next action | Meaning | Colour |
|---|---|---|
| Renewal: date and time | The planned renewal. Plain text if it is more than 24 hours away. | Green |
| Issue: date and time | Never issued. Plain text if it is more than 24 hours away. | Green |
| Deploy: date and time | The planned deployment in the regular cycle. | Green |
| Deploy: date and time | A deployment outside the regular cycle. | Orange |
| Renew & Deploy: date and time | Renewal and deployment together, see chapter When renewal and deployment run together. | Orange |
| Rescue: date and time | One immediate attempt shortly before or after expiry. | Orange |
| Retry: date and time | The attempts are used up. The next cycle tries again. | Orange |
| Pending issue: date and time | An issue started and is not finished. No time if none is planned. | Orange |
| Waiting for CA approval | An Enterprise CA request waits for approval. Not a failure. | Orange |
| Waiting date and time | Manual DNS: the TXT record is not published yet. | Orange |
| Retry renewal: date and time | The renewal failed. The time of the next attempt. | Red |
| Retry deploy: date and time | The deployment failed and a target certificate expires before the next cycle. | Red |
| Retry renew & deploy: date and time | The combined renewal and deployment failed in the renewal step. | Red |
| Retry revoke: date and time | The revocation at the CA failed and is retried. | Red |
| Expired, Error | Expired with no attempt planned, or unreadable. The tooltip names the error. | Red |
| Renewal in progress | Running now. Also Issuance, DNS validation, Deployment, Health check, Revoke, Delete in progress. | Blue |
| Disabled, Revoked | Nothing is planned. | Grey |
Deployments column. The column in the certificate list shows a check mark or a cross and the number of healthy deployments, for example (1/1). It shows only the result of the last health check of the enabled deployments and projects nothing. A renewed certificate that waits for its deploy does not change it while the target holds a valid earlier certificate. The cross appears when the deploy fails or the next health check reports Drift or another faulty state.
Health & History. The tab of a deployment shows the last health status on top: the mark, the status, the time of the last check and the error text. Below it, the history lists the recorded deploy and health events, newest first, without a planned entry. The plan is in the Certificate timeline and in the Next action column.
Certificate timeline. The green dash marks the planned renewal. The blue dash marks the planned deployment, the first regular cycle at or after the planned renewal. If both are at the same time, the two dashes sit directly next to each other. The legend has the rows Planned renewal and Planned deployment. The timeline also shows Issued, Expires, Today, the window bands and the failure mark. Get-TLSPilotCertificate returns the planned times as NextRenewal and NextDeployment.
Dashboard, Deployments. The tile is laid out like Certificates: Health OK and Awaiting deploy in the first row, Not OK in the second. Each enabled deployment is counted once. Awaiting deploy counts deployments whose renewed certificate waits for its deploy and that have a completed health check whose last result is not faulty. A deployment that was never checked, a failed deploy or health check, and Drift count as Not OK.
Deployments tile
| DEPLOYMENTS | |
|---|---|
| Health OK | Awaiting deploy |
| Not OK | |