Check health, license and logs

Commands with the parameter -CertificateId, and -Id of the certificate commands, expect the id of the certificate, not its name. TLSPilot assigns this id when the certificate is created. Read it once and pass it on:

$id = (Get-TLSPilotCertificate -Id 'web01.example.com').certificateId

Get-TLSPilotCertificate -Id accepts the id or the name. New-TLSPilotCertificate returns the new certificate with its id in the property id, for example $cert.id in chapter Create a certificate and add a deployment.

The module includes two health commands. Get-TLSPilotApiHealth checks whether the management service itself is running. Test-TLSPilotHealth checks whether the certificates managed by TLSPilot are actually in use on their targets. It runs the same check as the Desktop Admin console.

Get-TLSPilotApiHealth
Test-TLSPilotHealth
Test-TLSPilotHealth -CertificateId $id

For a monitoring probe, -Quiet reduces the result to a single true or false. This way, the probe fails as soon as TLSPilot reports an unhealthy certificate:

if (-not (Test-TLSPilotHealth -Quiet)) {
    throw 'TLSPilot reports an unhealthy certificate'
}

Get-TLSPilotOperation shows whether TLSPilot is busy. Check this before you start work of your own. Get-TLSPilotLog returns the operational, audit or debug log:

Get-TLSPilotOperation
Get-TLSPilotLog -Kind audit -Take 50

The audit log (-Kind audit) requires the permission canManageRbac. With the default -Kind all, the audit entries are left out for other users.

Get-TLSPilotLicense shows the license, including how many certificate seats are in use. Invoke-TLSPilotLicenseCheck runs the online check and refreshes the local lease. This command shows whether issuing is currently blocked, for example because the license is in use on another management host.

Get-TLSPilotLicense
Invoke-TLSPilotLicenseCheck