PowerShell module · 17.13
Command reference
The following table lists all commands of the module, what they do and which permission they require. A dash means that no special permission is required beyond access to TLSPilot itself. The permission names are those described in chapter RBAC.
| Command | What it does | Permission |
|---|---|---|
| Session, status and logs | ||
Set-TLSPilotBaseUrl | Points the current session at a management host. | – |
Get-TLSPilotStatus | Version, license usage, service state and last cycle. | – |
Get-TLSPilotApiHealth | Confirms that the Management API answers. | – |
Get-TLSPilotOperation | Shows whether a management operation is running. | – |
Get-TLSPilotLog | Reads the operational, audit or debug log. | –; canManageRbac for -Kind audit |
Get-TLSPilotMe | Lists the permissions you hold. | – |
| License | ||
Get-TLSPilotLicense | Reads the license, including seat usage. | – |
Invoke-TLSPilotLicenseCheck | Runs the online license check. No -WhatIf. | canManageLicense |
Unlock-TLSPilotLicense | Binds this host using a one-time key. Single use, no -WhatIf. | canManageLicense |
| Certificates | ||
Get-TLSPilotCertificate | Lists certificates and their current state. | – |
New-TLSPilotCertificate | Creates a certificate, optionally in DNS-01 Alias Mode. | canCreateCertificates |
Set-TLSPilotCertificate | Saves a changed certificate; switches DNS-01 Alias Mode with -DnsValidation and -DnsAliasDomain. No -WhatIf. | canModifyCertificate |
Get-TLSPilotDnsAliasRecords | Lists the CNAME records for DNS-01 Alias Mode. Local, no DNS query. | – |
Test-TLSPilotDnsAliasRecords | Checks these CNAME records over DNS over HTTPS. Local. | – |
Remove-TLSPilotCertificate | Removes a certificate from TLSPilot. | canDeleteCertificate |
Invoke-TLSPilotCertificateRenew | Forces a renewal now. | canForceRenew |
Export-TLSPilotCertificate | Exports the certificate or key as PFX or PEM, with chain options. | canExportKeyMaterial |
Invoke-TLSPilotCertificateRevoke | Revokes the certificate at the CA. Cannot be undone. | canRevokeCertificate |
Invoke-TLSPilotCertificateRollback | Activates a retained earlier version. | canModifyCertificate |
Get-TLSPilotCertificateVersion | Lists the retained versions. | – |
| Deployments | ||
Get-TLSPilotDeployment | Lists the deployments of a certificate. | – |
New-TLSPilotDeployment | Adds a deployment target, for file targets with chain options. | canEditDeployments |
Set-TLSPilotDeployment | Changes, enables or disables a target. | canEditDeployments |
Remove-TLSPilotDeployment | Removes a target. The certificate stays installed on it. | canEditDeployments |
Start-TLSPilotDeployment | Installs the current certificate on its targets again. | canDeploy |
Test-TLSPilotDeployment | Probes a target without installing anything. | canDeploy |
Get-TLSPilotDeploymentHistory | Lists past attempts and their results. | – |
| Cycle and health | ||
Start-TLSPilotCycle | Runs the daily cycle now, for the whole host. No -WhatIf. | canTriggerCycle |
Test-TLSPilotHealth | Checks whether certificates are in use on their targets. | canDeploy, for -DeploymentId |
| Credentials | ||
Set-TLSPilotCredential | Creates, updates or renames a credential. | canManageCredentials |
Get-TLSPilotCredential | Lists credentials. Never returns the secret. | – |
Remove-TLSPilotCredential | Deletes a credential. | canManageCredentials |
| Backup | ||
New-TLSPilotBackup | Creates a configuration backup. | canManageSettings |
Get-TLSPilotBackup | Lists the backups on the management host. | canManageSettings |
Remove-TLSPilotBackup | Deletes one backup file. | canManageSettings |
| Private CA | ||
Get-TLSPilotPrivateCa | Private CA state and current version. | – |
Export-TLSPilotPrivateCa | Writes the CA certificate to a file. | canManageSettings |
Export-TLSPilotPrivateCaCrl | Writes the certificate revocation list to a file. | canManageSettings |
| Configuration | ||
Get-TLSPilotConfig | Reads the configuration document. | – |
Get-TLSPilotAcmeProvider | Lists the configured ACME providers, optionally filtered with -Id. | canManageSettings |
Set-TLSPilotAcmeEmergency | Switches the global emergency option Renew immediately on CA emergency on or off (-Enabled). | canManageSettings |