Certificate formats · 19.5
Which format each target takes
Most targets take a fixed format, which TLSPilot builds automatically. Only the three file targets let you choose the format and the chain options.
| Target | Format TLSPilot delivers | Format and chain |
|---|---|---|
| Windows | ||
| Web UI HTTPS | No file: binds the certificate to the HTTPS listener of the WebUI on the management host. | Fixed |
| Certificate store only, IIS, Remote Desktop Services (RDS), Exchange, AD FS, SQL Server, NPS (RADIUS) | PFX with the private key, imported into LocalMachine\My. | Fixed |
| File Path (WinRM), UNC share | PKCS #8 (PEM), PKCS #1 (PEM RSA), Encrypted PEM or PKCS #12 (PFX), as selected. | Selectable, see chapter Chain options |
| Linux | ||
| Nginx, Apache, PostgreSQL, MySQL/MariaDB | PEM: certificate with chain and a separate private key. | Fixed |
| HAProxy | One combined PEM file: certificate with chain, followed by the private key. | Fixed |
| Tomcat | PKCS #12 keystore. | Fixed |
| File Path (SSH) | As File Path (WinRM). | Selectable, see chapter Chain options |
| Appliances | ||
| F5 BIG-IP, Palo Alto Strata Cloud Manager | PEM certificate and PEM key. | Fixed |
| Palo Alto PAN-OS | PKCS #12. | Fixed |
| UAG (Omnissa) | PEM certificate chain and unencrypted PEM key. | Fixed |
| Cloud | ||
| Azure Key Vault | PKCS #12, stored as certificate or as secret (application/x-pkcs12). | Fixed |
| Azure App Service, Azure Front Door, Azure Application Gateway, Azure API Management, Entra application proxy | PFX with the private key. | Fixed |
| Entra app registration | Public certificate only, without the private key. | Fixed |
| Google Cloud Certificate Manager | PEM certificate and PEM key. | Fixed |
| AWS Certificate Manager (import) | PEM: certificate, chain and key as separate parts. | Fixed |
| Custom | ||
| Custom Deployment | PFX and PEM files on the management host, passed to the script, see chapter Custom Deployment. | Fixed |