Deployment & health cycle

The deployment & health cycle runs at the daily cycle time (local time of the management host, default 02:00). You set it in the Initial Setup Wizard, see chapter Daily check, and change it later in the settings on the tab General. A saved time applies at once, without a restart. With an expired license the cycle is skipped (event 1106).

Each cycle does four things. It does not manage the regular renewal.

• Deploy. Targets that do not yet hold the current certificate receive it. A deployment you just added is included. TLSPilot sets Manual check needed when Drift remains after the retest, or when the deploy reports that the previous state could not be fully restored. Each cycle makes one deploy attempt for such a deployment, without a health check first. Then the health check runs, with its retest after 60 seconds. Healthy clears the mark. Otherwise the mark and the Deploy warnings alert stay, and the next cycle tries again. A deploy that you start clears the mark before its attempt, a manual health check before the check; the attempt of the cycle does not.
• Health check. Every deployment is checked, including when nothing was renewed. Between cycles, deployments are also checked after each deployment, with a retest after 60 seconds if that check fails. You can also start a check manually with Check Now on the tab Health & History of the deployment.
• Issue certificates set to Next cycle. A new certificate that you chose to issue on the next cycle is issued in this cycle and deployed.
• Backstop. A renewal that is overdue or has failed, and an Enterprise CA request that is waiting for approval, is tried again and deployed in this same cycle. A renewal planned only for later is left for its own time.

To run the cycle immediately, choose Service, Run deployment & health cycle now in the Desktop Admin console, or the same button in the WebUI. TLSPilot asks Run the deployment & health cycle now instead of waiting for the daily cycle time? Pending certificates are deployed to their targets, all active targets are health-checked, and overdue renewals are caught up. Deployments can briefly interrupt services. Yes starts it. No is the default. Start-TLSPilotCycle runs the same cycle without asking, see chapter Renew a certificate and run the cycle. A missed cycle is not repeated after an outage. The next cycle is the next configured time.

In short. A renewal runs at its own random time in the renewal window and does not deploy. A failed renewal is retried every 15 minutes up to Max. renewal attempts, then by the backstop in each cycle. The next cycle deploys the renewed certificate and checks the health of every deployment; a check right after a deployment that fails is repeated after 60 seconds. Chapter Appendix: Automatic tasks and timings lists all automatic tasks, their times and the alerts.