My first deployments · 6.3
Tabs Manual and Discovery
On this page
For Windows and Linux targets, the deployment dialog has two tabs below Target host and Credential: Manual and Discovery. In Manual, you type the values into plain text fields. In Discovery, TLSPilot reads the possible targets directly from the server, for example the websites of IIS or the network policies of NPS, and you only switch on what should receive the certificate. This avoids typing errors and shows at a glance which certificate is bound today.
The tab Discovery is available for these targets:
- Windows: IIS, SQL Server, NPS (RADIUS), Exchange and RDS. AD FS has no tab Discovery.
- Linux: Nginx, Apache, HAProxy and Tomcat. PostgreSQL, MySQL/MariaDB and File Path (SSH) show only the tab Manual.
- Azure: App Service, Key Vault, API Management, Application Gateway and Front Door.
- Appliances: NetScaler.
All other targets show only the plain form with text fields. The tab Discovery is available as soon as all required fields of the deployment except the object name are filled; until then it is greyed out and its tooltip names what is missing. These fields are, for Azure for example the tenant, the subscription, the resource group and the resource name. You select the entries with their toggles. The deployment dialog always opens on the tab Manual.
Use the tab Discovery
- Select the Linked service and enter the Target host.
- Select the Credential. For Localhost, no credential is required: TLSPilot reads the target as LocalSystem on the management host.
- Open the tab Discovery. TLSPilot reads the list only when you click the tab, connects with the selected credential and shows the progress while it reads. Click Refresh to read the list again, for example after a change on the server.
- Switch on the entries that should receive this certificate. Each entry has its own toggle. Click OK and then Save.
How to read the list
- Toggle on the left: Switched on means that the deployment writes this certificate to the entry.
- First line: Name of the entry with further details, for example the port, the SNI host name, the order of a network policy or the expiry date of the certificate currently bound. Binding is created on deploy means that there is no matching binding yet and the deployment creates it.
- Grey second line: currently on target shows the name and the first characters of the thumbprint of the certificate bound today.
- Groups: If a target has several kinds of bindings, the results are grouped under subtitles, for example IIS, SMTP and Send Connectors for Exchange.
A badge next to each entry shows its state. Figure IIS deployment, tab Discovery with one toggle per binding shows this certificate and other certificate for IIS, Figure NPS deployment, tab Discovery with network policies shows Not found on target for NPS.
| Badge | Meaning |
|---|---|
| this certificate | The entry already uses the certificate of this deployment. TLSPilot switches the entry on automatically. |
| other certificate | The entry uses a different certificate. Switch it on if this certificate should replace it. |
| Not found on target | The entry is saved in the deployment, but the server does not have it, for example because a network policy was renamed or deleted. Switch it off, or create the entry on the server again. |
If no certificate is bound to an entry, it has no badge, and the grey second line shows none.
Rules
- Your selection is kept: Entries that are saved in the deployment, and entries with this certificate, are switched on after loading. When you open a saved deployment again, your selection is kept.
- The list is reloaded: If you change the linked service, the target host or the credential, TLSPilot discards the list. Open the tab Discovery again or click Refresh.
- Manual is always possible: If the target cannot be reached from the management host during setup, enter the values in the tab Manual.
- Reading changes nothing: The tab Discovery only reads. The certificate is written only by the deployment after OK, Save and Deploy.