Rotate a credential

Credentials are the one setting that is regularly changed by a script. Set-TLSPilotCredential creates, updates or renames a credential, depending on what you pass. An unknown target creates a new credential, and a known target updates it. -Id together with -DisplayName renames a credential without breaking the deployments that use it.

$secret = Read-Host -AsSecureString 'New password'
Set-TLSPilotCredential -Target 'iis-web01' -Kind winrm `
    -User 'DOMAIN\svc-tlspilot' -Secret $secret

-Kind defines what the credential is used for: dns, winrm, ssh, f5, palo, palo-scm, uag, azure, google, aws, smtp, zerossl or custom. If you omit -Secret when updating a credential, the stored secret is kept. This way, you can correct a user name without entering the password again.

To show or delete a credential, use Get-TLSPilotCredential and Remove-TLSPilotCredential:

Get-TLSPilotCredential -Target 'iis-web01'
Remove-TLSPilotCredential -Target 'iis-web01'