Windows Agent - install and setup¶

The CertIntel Agent is a local certificate lifecycle service. It can:

• issue and renew certificates with its embedded ACME client, following the CA's renewal window (ARI) when it offers one;
• answer CertIntel Delegated DNS-01 challenges;
• store certificates in Windows stores or protected files;
• update IIS bindings, reload supported web servers, run an approved local installation program, or restart a selected Windows service;
• bind certificates to Microsoft server roles such as Exchange, Remote Desktop, RRAS, SQL Server, AD FS, NPS and WinRM (Microsoft services);
• deploy certificates to F5 BIG-IP, FortiGate, PAN-OS, NetScaler ADC and SonicWall appliances over their management API (Remote & appliance deployment);
• inventory local TLS endpoints, certificate files and Windows certificate stores;
• scan internal endpoints assigned to it by CertIntel; and
• report the servers on its computer that use a certificate, so the dashboard can list them and pre-fill a workflow (Server detection).

This page describes Agent 1.9.0. The service owns configuration, credentials, ACME state and private keys. The desktop app runs without administrator privileges and asks Windows for approval the first time you change something (see Administrator approval). Privileged work runs in the LocalSystem service and its separate deployment worker. CertIntel has no remote shell or general remote-command channel into the machine.

Requirements¶

• Windows x64 and a local administrator account for installation and for using the desktop app. A standard user sees An administrator account is required and a Restart as administrator button.
• .NET 10 Desktop Runtime (x64) for the desktop app and the deployment worker. The MSI checks for a 10.0.x Desktop Runtime and stops with a message pointing to the download page if it is missing. The online installer downloads and verifies it for you.
• Outbound HTTPS to your CertIntel API, the selected ACME certificate authority, the signed release endpoints if automatic updates are enabled, and the management interface of any appliance a workflow deploys to.
• Working DNS resolution. DNS-01 propagation checks may query authoritative, public and machine-configured resolvers.
• No inbound port. ACME names are validated with Delegated DNS-01.
• Java keytool.exe only when creating or monitoring a Java keystore.

The service is named CertIntelAgent and runs as LocalSystem. The installation paths are fixed; the MSI does not support relocating them.

Routine activity is retained in the agent's own journal and shown on Activity. Only errors are copied to the Windows Application event log, including a CertIntelAgent service failed: ... event if the service cannot start.

Recommended installation¶

On the dashboard's Install Tokens page, click Install commands (or Show) on your organization's token row. The token page that opens, at its Install on Windows section, generates a one-line command that downloads the CertIntel bootstrap from https://certin.tel/install.ps1; the list page itself shows only the token's prefix and no command. Installing a single machine by hand? Mint a one-time install token from the same page or the Agents page instead: it is shown once with these same commands, enrolls exactly one agent and expires on its own; see Install tokens & enrollment. The bootstrap:

1. reads the current release record from two independent sources (assets.certin.tel and api.certin.tel) and refuses to continue if they disagree or the record has expired;
2. downloads the versioned, Authenticode-signed installer script install-windows.ps1 and checks its SHA-256 and signer thumbprint (once the updated bootstrap is published, the check of the self-signed signature works on Windows in any display language; the current one may stop with does not have the expected intact CertIntel signature on a non-English Windows that does not trust the signing certificate yet; then verify and run the installer yourself as described in Verifying the scripts yourself);
3. runs that installer, which downloads the matching MSI, checks its size, SHA-256, signature and MSI identity, installs the .NET 10 Desktop Runtime if needed, installs the MSI, and connects the agent with your token.

Open PowerShell as administrator and run the generated command. It looks like this:

$env:CI_INSTALL_TOKEN = "cit_..."
& ([scriptblock]::Create((irm https://certin.tel/install.ps1)))

The Installation options on that token page change what is appended to that command:

A number outside its range disables the copy buttons with, for example, Agent monitor interval, hours: enter a whole number from 1 to 720, or leave it empty for the installer default. An invalid setting value passed to the installer another way fails the MSI's launch conditions before anything is installed: a silent run ends with exit code 1603 and the installer log names the option.

A cmd.exe (elevated) command is also offered, for deployment and RMM tools; the chosen options are added inside its quotes:

set CI_INSTALL_TOKEN=cit_...
powershell -NoProfile -ExecutionPolicy Bypass -Command "& ([scriptblock]::Create((irm https://certin.tel/install.ps1)))"

The bootstrap also accepts these environment variables instead of switches: CI_API_BASE, CI_API_KEY (a cik_ agent key, to reconnect an existing device instead of enrolling a new one), CI_NONINTERACTIVE=1, CI_RESET_EXISTING_DATA=1, CI_TRUST_CODE_SIGNING_CERT=1 and, for the agent settings above, CI_INSTALL_OPTIONS="NAME=VALUE NAME=VALUE" (space-separated; the Linux bootstrap uses CI_AGENT_SETTINGS and --agent-setting key=value instead, applied with certintel config set after installation). Supply a token or an agent key, never both. An ordinary integration key is not a substitute for enrolling an Agent: certintel register and Connect with API key refuse one and say to create an install token on the Install Tokens page and enroll with it.

Use a real cit_ token with no added label, quotes, spaces, or newline inside the value. Input is passed exactly; malformed or altered credentials are not silently repaired. The installer clears the token from its environment before launching child processes. Clear it in your own shell afterwards and never save a populated command in tickets, logs or source control.

What you will see¶

• Resolving the current CertIntel Agent release and Downloading and verifying the installer, then the installer's own steps: checking the authorized release, installing .NET if needed, downloading and verifying the Agent, installing, and Connecting this computer to CertIntel.
• On an interactive run with an existing installation: An existing CertIntel Agent installation or saved data was found. Choose K to keep the connection, workflows, certificates, configuration and logs (default) or R to remove everything and start over. Removal requires typing REMOVE.
• A failure prints CertIntel Agent installation failed during '<step>': .... Existing protected agent data is retained.

After install-token enrollment, the device is pending approval; reporting stays rejected until an administrator approves it on the CertIntel Agents page. See Install tokens & enrollment.

Verifying the scripts yourself¶

The bootstrap does the download and signature checks for you. If your policy requires reviewing scripts before execution, download install-windows.ps1 from the versioned release directory listed in the release record, compare its SHA-256 with the record's installWindowsSha256 value, and inspect its signature:

Get-AuthenticodeSignature -FilePath .\install-windows.ps1 | Format-List Status, StatusMessage
(Get-AuthenticodeSignature -FilePath .\install-windows.ps1).SignerCertificate.Thumbprint

The signing certificate is currently self-signed, so Status shows UnknownError with the message A certificate chain processed, but terminated in a root certificate which is not trusted unless you have trusted the certificate. That is the expected result. What matters is the thumbprint DD3F69F48412C05A9365E4863B7FFFBE254FE62D and an intact signature; confirm the thumbprint with your administrator or another trusted source. Stop on HashMismatch, NotSigned, a different signer, or any other error. Do not disable verification to get past a failure.

Then run the saved script directly in an elevated prompt. It takes the same -ApiBase, -InstallToken, -ApiKey, -NonInteractive and -ResetExistingData parameters; -TrustCodeSigningCertificate exists only on the bootstrap, so trust the signing certificate yourself if you need to. When you run the signed installer directly (not through the bootstrap), inherited CI_INSTALL_TOKEN / CI_API_KEY environment variables are used only with -NonInteractive and -AllowEnvironmentCredentials; otherwise it stops with Inherited environment credentials require an explicit automation opt-in. Interactive runs prompt for the token without echo.

MSI deployment¶

The MSI installs the binaries and service only. It does not accept connection credentials. INSTALLTOKEN, APIKEY and APIBASE are not MSI properties: Windows Installer ignores unknown properties, and the machine is left in setup required state until you connect it from Settings or the CLI.

Download the current MSI and its release record:

• certintel-agent_windows_amd64.msi
• info.json

Install interactively or silently:

msiexec.exe /i .\certintel-agent_windows_amd64.msi
msiexec.exe /i .\certintel-agent_windows_amd64.msi /qn /norestart

The public MSI properties are the install options below and REMOVEALLDATA. A fresh installation starts with the defaults in the table; an option that is not given keeps the default on a fresh installation and the saved setting on an upgrade. The same settings are changed later with certintel config set (certintel config set --help), in the desktop app or in the terminal interface. The PowerShell installers pass them through with -InstallOption NAME=VALUE.

An invalid option value fails the launch conditions before anything is installed (exit code 1603 for a silent install; the log names the option).

msiexec.exe /i .\certintel-agent_windows_amd64.msi /qn /norestart AUTOUPDATEINSTALL=1 RENEWALCHECKINTERVALMINUTES=360 ASSIGNMENTAUTOAPPLY=0

After the MSI finishes it verifies that the installed version matches the package and that the service starts and answers within 60 seconds; otherwise Windows Installer rolls the installation back. A downgrade is refused with A newer CertIntel Agent version is already installed.

Then connect the machine:

• In the desktop app, open Settings → API / Server details and enter the install token or agent API key, or
• run certintel enroll --api-base https://api.certin.tel (install token) or certintel register --api-base ... (agent API key) in an elevated prompt, with your deployment's agent address. Both prompt for the secret without echo; add --stdin for automation. Secrets are never accepted as command-line arguments.

For a fully offline installation, the release also contains a signed install.ps1 wrapper that takes -MsiPath and a mandatory -ExpectedSha256 (from the release record), verifies the MSI's hash, signature and identity in a protected staging folder, installs it silently, and then connects the agent with the credential you pass or type.

Connect, reconnect or disconnect¶

In the desktop app, Settings → API / Server details accepts an install token or API key for a fresh setup. Once connected, the same section can replace a rotated API key or disconnect the machine. Changing the API origin of a connected host is refused until you disconnect first.

CLI equivalents, run elevated:

certintel enroll --api-base https://api.certin.tel
certintel register --api-base https://api.certin.tel
certintel unregister
certintel status
certintel diagnostics

certintel status prints a short summary: the platform connection and when the Agent last reported, reports waiting, an available update, the configuration lock and running jobs, then one row per certificate - problems first - with its state, expiry and next renewal or retry, and the error, the revocation and the next step under it. certintel certificates list prints the certificate rows. Add --json for every field.

Enrollment exchanges the token once for a machine credential, protects the credential locally, and discards the token. An enrollment that failed without creating anything (a wrong, used or expired token, a refused request, a DNS, connection or TLS failure) does not block the next attempt, and the failure names its cause. Only when the platform may have created a key (the request was sent and no definite answer came back) is the next attempt blocked; the message then says to disable or delete the pending agent with this computer's name on the Agents page, run certintel unregister (or Disconnect) and enroll again, with a new token if a one-time token was used. A saved local credential alone does not mean approval is complete; use Test connection and Activity to confirm. Test connection reports Approval required: Approve this agent in the CertIntel dashboard, then test the connection again. while the device is pending. Other requests the pending Agent makes on its own (the heartbeat, reports, the Private CA probe) are refused with HTTP status 428. The Agent records that once, as an approval-pending event (Waiting for administrator approval in the CertIntel dashboard (CertIntel HTTP 428 from ROUTE); Private CA, Internal TLS Probe - Cloud, AD CS and CRL cloud checks resume after approval), reports approval_pending: true in certintel status --json, and logs approval-granted (This agent was approved in the CertIntel dashboard; cloud checks resume and the Private CA availability is being checked) when it notices the approval. It is not a key or network fault: the platform is waiting for an administrator to click Approve on the Agents page.

Once approved, the service sends a short heartbeat to CertIntel at start, after a new or changed connection, and then about hourly. It carries only the computer name and the version, operating system and architecture already in the agent's request header, so a device with no monitors, no assigned checks and no certificate work still shows as online on the Agents page with its current version. A successful heartbeat updates the local Last check-in time; failures are retried without touching the report queue. The Agent also sends one the moment it notices it was approved and then about every minute for 15 minutes, and every answer carries whether the key may request Private CA certificates and how many active CAs exist, so a permission granted shortly after approval is seen within about a minute (see Enabling it for an Agent).

Disconnecting removes the local platform credential and queued reports but retains certificate workflows, ACME keys, issued certificates and local monitor configuration. CertIntel marks the device unregistered and its key stops working; delete it on the Agents page, or Re-register or Rotate it there to let the device back in (subject to the plan's Agents limit).

Through a proxy¶

The Agent service (CertIntelAgent) makes every connection to CertIntel, the ACME CA and the delegated DNS-01 API itself, with the same HTTPS client as the Linux Agent. That client reads the HTTPS_PROXY and NO_PROXY environment variables; it does not use the proxy configured in Windows (Internet Options or netsh winhttp). To send the service through a proxy, set HTTPS_PROXY (and NO_PROXY if needed) as system environment variables and restart the computer, so that the service starts with them. This has not been tested on Windows; the proxy behaviour was verified on Linux only.

Command-line configuration¶

Everything the desktop app saves can also be changed from an elevated prompt with the Agent's versioned configuration transaction:

certintel --json config get                       # non-secret configuration, with its revision
certintel validate --file C:\certintel\config.json
certintel config apply --file C:\certintel\config.json
certintel workflows create --template ID --certificate-id ID --domains NAMES [...]
certintel lock --reason "Change freeze"           # configuration lock
certintel lock status
certintel unlock
certintel config set renewal-check-interval-minutes=360 assignment-auto-apply=off

config set KEY=VALUE ... changes the settings that the install options set at installation, without the get-edit-apply cycle: update-check, update-auto-install, update-requests (Agent 1.17.0+), update-check-interval-hours, monitor-interval-hours, managed-checks, managed-check-interval-minutes, renewal-check-interval-minutes, assignment-auto-apply and report-detected-servers (see Server detection). Switches take on/off, true/false, yes/no or 1/0.

config get prints one line of JSON. Edit a copy, keep the revision it came with, validate, then apply; config apply refuses with conflict: configuration changed when the revision moved in the meantime. Secrets are never part of the file; set them with certintel secret set …. workflows create builds a certificate and its workflow from a bundled template and applies both for you. See the workflow reference and the complete IIS + Private CA example.

A command that queues a job prints the job's ID and returns at once. certintel jobs list lists the jobs the Agent keeps (its newest 128), newest first: job ID, what it does, certificate, phase and when (--json: the whole jobs). With --wait, certificates issue, renew, force-renew, revoke and discover and deployments retry follow the job instead: they print its progress as it happens and its result, and exit 0 when it completed, 4 when it failed, 5 when the Agent no longer knows the job and 6 when they stopped waiting before it finished. --wait-timeout DURATION (for example 10m, default 30m) bounds the wait; the timeout and Ctrl-C stop the waiting, not the job, which keeps running (follow it with certintel jobs get ID). certintel COMMAND --help prints that command's usage; for certificates issue, renew, force-renew and deployments retry the whole usage: what it does, the ID, how the job is followed, every option and the exit codes.

certintel jobs list
certintel certificates force-renew intranet-iis --wait --wait-timeout 15m

$json | Out-File C:\certintel\config.json -Encoding ascii     # ASCII-only content
[IO.File]::WriteAllText('C:\certintel\config.json', $json, [Text.UTF8Encoding]::new($false))

Configuration lock¶

The configuration lock is a file on the machine that only a local administrator can create or remove. While it exists, the Agent refuses configuration changes proposed by the CertIntel platform. The only such changes are dashboard-assigned workflows; the platform cannot push scripts, hooks or other configuration to an Agent at all. Use it on machines where nobody should be able to change the Agent's workflows from the dashboard, for example during a change freeze.

Turning it on or off

• Desktop app - Settings → Configuration lock: Turn on configuration lock… asks for an optional one-line reason (up to 200 characters) shown with the lock here, in the terminal interface and in the dashboard; Turn off configuration lock… asks for confirmation. Unless the app runs elevated, the CertIntel Agent - administrator approval dialog then confirms the change. While the lock is on, a Configuration lock on badge sits in the window header, and the dashboard assignments section disables Approve… and the auto-apply checkbox.
• Command line (elevated prompt) - certintel lock [--reason TEXT], certintel lock status and certintel unlock. They exit with 0 on success, 1 on an error and 2 when the prompt is not elevated. Without elevation the current state is still visible as config_lock in certintel status --json (locked, since, by, reason, error).

The file is %ProgramData%\CertIntelAgent\config.lock, readable and writable only by SYSTEM and Administrators, and holds {"schema":1,"locked_at":"…","locked_by":"…","reason":"…"}. The service reads it at most once a minute and tells CertIntel within about 30 seconds after noticing a change; the dashboard then shows the Agent as Locked. A file that is damaged or cannot be read counts as locked, with the error shown next to the state, so a broken lock never silently opens up.

Administrator approval in the desktop app¶

The app starts without elevation. Everything is readable, but every change (a setting, a monitor's Enabled box, Auto-renew, a workflow edit, Scan and Report) needs administrator approval. The bottom-right status badge explains the current state:

Some actions show a second, elevated confirmation dialog titled CertIntel Agent - administrator approval that lists exactly what is about to change ("The CertIntel Agent app is asking to make these administrator changes: ... Approve only if you just made these changes."). It always appears for connecting or disconnecting, installing an update, issuing, renewing or revoking a certificate, Install again, deleting a workflow, saving a secret, resolving a DNS delegation, turning the configuration lock on or off, Trust this CA on this computer… (adding a CertIntel Private CA root to the machine's Trusted Root store, restricted to TLS server and client authentication; see Private CA), Approve… and Reject… for a dashboard assignment (the approval dialog lists the whole proposal - certificate, names, issuer, every template setting and whether issuance starts at once - and approves exactly that revision, splitting a long template setting into numbered parts; an assignment too long for the dialog is approved from an elevated prompt with certintel assignments approve ID --revision N instead; the rejection dialog shows the reason that will be sent to the dashboard) and Restore permissions…. For settings changes it appears only when the change is security-sensitive, for example:

• connecting to a different API origin or changing the policy organization;
• adding or changing a TLS probe, certificate file or store monitor target;
• removing a password-protected file monitor (.pfx, .p12, .jks), which also deletes its stored password;
• enabling Check internal endpoints assigned by CertIntel;
• turning on unattended update installation or changing renewal windows;
• turning on the report of detected servers to CertIntel again after it was turned off (turning it off is routine);
• turning on auto-apply for dashboard-assigned workflows, or moving it to another organization. A fresh installation has auto-apply on by default: the consent is recorded as pending at installation and bound at enrollment to the organization the platform reports, so it never carries over to another connection, and an existing installation that upgrades does not gain it. Set it at installation with the ASSIGNMENTAUTOAPPLY install option or change it later with certintel config set assignment-auto-apply=on|off or certintel assignments policy --auto-apply on|off, which also works before the agent is connected and then reports pending;
• adding or changing an ACME account, DNS delegation, workflow step or installation plan.

Notes, enable/disable toggles and appearance changes do not trigger the dialog. Choose No if you did not just make the change. After three declined dialogs the approval helper exits and the next change asks for UAC again.

A long change is shown in full across several dialogs. Each dialog holds up to 12 items; a larger change continues in further dialogs titled part N of M, up to five, and is applied only when every part is approved. Declining any part declines the whole change. Lists that grow with the configuration (certificate names, outputs and installations, step inputs, renewal windows, store name filters) are packed into a few items rather than one item per entry, so a certificate with 100 names takes two dialogs to create or issue. A change that still cannot be shown completely within five dialogs is refused with too many security-sensitive changes to review safely at once; split it.

You have twenty minutes to work through the dialogs of one change. An open dialog does not count as idle time, and a timeout is reported as a timeout rather than counted as a decline.

Creating a certificate workflow from a template takes two dialogs in total: one for the DNS delegation check and one for the save. The save dialog lists the follow-up steps of the same setup (storing the delegation, account, workflow and output secrets, enabling the certificate, and issuing and delivering it) and approves them with it, so those steps are not prompted again. Anything not listed, repeated, or combined with another change is reviewed as before, and a declined save grants nothing.

If you run the whole app elevated, Export… for Activity and workflows is disabled and appearance choices are not saved for the next launch. Reopen the app normally for those tasks.

Messages you may see in the status bar: Administrator approval was cancelled. The change was not saved., The change was not approved. Nothing was saved., Administrator approval expired. Make the change again to approve it.

Desktop app¶

The app has six sections:

• Overview — certificate, monitor and attention summaries, the Check internal endpoints assigned by CertIntel checkbox, and Cloud-assigned monitor results.
• Workflows — create and manage certificate renewals (ACME, or a CertIntel Private CA when the platform offers it to this Agent; the Private CA entry is listed disabled, with the reason, until it can be used), storage and installation, with a Renewal due column and a History… button per certificate. The Renewal due tooltip shows whether the date comes from the CA's renewal window (ARI) or the certificate's lifetime, and the window itself; see when a certificate renews. A renewed certificate waiting for its deployment window shows Waiting for deployment window. The templates of + New certificate workflow are also grouped under Appliances (remote) and Microsoft services, and Detect servers on this computer… is offered to pre-fill a template from this machine's bindings (Server detection).
• Agent Monitors — TLS probes (Add TLS probe…), certificate files (Add file…), Windows stores (Add store…), Configure AD CS Template - Agent… and CRL Distribution Point - Agent entries (add, edit, enable/disable, delete; see CRL monitoring).
• Activity — recent activity with search, Show debug details, History (Latest 500 or All retained logs, loaded in batches with Older), Copy and Export…. Search narrows the displayed page.
• Settings — connection, Appearance, Schedules, Log retention, Renewal windows, Deployment window (the Agent default deployment window, Report the redacted end of a failed step's output to CertIntel and Report the servers detected on this computer to CertIntel, see Server detection), Configuration lock (above), Platform credentials (appliances) (see Remote & appliance deployment), Secret and configuration permissions, and Updates.
• Jobs — queued and recent operations.

Scan and Report, Test connection, Refresh and Pause auto-refresh are at the top of the window. Settings and individual configuration actions apply immediately (after approval); there is no global Save button. Workflow studio keeps a draft until Save workflow; see the studio walkthrough. Whole-number settings outside their range are rejected with Enter a whole number from {min} to {max}. The previous setting is still active.

Schedules¶

Settings → Schedules shows each recurring activity with its last and next run, an interval and a run-now button. Times are the computer's local time.

The defaults can be set for a fleet at installation time with the MSI install options and changed afterwards with certintel config set.

Scan now queues a discovery job; Check now and Purge now mark the activity due and wake the service without changing its schedule. The internal-endpoint interval only controls how often the agent asks CertIntel for due assignments; CertIntel decides how often each endpoint is probed. That row shows Disabled until you turn on Check internal endpoints assigned by CertIntel on Overview.

The renewal check interval is a safety net, not the renewal clock. The service wakes on its own for each certificate's renewal date, retry delay, revocation follow-up, installation retry and next check of the CA's renewal window and the opening of a deployment window; the interval only bounds how long the service goes without evaluating every certificate when none of those is pending. With renewal windows configured, the scheduled check runs once per window at a random time inside it instead, and an overdue renewal is spread into the window the same way.

After installing a managed certificate, re-check monitored TLS endpoints it covers (on by default) re-probes your local TLS monitors whose host is one of the new certificate's names right after installation, so the inventory shows the new thumbprint without waiting for the next scan. See Monitors & internal endpoints.

Log retention¶

Normal logs (days, 1–3650) and Debug logs (days, 1–3650) control how long the journal is kept (defaults 120 and 30). Debug entries are always recorded; show them on Activity with Show debug details. Reducing retention asks for confirmation because older files are removed.

Appearance and Tenant override¶

The desktop app has one look. Under Settings → Appearance, Color mode offers Light or Dark per Windows user. On supported plans the tenant administrator can customize the button colors under Tenant appearance in the dashboard. An approved, install-token-enrolled Agent uses those customized button colors after receiving branding from the platform; Refresh platform theme fetches them now.

Turn Tenant override on to keep the standard colors on this server and stop platform check-ins from changing them; turn it off to follow the tenant again. Agents connected with an integration API key always use the standard colors. Windows high-contrast settings take priority. The appearance status line explains whether the agent is following the tenant, overriding it, waiting for approval, or could not obtain branding.

Agent 1.10.0 and earlier also have a Visual theme list on this page; later versions do not. See Branding & appearance.

Updates¶

Update checking is on by default. From Agent 1.17.0 two separate settings decide whether the Agent installs an update without an administrator at the computer; before 1.17.0 the first one decided both:

Neither needs the other, and turning Check for agent updates off does not stop a requested update. For no update without someone at the computer, turn both off. Control them under Settings → Updates (Check for agent updates, Install verified updates automatically, Allow update requests from CertIntel, Check now, Install update), pass AUTOUPDATEINSTALL=1, UPDATEREQUESTS=0|1 and UPDATECHECK=0|1 at MSI installation, or run certintel config set update-auto-install=on or update-requests=off afterwards.

The service compares two independent release records:

• https://assets.certin.tel/downloads/agent/latest/info.json
• https://api.certin.tel/api/v1/releases/agent/latest.json

Both must be fresh (records are re-signed on a schedule and expire after 30 days), signed by the Agent's built-in Ed25519 trust root, and exactly equal. They bind the version, platform, immutable download URL, exact byte size and SHA-256. The downloaded MSI must also pass Authenticode signer and MSI identity checks and be a newer version than the one installed; the agent never rolls back. The service rechecks both records after download, then runs Windows Installer quietly with a log at C:\ProgramData\CertIntelAgent\update-install.log. Activity records update-available, update-started and update-failed events; started means the installer launched, so confirm the version and service health afterwards.

From an elevated prompt, certintel update check and certintel update install do the same.

Update requests from the dashboard¶

The Agent takes update requests from CertIntel. A user with the agent_updates.create permission (Operator and Administrator) chooses Update now on the Agent's page or Update all outdated on the Agents list, where an Update available x.y.z pill marks outdated Agents. The platform requests; the device decides:

• The Agent picks the request up with its next heartbeat, within about an hour (Agent 1.13.0+: within about a minute).
• It installs only the version in the signed release manifest it verifies itself (at least the requested version and newer than the running one), never a download address from the platform and never an older version.
• It installs it unless Allow update requests from CertIntel is turned off locally (Agent 1.17.0+; on by default); then it refuses (update requests are turned off on the device). It does not need Install verified updates automatically. An Agent before 1.17.0 installs it only when automatic installation is on, and otherwise refuses (automatic installation is off on the device; agents before 1.17.0 need it on for update requests). The configuration lock does not block signed updates.
• A request the Agent refused stays refused: after changing the setting, request the update again.
• It reports each step; the dashboard shows Update requested, Update request sent to the agent, Update accepted, Installing the update, Updated, Update refused or Update failed. The new version reports the result after it starts.
• A request the Agent has not finished expires after 7 days (168 hours) (Update request expired). While it has not been sent yet, Cancel request withdraws it (agent_updates.delete).

Linux uses a different, CLI-driven installation path, and automatic installation on Linux is not available in this release; see Linux Agent.

Upgrade, repair and removal¶

MSI upgrades preserve Agent data and the connected credential. Before the installation commits, the MSI checks the installed CLI version and service health; a mismatch fails the installer transaction and rolls back.

An interactive uninstall asks Remove all CertIntel Agent data too? and explains that this unregisters the agent (its API key stops working) and permanently deletes locally stored certificates, private keys, workflow configuration and logs. No (the default) keeps the data for a later reinstall. A silent uninstall keeps data unless you pass REMOVEALLDATA=1:

msiexec.exe /x "{ProductCode}" REMOVEALLDATA=1 /qn /norestart

Data removal is all-or-nothing: if a folder or registry key cannot be deleted the uninstall fails with CertIntel data erasure was incomplete. Protected data may remain. Fix the lock or permission problem and retry with REMOVEALLDATA=1. Exported certificates in other application directories are never removed by this cleanup.

Settings → Secret and configuration permissions (Check permissions, Restore permissions…) checks or restores access for SYSTEM and Administrators on the agent's configuration and encrypted secret files. Saved keys and settings are retained; folder permissions, jobs, logs and exported certificate files are not changed. Both actions ask for administrator approval when the app is not elevated. CLI equivalents:

certintel permissions check
certintel permissions restore

Secrets use machine-scope DPAPI and restrictive ACLs. This protects against unrelated unelevated users, not against LocalSystem or a local administrator.

Next steps¶

• Create certificate workflows and installation plans
• Use workflow variables, conditions, and deployment examples
• Configure monitors and internal endpoints
• Monitor certificate stores and files
• Connect Delegated DNS-01
• Understand install-token approval