Skip to content

Windows Agent - install and setup

The CertIntel Agent is a local certificate lifecycle service. It can:

  • issue and renew certificates with its embedded ACME client;
  • answer CertIntel Delegated DNS-01 challenges;
  • store certificates in Windows stores or protected files;
  • update IIS bindings, reload supported web servers, run an approved local installation program, or restart a selected Windows service;
  • inventory local TLS endpoints, certificate files and Windows certificate stores; and
  • scan internal endpoints assigned to it by CertIntel.

The service owns configuration, credentials, ACME state and private keys. The desktop app and CLI are local administration clients over an administrator-only named pipe. CertIntel does not have a remote shell or a general remote-command channel into the machine.

Requirements

  • Windows x64 and local administrator rights for installation.
  • .NET 10 Desktop Runtime (x64) for the desktop app. The MSI checks for this runtime.
  • Outbound HTTPS to your CertIntel API, the selected ACME certificate authority, and the signed release endpoints if automatic updates are enabled.
  • Working DNS resolution. DNS-01 propagation checks may query authoritative, public and machine-configured resolvers.
  • Java keytool.exe only when creating or monitoring a Java keystore.

The service is named CertIntelAgent and runs as LocalSystem. The default locations are:

Item Default location
Program files C:\Program Files\CertIntel\CertIntelAgent
Service data C:\ProgramData\CertIntelAgent
Local pipe \\.\pipe\certintel-agent
Event source CertIntelAgent in the Windows Application log

Routine activity is retained in the agent's own journal and shown on Activity. Only actionable errors are copied to the shared Windows Application event log.

Open an elevated PowerShell 5.1 or newer terminal, download the installer, and review it before running it:

$installer = Join-Path $env:TEMP 'Install-CertIntelAgent.ps1'
Invoke-WebRequest -UseBasicParsing `
  'https://assets.certin.tel/downloads/agent/install.ps1' `
  -OutFile $installer

$token = Read-Host 'CertIntel install token' -AsSecureString
try {
  & $installer -InstallToken $token
} finally {
  $token.Dispose()
}

The online installer reads the signed release manifest, downloads the MSI and local installer wrapper, and verifies their SHA-256 hashes, pinned Authenticode signer, and MSI identity. It does not add a root certificate, weaken execution policy, or place the SecureString value in the child command line.

To use an existing API key instead of an install token:

$key = Read-Host 'CertIntel API key' -AsSecureString
try {
  & $installer -ApiKey $key
} finally {
  $key.Dispose()
}

Use -ApiBase 'https://your-certintel-server.example' for another CertIntel origin. Do not append /api/v1. -NonInteractive makes a new, unconnected installation fail instead of prompting. An upgrade of a connected installation preserves its existing origin and credential.

You can also download the stable MSI and verify it against the release manifest.

MSI deployment

Interactive installation:

msiexec.exe /i .\CertIntelAgent.msi

The MSI accepts INSTALLTOKEN, APIKEY, and APIBASE for managed deployment:

msiexec.exe /i "C:\Deployment\CertIntelAgent.msi" `
  INSTALLTOKEN="cit_REPLACE_WITH_TOKEN" `
  APIBASE="https://api.certin.tel" /qn /norestart

Supply INSTALLTOKEN or APIKEY, never both. Windows Installer marks these properties hidden and passes the value to the installed CLI through standard input. A secret placed directly on the msiexec command line can still appear in shell history, process inspection, or deployment-system logs. Prefer the PowerShell SecureString installer or your deployment platform's protected secret transport.

A bare MSI is allowed. It starts in setup required state and performs no background scan or certificate work until connected from Settings or the CLI.

Connect or rotate a credential

In the desktop app, open Settings → API / Server details. A fresh setup accepts an install token or API key. Once connected, the same section can replace a rotated API key or disconnect the machine.

CLI equivalents, run elevated:

certintel-agent enroll --api-base https://api.certin.tel
certintel-agent register --api-base https://api.certin.tel
certintel-agent status --json
certintel-agent diagnostics

enroll prompts for an install token; register prompts for an API key. Add --stdin for protected automation input. The CLI deliberately rejects secret values as command-line arguments.

Enrollment exchanges the token once for a machine credential, protects the credential locally, and discards the install token. If your organization requires agent approval, reporting remains rejected until an administrator approves the new device on the CertIntel Agents page. A saved local credential alone does not mean approval is complete; use Test connection and Activity to confirm.

Disconnecting removes the local platform credential and queued platform reports, but retains certificate workflows, ACME keys, issued certificates and local monitor configuration. Revoke the old key in CertIntel separately when retiring the device.

Desktop app

The app has six sections:

  • Overview — certificate, monitor and attention summaries.
  • Workflows — create and manage ACME renewals, storage and installation.
  • Agent Monitors — configure TLS endpoints, certificate files and stores.
  • Activity — friendly normal activity with optional debug details, copy and export actions.
  • Settings — connection, theme, retention, renewal windows, local file permissions and automatic updates.
  • Jobs — queued/recent operations and automatic renewal schedule.

Scan and Report, Test connection, and Refresh remain available at the top of the window. Settings and configuration actions apply immediately; there is no global Save button. Choose Light or Dark under Settings → Theme; that preference is saved for the Windows user running the desktop app.

Updates

Windows update checking and verified automatic installation are enabled by default. They can be controlled in Settings → Updates. The service checks two independent records:

  • https://assets.certin.tel/downloads/agent/latest.json
  • https://api.certin.tel/api/v1/releases/agent/latest.json

Both records must be fresh and exactly equal. The downloaded MSI must also match the authorized SHA-256, pinned signer, product/package identity and compiled UpgradeCode. The service rechecks both records after download before starting Windows Installer. Redirects, downgrades and changed/expired authorization are rejected. Linux packages do not use this Windows MSI update path.

Upgrade and repair

Normal MSI upgrades preserve data and the connected credential. Upgrading from the earlier CertIntelAgentV2 service migrates its supported state into C:\ProgramData\CertIntelAgent and retains the old tree as a recovery copy. Do not run both services concurrently. If another application references an export path under the old directory, update that application manually; agent migration cannot rewrite arbitrary application configuration.

Settings → Secret and configuration permissions can check or restore ACLs on config.json and encrypted secret files. It does not rewrite exported certificate files or application folders. CLI equivalents are:

certintel-agent permissions check
certintel-agent permissions restore

Secrets use machine-scope DPAPI and restrictive ACLs. This protects against unrelated unelevated users, not against LocalSystem or a local administrator.

Next steps