Certificate workflows and deployment¶

The Windows Agent contains an ACME client. A workflow owns the certificate policy, ACME account, Delegated DNS-01 mapping, renewal state, storage destinations and application installation steps. It also reports check-in and renewal outcomes to CertIntel. You do not need simple-acme, Certbot or Posh-ACME for an agent-managed workflow.

Private keys are generated and retained locally. They are never returned by the local management API or included in CertIntel reporting.

Create a workflow¶

Open Workflows → New certificate. The six-step wizard asks for:

the application or output type;
certificate names, ACME account, CA and key type;
a CertIntel DNS delegation for each base domain;
a storage destination;
application installation details; and
a final review before saving and issuing.

New ACME accounts have a name chosen by the administrator, a contact email and a directory URL. Existing accounts appear by that name for reuse. Let's Encrypt supports Default, TLS Server and Short-Lived profiles when the CA advertises them; custom ACME directories do not show Let's Encrypt-only profiles. External Account Binding (EAB) keys can be added or rotated from Manage workflow for an account that requires EAB.

The wizard creates a disabled draft first, saves DNS/output secrets through the protected service API, restores the selected automatic-renewal setting, then queues issuance. If a later step fails, the draft remains available rather than losing already entered configuration.

Identity fields do not change in place¶

The renewal ID, names, ACME account, key type and CA policy are treated as the workflow's issuance identity and cannot be edited after creation. The directory of an existing ACME account is also locked. Changing these values underneath an existing order can invalidate persisted state or violate replacement policy.

Create a new workflow when you need a different CA, account, domain set, key type or profile. Display names, account labels/contact details, automatic renewal and storage/installation plans can be updated without changing issuance identity.

Workflow actions¶

Action	What it does
Issue / replace	Starts the first order, resumes safe persisted state, or issues a replacement after confirmed revocation.
Renew now	Requests a new certificate before its scheduled renewal time. CA rate limits and retry state still apply.
Retry installation	Reuses the already-issued certificate and reruns storage/installation. It does not create an ACME order or DNS challenge.
Revoke	Requests CA revocation. Revoked workflows are not automatically replaced.
Auto-renew	Allows the service to renew when the persisted CA/lifetime schedule says the certificate is due.

The Workflows table shows issuance status, expiration and installation status. Queued and recent operations appear in the activity popup and on Jobs. The popup follows only the requested job/workflow and starts at the newest activity.

Renewal windows¶

Settings → Renewal windows can limit unattended renewal and automatic installation retries to one or more weekly windows. Times use the agent machine's local time zone. An end earlier than the start creates an overnight window; for example, Tuesday 22:00 to 02:00 closes Wednesday at 2 AM.

No configured window means unrestricted operation. Windows apply to automatic renewal and automatic/retry delivery. First issuance and actions explicitly started by an administrator, including Renew now and Retry installation, run immediately as deliberate overrides.

Storage destinations¶

A certificate can have multiple storage/installation plans, except a JKS CSR workflow, which uses one dedicated JKS plan because its private key remains inside that keystore.

Destination	Result
Windows certificate store	Installs into a Local Computer personal store such as `My` or `WebHosting`. The private key is non-exportable unless explicitly allowed. Read access can be granted to selected users/services. Trust stores such as Root, CA, AuthRoot and Disallowed are not valid deployment targets.
PEM	Writes leaf certificate, encrypted PKCS#8 private key, full chain and chain-only `.pem` files.
CRT / KEY	Writes a leaf `.crt`, password-encrypted PKCS#8 `.key`, and chain `.crt`.
DER / CER	Writes the public leaf certificate only as `.cer`.
PKCS#7	Writes the public certificate chain only as `.p7b`.
PFX / PKCS#12	Writes certificate, private key and chain in one password-protected `.pfx`.
IIS Central Certificate Store	Writes one password-protected PFX per DNS name. Wildcards use IIS's `_.example.com.pfx` naming.
Java keystore (JKS)	Creates/reuses the configured alias in one exact `.jks` file, creates the CSR with `keytool`, and imports the issued reply into that alias.

File outputs use stable names and atomic replacement. Keep previous files can place changed files in a separate backup directory with timestamped names.

Private-key files are always encrypted. The wizard accepts a password when another application must know it. If no password is supplied for a new protected output, the service generates a strong random password directly into encrypted storage and never exposes it. Use a supplied password for software that must open the PFX, encrypted PEM/KEY or JKS itself. Public .cer, .crt and .p7b outputs do not contain a private key.

On Windows, the destination additionally grants access only to SYSTEM, Administrators and explicitly selected reader accounts. Use a dedicated output directory; do not choose an application's shared configuration directory for a normal file output because the agent manages the output directory's ACL.

Java keystores¶

For JKS, select:

the exact absolute .jks path;
the Java runtime's absolute keytool.exe path;
a simple alias;
the keystore/key password; and
optional read access accounts for the JKS file.

The containing directory must already exist and retains its current directory permissions. If the JKS already exists, enter its current password. If the alias does not exist, keytool creates a keypair and CSR in that alias. The CA reply is then imported back into the same alias. Temporary CSR/reply/import files are deleted after use.

Optionally select Restart a Windows service after installing the certificate. The picker shows installed service display names and stores the exact service name, so the correct instance can be selected when several Tomcat services exist. The restart runs only after a successful import. If import succeeds but restart fails, Retry installation recognizes the certificate already in the JKS and proceeds to the restart rather than treating the duplicate import as a new failure.

Installation options¶

IIS imports into WebHosting by default and creates or updates one selected HTTPS site binding. SNI is off by default for a normal Windows-store binding. Central Certificate Store requires SNI and enables it automatically. Unrelated sites and bindings are preserved.
NGINX writes PEM files, tests the selected configuration and requests a graceful reload only after the check succeeds.
Apache writes PEM files, tests the selected configuration and reloads or restarts the configured server/service.
Tomcat writes a protected PFX and restarts the selected Windows service.
JKS can restart the selected Windows service as described above.
Certificate File can run an administrator-selected absolute .exe or .ps1 with a bounded timeout after files are written. Hook output is discarded because arbitrary programs may print secrets.

Installation failure retains the issued certificate and records a retryable delivery failure. It does not trigger another CA order.

Edit or delete a workflow¶

Use Manage workflow to edit the display name/renewal preference, account label and contact data, DNS delegation credentials, output passwords, and attached storage/installation plans. Plans can be added, edited or removed without losing the issued certificate. Updating an issued plan queues installation of the current certificate.

Deleting a workflow removes its agent-owned certificate state and any ACME account, DNS mapping/secret, output password or plan that is no longer shared by another workflow. It does not revoke the certificate or delete certificates/files already installed outside the agent's state directory.

CLI equivalents¶

The desktop app is the normal setup experience. Useful elevated CLI operations include:

certintel-agent acme accounts --json
certintel-agent acme orders --json
certintel-agent acme issue WORKFLOW-ID
certintel-agent acme renew WORKFLOW-ID
certintel-agent acme force-renew WORKFLOW-ID
certintel-agent acme revoke WORKFLOW-ID
certintel-agent deployments retry WORKFLOW-ID
certintel-agent jobs get JOB-ID --json

Queueing succeeds before the operation necessarily finishes; use the returned job ID, Jobs, Activity, or status --json for the final result.