Step 8 of 8

8. First certificate on a server

Create an installation plan that installs the certificate on the server’s services and installs the renewed version automatically.

What you need

The server and service where the certificate should be installed (step 5).
The names the certificate should cover (step 6).
A user with the administrator or operator role.

Create the installation plan from the proposals

Open Servers › All servers and click Create installation plans automatically beside the server.
Check the services, names and certificate source in the proposal. Use Change if the certificate should come from another certificate source.
Select the proposals you want to create. After changing the certificate source, you may need to select the row yourself.
Click Create and start N installation plans, where N is the number on the button. Ready installation plans start; the rest are saved under Installation plans › Drafts with the reason.

Proposals that sslbrain cannot safely turn into installation plans appear under Skipped, with the reason. This can happen when discovery has not read the names in the certificate the service currently uses, or when the server information is out of date. Names from the service’s own configuration are not enough: an automatic proposal must not replace a certificate with one that covers fewer names. Use Create plan with these names, or compose the installation plan, and check the names.

Check that it works

On the installation plan, First rollout shows progress: Certificate ordered, Certificate issued and Installed on the services. Open the run with See the result.

Also check the certificate served by the service. For a web service, open its HTTPS address in a browser and view the certificate beside the address bar. Its serial number and expiry date should match the version under Certificates › Automated.

With Order at its default setting, each service is checked after installation before the next receives the certificate. The integration performs its own check; for a web service, it connects to the service’s TLS port and looks for the new version. This is a separate connection from the one used to install the certificate: a working SSH or service agent connection does not show that the service’s port is reachable from where the check runs. If the check fails, the run is marked as failed even if the certificate has been placed on the server. Open the step in the run to see the address, port and response. Correct the port or name in the installation plan’s Integration values, or allow access to the port, then use Try again. Changing Order does not disable the check, and Continue does not make a failed check count as passed.

Next step

Keep an eye on your certificates.

If it fails

The proposal becomes a draft → read the reason under Installation plans › Drafts. Prepare missing domains under Issuance › Domains, then start the draft.
The service is missing from the proposals → run discovery on the server again. If the service is in the wizard, you can compose the installation plan.
The run shows Waiting for certificate → follow Validation fails.
The run shows Failed or Partial → open the run and follow Installation fails.
The service serves a different certificate after installation → run discovery again and check the service and IIS binding in the installation plan.
The renewal is not installed → check that the installation plan is active and Install on renewal is enabled. See Renewal fails.

When the service is missing from the proposals

Open Installation plans › New installation plan. Select Servers and services and click Next. Select a certificate that exists, or enter a certificate source and names for a certificate to be issued. Check Status of the names.

Click Next, fill in Installation plan name and click Create and start installation plan. Discovery selects the integration for the service. See Integrations if the service is missing from the wizard.

One installation plan installs one certificate on all the services you select, even across servers. The certificate must therefore cover every name those services use; check Names in the certificate. If a service needs its own certificate, create a separate installation plan for it. The installation plan’s name is just a label: the list of names determines what the certificate covers.

Edit installation plan changes the services and names. A service you deselect receives no further versions, but the certificate already installed on it stays in place. Save and install now installs immediately on the changed services.

View the result of a run

The installation plan’s History tab shows its runs. Installation plans › Runs shows runs across installation plans. Open a run to see its result and step log. Try again repeats the run when the action is available; Run now on the installation plan starts a run.

Run now, Renew now, Pause and older versions

Run now on the installation plan installs the version the plan is set to use. It does not order a new certificate. If the installation plan is waiting for its first version, installation starts automatically when the certificate is issued.
Renew now on the certificate orders a new version. Active installation plans install it according to their settings and service window.
Pause keeps the installation plan on its current version. An installation that has not started is cancelled; one already in progress finishes. The certificate still renews, and its other installation plans install the new version. The version on the server expires as usual.
Resume makes the installation plan active again and installs the latest version if it does not already have it.
Install version … installs a specific version. Choosing a version older than the latest pauses the installation plan so it stays on that version: this is how you roll back. The choice is recorded in the audit log.

When the certificate is renewed

Renewal is ordered automatically before expiry. Timing follows the CA’s renewal window when available, otherwise the certificate’s lifetime and renewal margin. The installation plan installs the version when it is active, Install on renewal is enabled and the service window allows it.

Find the scheduled checks

Appliance › Maintenance › Background jobs shows certificate source runs and update checks. Certificate renewal is not shown as a background job here.

Adjust the installation

Setting	Meaning
Order	The default is One at a time, checking each server. Each installation is confirmed before the next service receives the certificate.
Failure policy	The default is Alarm and stop. Choose another policy if installation should continue or roll back.
Install on renewal	Enabled by default. The renewed version is installed automatically.
Service window	Controls when installation may run. A window on the installation plan replaces the appliance’s window. Requires Professional or Enterprise (service windows).
Follow bindings automatically	For IIS, follows the bindings that use the certificate on the server.

Stop and Alarm and stop halt the run on failure; Continue moves on to the next service. Revert failed attempts to restore the failed service, but a staged rollout stops after the failure; Revert all attempts to restore every service the run changed. On IIS, rollback restores the affected bindings’ previous certificate, certificate store and flags, and removes bindings created by the failed installation if they still use its certificate. This requires an integration with a rollback action, the deployment’s record of changes, the previous certificate with its private key on the server and a connection to the service agent; later changes are preserved.