Enabling certificate auto-renewal and provisioning
Table of Contents
Expand all | Collapse all
-
- Activate Next-Generation Trust Security
-
-
- Configure AWS connection
- Configure Azure Key Vault connection
-
- Workload Identity Federation authentication
- Workload Identity Federation - Azure Identity Provider authentication
- Next-Gen Trust Security Generated Key authentication
- User permissions
- Workload Identity Federation authentication
- Next-Gen Trust Security Generated Key authentication
- User permissions
- Supported OIDC claims
-
-
-
-
- Create an F5 BIG-IP LTM machine
- Create a Microsoft Azure Private Key Vault machine
- Create a Microsoft IIS machine
- Create a Microsoft Windows (PowerShell) machine
- Create a Microsoft SQL Server machine
- Create a Common KeyStore machine
- Create a Citrix ADC machine
- Create an Imperva WAF machine
- Create a VMware NSX Advanced Load Balancer (AVI) machine
- Create an A10 Thunder ADC machine
- Create a Cloudflare machine
- Create Kemp Virtual LoadMaster machine
- Create a Palo Alto Panorama machine
-
- Provision to an F5 BIG-IP LTM
- Provision to a Microsoft Azure Private Key Vault
- Provision to Microsoft IIS
- Provision to Microsoft Windows (PowerShell)
- Provision to Microsoft SQL Server
- Provision to a Common KeyStore
- Provision to a Citrix ADC
- Provision to an Imperva WAF
- Provision to VMware NSX Advanced Load Balancer (AVI)
- Provision to an A10 Thunder ADC
- Provision to Cloudflare
- Provision to a Kemp Virtual LoadMaster
- Provision to Palo Alto Panorama
-
-
- 47-Day Validity Readiness TLS Certificates dashboard
- About the Certificate Inventory
- Managing certificate lifecycle settings
- Reissuing certificates in Next-Gen Trust Security
- Downloading certificates, certificate chains, and keystores
- Retiring, recovering, and deleting certificates
- Finding certificates in the certificate inventory
- Importing certificates from a CA using EJBCA
- Notification Center overview
- Domain-based validation for external emails
- Managing user accounts
- Troubleshooting
Enabling certificate auto-renewal and provisioning
Learn how to enable and configure certificate auto-renewal and optional auto-provisioning. These features help automate certificate lifecycle management and reduce the need for manual renewal and deployment.
Auto-renewal runs daily. It evaluates all applications with auto-renewal enabled and renews eligible certificates that fall within the configured renewal window.
Auto-renewal is disabled by default for newly created applications.
Prerequisites
To enable auto-renewal, ensure the following conditions are met:
- You have sufficient permissions to manage application settings.
- At least one application is configured to use auto-renewal.
- Certificates intended for auto-renewal meet all of the following requirements:
- Are associated with at least one application that has auto-renewal enabled.
- Have an expiration date that falls within the configured renewal window.
To enable auto-provisioning after renewal, the certificate must also be associated with a machine or cloud keystore that is configured for certificate provisioning.
To enable and configure auto-renewal and auto-provisioning
- Sign in to Next-Gen Trust Security.
- Click Insights > Applications.
- Click the name of the application you want to configure.
- Click the Auto-renewal tab.
- Enable Certificate Auto-Renewal.
- Configure the renewal window:
- Inherit from global configuration to use the default setting.
- Configure manually to specify a custom number of days before expiration when renewal should occur.
What does the renewal window mean?Certificates with expiration dates that fall within the specified number of days are eligible for renewal during the next auto-renewal run, provided they meet all eligibility requirements.
- (Optional) Enable Auto-provision certificates after renewal.
Note: To use auto-provisioning, the certificate must be associated with a machine or cloud keystore that is configured for certificate provisioning.
- Click Save and close the configuration panel.
After these steps are complete, eligible certificates are renewed automatically during daily auto-renewal runs. If auto-provisioning is enabled, renewed certificates are also provisioned automatically.