CloudPortal · Certificates
SSL certificates that are renewed and installed automatically
Many teams already renew automatically. What is left is getting the new certificate onto every server. CloudPortal automates that step too: an agent on the server installs the certificate in IIS or nginx, or as PEM files, and checks that the new certificate is actually in use.
- Installation in IIS, in nginx or in a PEM directory, without anyone signing in to the server
- A check afterwards that the server presents the new certificate
- The key is created on the server and never leaves it
Renewal is automatic. Installation rarely is.
With automatic renewal the new certificate arrives in time, but often as a .pem, .crt or .pfx file. Someone then has to import it, change the IIS binding, update nginx and reload the service, on every server where the certificate is used. Forget one server and the certificate expires there anyway.
The maximum validity of public TLS certificates is also being shortened step by step over the coming years, so installation has to happen more and more often. CloudPortal takes care of the whole chain: renewal, installation and a check that the server presents the new certificate.
What it looks like
Example: shop.example.com on two servers
The web shop runs on web01 with IIS and on web02 with nginx. Both servers have an agent.
- 1
The agent finds where the certificate is used
The agents report the IIS binding on web01 and the nginx server block on web02. The portal suggests an automation with the names filled in, and an authorized person approves it.
- 2
Renewal with no files to move
When it is time, CloudPortal renews the certificate through ACME. The key is created on each server and never leaves it, so no .pfx file has to be passed around.
- 3
Installation and check
The agent switches the certificate in the IIS binding. On the nginx server a configuration test runs before nginx is reloaded. Then it checks that the server presents the new certificate, and the result shows in the portal.
What's included
Installation in IIS
The agent adds the certificate to the computer's certificate store and updates the IIS binding. The key is created on the server and cannot be exported.
nginx and PEM directory
On Linux the agent writes the certificate and key as PEM files to a directory and swaps them in one step. For nginx a configuration test runs before nginx is reloaded.
A check of the result
After installation the agent reads the binding back and checks that the server presents the new certificate. A certificate that is renewed but not yet installed is clearly shown.
Finds existing bindings
The agent reports IIS bindings and nginx server blocks, and the portal suggests what can be automated. An authorized person reviews it before anything is created.
The key stays on the server
Each server creates its own key. It is never sent to the portal or to other servers.
Overview with cause and next step
Every certificate in one list sorted by what needs action, including those you only monitor. If a renewal or installation gets stuck, you see the cause and what needs to be done.
What you need
Automatic installation needs an agent on the server and a domain that can be validated through DNS.
- An agent on the server
- Windows Server 2016 or later, or a current Linux distribution, for example Ubuntu 22.04 and later or RHEL 8 and later. The agent needs outbound HTTPS to the portal. The server does not have to be reachable from outside.
- IIS, nginx or a PEM directory
- These are the installation flows the agent offers. Certificates used elsewhere can be monitored in the overview.
- Validation through DNS
- The domain is validated through DNS. Zones in CloudPortal are handled directly, and for zones at another DNS provider a CNAME record is enough.
- Approval
- A new server and a new automation are approved by someone with permission before anything is installed.
Frequently asked questions
We already renew automatically. What does CloudPortal add?
Installation. Renewal gives you a new certificate, but it also has to go into IIS, into nginx or into the directory the service reads, on every server. CloudPortal does that step automatically and checks that the server presents the new certificate.
How does it work with IIS?
The agent adds the certificate to the computer's certificate store and updates the IIS binding. The key is created on the server and cannot be exported. Afterwards it checks that the binding presents the new certificate.
How does it work with nginx and other Linux services?
The agent writes the certificate and key as PEM files to a directory and swaps them in one step. For nginx a configuration test runs before nginx is reloaded. The agent never changes your nginx configuration.
Does the private key leave the server?
No. The key is created on the server for each certificate and is never sent to the portal or to other servers.
Does the server need to be reachable from the internet?
No. The agent contacts the portal itself over outbound HTTPS, and the domain is validated through DNS. No inbound ports need to be opened.
We already use win-acme or certbot. Will they clash?
The agent detects other ACME clients on the server and flags them. What they manage is not automated until you explicitly choose to.
Why does this matter more over time?
The maximum validity of public TLS certificates is being shortened step by step over the coming years. The shorter the validity, the more often the certificate has to be installed.
See automatic installation in your environment
We show how the agent finds your IIS bindings and nginx server blocks, and how a certificate is renewed, installed and checked.