Deployment automation
A renewed certificate is not done until production serves it.
Issuance is a midpoint. The change is closed when the listener you named presents the expected fingerprint — or when rollback restored the last known good fullchain.
The intended path
- Discover the target (panel bindings or a host you registered).
- Upload or import the PEM.
- Bind it to the vhost or listener.
- Check configuration (
nginx -t,apachectl configtest, allowlisted equivalents). - Reload or apply.
- External TLS handshake.
- Fingerprint verification against the expected SHA-256.
- Rollback to
.previf it does not match.
Customer-ready targets
The dashboard picker stores plesk, cpanel, nginx, apache, kubernetes and aws. New rows start disconnected until you add a scoped token. That is the honest support list.
| Target | What exists | What we will not say |
|---|---|---|
| Plesk / cPanel | Customer integrations: discover, deploy, keep rollback when connected | Not a promised marketplace extension |
| Nginx / Apache via SSH | Atomic write, allowlisted test/reload, TLS inspect, .prev | Not a root shell from user input |
| HAProxy / IIS | Allowlisted command profiles on the SSH connector | Not separate picker tiles |
| Kubernetes | Write a secret | Not a certified cert-manager replacement |
| AWS ACM/ALB | Import + attach capability in the adapter | ACM will not auto-renew imported third-party certs |
| Azure / Google Cloud | Not in the picker | Not claimed as deploy products |
| target | nginx · shop-edge-1 |
|---|---|
| status | verified |
| expected SHA-256 | DE:MO:FP:… |
| rollback | /etc/ssl/sslcertificates-io.prev |
Related Solutions and Integrations
Solutions this product surface is built for:
Customer-facing integrations to open next:
Questions people actually ask
Which targets can I add in the dashboard?
plesk, cpanel, nginx, apache, kubernetes and aws. They start as disconnected until you add a scoped token. That list is the customer-facing picker — not every adapter class in the repo.
Do you verify the live certificate?
On supported SSH deploys, yes: the connector computes the expected SHA-256 fingerprint and can inspect the TLS endpoint. Mismatch means rollback. Panel connectors deploy; still treat handshake verification as required before you close the change.
Is rollback automatic?
Supported SSH deploys keep a .prev copy and describe restoring it when verification fails. The certificate object is not deleted. Re-running deploy is cheaper than issuing a third leaf.
Do you support IIS, HAProxy, Azure and GCP?
HAProxy and IIS appear as allowlisted SSH command profiles. They are not separate tiles in the deployment-target picker. Azure and Google Cloud are not in that picker today. Do not claim them as first-class deploy products.
Does issuance deploy?
No. certificate.issued means the CA produced a leaf. Deployment is a later connected target or your own installer.
What about Kubernetes?
The connector can write a secret. It does not replace cert-manager, and we do not store unprotected roots in etcd. Treat PEM-in-a-secret as the integration, not as a certified operator.
How does Plesk work?
Connect a Plesk server you operate, discover subscriptions, install a replacement, bind it, keep a previous certificate for rollback. Issuance still happens through the certificate API. Academy: /academy/plesk-automation.
What if there is no connector?
Download the bundle, install through that host’s UI, keep the name in inventory as Action Required. The platform will not invent a deploy API for a closed builder.
Close the change when port 443 agrees.
Register a target, add a scoped token, and treat fingerprint mismatch as rollback — not as a new issuance.