Targets, agents and webhooks

A target is a place a certificate is installed. Automate Certificates can also scan for certificates you do not manage yet and send events to your own tools.

Target types

Azure: virtual machine, SQL, App Service, Key Vault, Application Gateway and Front Door.
AWS: ACM, CloudFront, load balancer and RDS.
Google Cloud: virtual machine, HTTPS load balancer, Cloud SQL and Cloud Run.
Databases: PostgreSQL, MySQL, MongoDB and Redis.
Other: Cloudflare, SSH hosts and a custom API.

Business and MSP plans cover all 21 target types. Team covers 5 targets.

Custom API targets

The endpoint must be an https:// URL. A plain http:// endpoint is refused, because the request carries the private key.

Linux agent

The agent is a small Python 3 service for a Linux host. Automate Certificates pushes the certificate to it over https and with the agent key only. Where the files go and how the service reloads is set on the host at install time and never taken from a request. The installer needs systemd.

Create a long random key, for example with openssl rand -hex 32. It must be at least 32 characters.
Download and run the installer on the host, as root, with the key and the paths for your service.
Create a target in Automate Certificates with the agent URL (https://<host>:8443) and the same key.

curl -fsSL https://api.automate-certificates.com/v1/agent/install/linux -o install-agent.sh
sudo CERTAI_AGENT_KEY="$(openssl rand -hex 32)" \
     CERTAI_CERT_PATH=/etc/nginx/tls/site.crt \
     CERTAI_KEY_PATH=/etc/nginx/tls/site.key \
     CERTAI_RELOAD_COMMAND="systemctl reload nginx" \
     bash install-agent.sh

Print the key once and store it; the target needs the same value. The installer writes a root-only config file at /etc/automate-certificates/agent.json and starts the systemd unit automate-certificates-agent. The agent answers https only and returns 401 to any request without the right key. It serves https with the certificate at CERTAI_CERT_PATH (or CERTAI_TLS_CERT and CERTAI_TLS_KEY), so that file must exist before the install. The default port is 8443 (CERTAI_PORT).

Windows agent

The Windows agent is a PowerShell service for a Windows host. Automate Certificates sends certificates to it over https only, with the agent key. Where the files go and what runs afterwards is set on the host at install time and never taken from a request. The installer needs PowerShell 7.4 or later (pwsh) and must be run as Administrator.

Create a key of at least 32 characters, for example with the PowerShell command in the block below.
Download the installer and run it as Administrator, with the key and the paths for your service.
Allow inbound TCP port 8443 from Automate Certificates in Windows Firewall. The installer does not open it.
Create a target in Automate Certificates with the agent URL (https://<host>:8443) and the same key.

Invoke-WebRequest https://api.automate-certificates.com/v1/agent/install/windows -OutFile install-agent.ps1
$env:CERTAI_AGENT_KEY = [Convert]::ToHexString([Security.Cryptography.RandomNumberGenerator]::GetBytes(32))
$env:CERTAI_CERT_PATH = 'C:\certs\site.crt'; $env:CERTAI_KEY_PATH = 'C:\certs\site.key'
$env:CERTAI_CERT_STORE = 'My'; $env:CERTAI_RELOAD_COMMAND = '& C:\scripts\bind-certificate.ps1'
pwsh -NoProfile -ExecutionPolicy Bypass -File install-agent.ps1

Store the key; the target needs the same value. The installer registers the agent as a scheduled task named AutomateCertificatesAgent that runs as SYSTEM, and keeps its config under C:\ProgramData\AutomateCertificates. The agent answers https only and returns 401 to any request without the right key. The installer settings are:

Setting	What it does
`CERTAI_AGENT_KEY`	Required. At least 32 characters. The target needs the same key.
`CERTAI_CERT_PATH`, `CERTAI_KEY_PATH`	Where each deployed certificate and key are written, as PEM. The default folder is `C:\ProgramData\AutomateCertificates\certs`.
`CERTAI_CERT_STORE`	A LocalMachine certificate store, such as `My`, that each certificate is also imported into.
`CERTAI_RELOAD_COMMAND`	PowerShell that runs after each deploy, with `CERTAI_CERT_PATH`, `CERTAI_KEY_PATH` and `CERTAI_THUMBPRINT` set, for example to bind the new certificate in IIS. A non-zero exit fails the deploy.
`CERTAI_PORT`	The port the agent listens on. The default is 8443.
`CERTAI_TLS_CERT`, `CERTAI_TLS_KEY`	The agent's own https certificate. By default it uses the certificate and key it manages, which must already exist as PEM and be valid for the host name of the machine. A certificate file that also holds its key needs no key file.

Key files are always readable by SYSTEM and Administrators only, on every deploy. A service that must read its key gets access in the reload command, for example:

icacls "C:\certs\mongo.pem" /grant "NT SERVICE\MongoDB:R"; Restart-Service MongoDB

If the managed certificate expires, Automate Certificates can no longer reach the agent. To avoid that, point CERTAI_TLS_CERT and CERTAI_TLS_KEY at a separate long-lived certificate. To open the port, the installer prints this rule for you to run:

New-NetFirewallRule -DisplayName 'Automate Certificates agent' -Direction Inbound -Protocol TCP -LocalPort 8443 -Action Allow

Discovery

Scans find certificates that are missing from your inventory: Azure tenant scans, AWS and GCP scans, and network scans of public domains. Scans count against the daily scan limit of your plan, and starting one needs an admin.

Webhooks

Add a webhook on the Alerts page to send events to your own tools. Events include cert.issued, cert.expiring, cert.issue_failed, cert.renew_failed, cert.renewal_dns_required, deployment.success and deployment.failed. Each request is signed: the header X-Automate-Certificates-Signature holds sha256= and an HMAC of the body made with the secret shown once when you create the webhook.

MCP

MCP tools cannot be installed from the product yet, so they are not part of the product today.