Automate Certificates documentation
Troubleshooting
Find the message you see, then follow the matching fix.
| What you see | What to do |
|---|---|
| Register an ACME account in Settings before requesting a certificate | Register an account in Settings, then request the certificate again. |
| A certificate stays in the issuing state | For DNS-01, publish the TXT records shown on the certificate page. They are checked every 5 minutes. An attempt that is not finished in time fails, and the page shows why; request again. |
| A wildcard domain can only be validated with DNS-01 | Choose dns-01 for a name that starts with *.. |
| Renewal failed alert | Read the reason in the alert. The app retries once a day. For DNS-01, publish the new TXT records sent by e-mail. |
plan_limit_reached | You are at the limit for certificates, targets, API keys, members or scans on your plan. Remove one or change plan. |
403 insufficient_scope | The key lacks the scope for this call, or the action needs a signed-in admin. See API keys and scopes. |
403 admin_required | The signed-in person has the member role. Ask an admin. |
401 from the agent | The key sent by the target does not match the key set at install. Use the same value in both places. |
| Agent deployment fails | Check that the target URL is https://, the port is open, the agent service is running (systemctl status automate-certificates-agent) and the reload command works. |
| Custom API target refused | The endpoint must start with https://. |
| A deployment shows failed | Open Deployments and read the message. For a database target, the host and credentials must be reachable from the app or an agent. |
The agent needs PowerShell 7.4 or later (pwsh). | Install PowerShell 7.4 or later and run the installer with pwsh. |
Run the installer as Administrator. | Start pwsh as Administrator and run the installer again. |
agent_url must be an https:// URL | Use an https:// URL such as https://<host>:8443 for the agent target. A plain http:// URL is refused, because the request carries the private key. |
Still stuck
Write to hello@spot-suite.com with the certificate name or the target name and the message you see. Do not send private keys or API keys.