Jobs

What a certificate job is, the four job types, how retries and leases work, and what Retry, Cancel and Delete do under Manage > Jobs.

A job is one unit of work handed to one agent. Everything that touches a certificate on a host goes through one: first issuance, every renewal, every redeployment, every revocation. Manage > Jobs is the operational view of them.

Job types

Type	What the agent does
issue	Generate a key and CSR, solve the validation challenge, obtain the certificate, deploy it.
renew	The same thing again, on schedule. A renewal is a reissue: new key, new serial.
deploy	Install a certificate the agent already has, without reissuing it.
revoke	Ask the authority to revoke the certificate.

Each job also records where it came from. manual means somebody created it; by policy means a certificate policy produced it. The list filters on that.

Statuses

Status	Meaning
Queued	Waiting for an agent to claim it.
In progress	Claimed by an agent, which holds a lease on it.
Succeeded	Finished.
Failed	Out of attempts, or a failure the agent classified as permanent.
Cancelled	Cancelled before it started.

A job that issued the certificate but failed to deploy it reports that distinctly - certificate issued, deploy failed - because the two halves have different fixes.

Claiming and leases

An agent claims a job on a check-in and holds a 20-minute lease on it. The claim is bound to a token: a result submitted with a stale token is rejected, so a slow agent whose job was already requeued cannot overwrite the newer attempt's outcome.

If the lease expires without a result - the host was rebooted, the process was killed, the network went away mid-job - the job is requeued automatically. The scheduler that does this runs every minute while there is work and every five minutes when idle, so recovery takes about 21 to 25 minutes in total.

Retries

A failed job is retried automatically, up to three attempts in total. Three things change that:

A permanent failure stops immediately. The agent classifies failures it knows will repeat identically - bad credentials on a deploy target, an unknown template or object name - as permanent, and the control plane does not spend the remaining attempts on them. Fix the configuration and press Retry.
A rate-limited failure waits. When the authority reports a rate limit, the next attempt is scheduled rather than made straight away, honouring the CA's own retry-after where it gives one.
A deploy-step failure retries only the deploy. When an issue or renew job obtained the certificate and then failed to install it, the retry is converted to a deploy job against the certificate the agent already has, so the retry does not order a second certificate from the authority.

A job that reaches Failed has therefore genuinely failed, and its error text is the authority's or the agent's own. See Troubleshooting.

Actions

Action	When it is available	What it does
Retry	Failed jobs	Requeues the job with its attempt count reset.
Retry deploy	A job that issued but failed to deploy	Requeues just the deployment.
Cancel	Queued jobs that have not started	Marks the job cancelled.
Edit	Any job	Opens the certificate's edit dialog. Saving reissues with the new configuration.
Delete	Any job	Removes the row from the history. Does not undo anything the job did.

Retention

Finished jobs - succeeded, failed and cancelled - are deleted once they are older than your plan's retention window: 7 days on Free, 30 on Standard, 90 on Pro and the MSP tiers. It is the same window as the event log, and the deletion is real. Queued and in-progress jobs are never purged.