Certificate policies

A certificate policy is a standing rule attached to an agent group. It is not a job itself - it hands one out. For as long as an agent is in the policy's group, the policy makes sure that agent has the certificate the policy describes.

What it creates is entirely ordinary. Every certificate and every job a policy produces is a normal certificate and a normal job: renewal, revocation, deployment and reseller order polling all behave exactly as they would for something you created by hand.

Certificate policies build on agent groups and require the Standard plan or higher.

The rollout it makes possible

This is the order the feature is built around. It works even though the policy is written before any of the servers exist.

Moving an already-enrolled agent into the group - from the group's Members tab, or from the agent's own settings - does exactly the same thing.

Two modes

"Every member gets this certificate" means two genuinely different things, so a policy picks one when it is created. The mode cannot be changed afterwards: the two produce structurally different certificates, and switching would strand whatever the policy has already created.

Per agent

Each member gets its own certificate, with its own common name and its own order at the authority. The common name is a template resolved against each agent:

So {{hostname_short}}.example.com gives web-01.example.com on one host and web-02.example.com on the next.

A per-agent policy must contain a placeholder. Without one, every member would resolve to the same name - which is what shared mode is for, and the form rejects it here.

Shared

One certificate and one order in total, deployed to every member. This is for identical replicas behind a load balancer that all present the same hostname. Its common name is a literal hostname, not a template.

Choosing between them

What a policy edit does

Editing a policy changes what future applications produce. It does not rewrite certificates the policy has already created.

Members pick the new specification up at their next issuance. To push it out now, reissue the affected certificates from the certificate list.

The one exception is a shared policy's certificate, which is the thing being issued - edits reach it directly.

When a policy stops applying

A policy stops applying to an agent when the agent leaves the group, or the policy is disabled or deleted. Each policy decides in advance what happens to the certificate it created:

Either way, jobs that were queued but had not started are cancelled. Work already in progress, and certificates already deployed, are never retracted.

PSW Group certificates under retire stop renewing but must be revoked at PSW by hand - PSW revocation is a server-side API call rather than an agent job.

Rollout state

A policy's page shows how far it has been applied across the group's current members, and what each member's certificate is doing.

A member can legitimately show as not applied. The usual reasons:

• Its operating system cannot run the policy's deploy target - a Linux agent in a group whose policy deploys to the Windows certificate store.
• It has not reported a hostname yet, so the template cannot resolve.
• The resolved hostname is not covered by a verified domain with a DNS provider configured (DNS-01 only).

Fix the cause and press Apply now. Applying is idempotent: members already covered are left alone, so it is always safe to press.

Policy or certificate job?

Both exist and they answer different questions.