Every infrastructure environment has its own way of consuming a certificate — some services expect a PEM file at a specific path, others require a Java keystore import, others need a daemon reload. Custom deployment scripts let you encode that logic once and attach it to your deployment targets so every renewal and push follows the same playbook automatically.
Custom Deployment Scripts

​
What it is

Scripts are authored in bash, sh, PowerShell, or Python and stored in your workspace’s script catalog. At deployment time, the field agent on the target host executes the script with the deployment configuration available as environment variables. You can reference any value from the deployment configuration using {{deploymentConfig.key}} placeholders, which the agent resolves before executing. A dry-run mode lets you preview the resolved environment without making any changes to the target.

​
When to use it

  • Reload nginx or Apache after a certificate file is written to disk.
  • Import a renewed certificate into a Java keystore and restart a Tomcat service.
  • Push a certificate to a Windows certificate store using PowerShell.
  • Trigger a config management tool (Ansible, Chef) after deployment to propagate the cert across a cluster.
  • Run a post-deploy health check and exit non-zero to fail the job if the service does not come up cleanly.

​
Set it up

1

Open the script catalog

Go to Deployments > Scripts and click New script.
2

Name and choose an interpreter

Give the script a unique name. Select bash, sh, PowerShell, or python as the interpreter. The agent uses this to invoke the script correctly on the target OS.
3

Write the script body

Enter the script. Use {{deploymentConfig.key}} placeholders anywhere you need a value from the deployment configuration, such as the certificate file path or the service name to reload. The editor highlights placeholders so you can verify them at a glance.
4

Define environment variables (optional)

In the Environment section, add variable names and values. Values may also contain {{deploymentConfig.key}} placeholders. The agent injects these into the script’s environment before execution.
5

Dry-run to verify

Click Dry run, select a deployment job from the dropdown to supply real configuration values, and review the resolved environment and script body. Nothing runs on the target during a dry run.
6

Save and attach to a target

Click Save script, then attach it to a deployment target from the target’s configuration page.

​
What you’ll see

The script detail page shows the most recent executions with exit code, duration, and the first lines of stdout and stderr. Click any execution row to see the full output log. Failed executions are highlighted in red and also appear as events in Deployments > Jobs.
Scripts run on the target host under the agent’s operating system user. Make sure that user has write access to the certificate directory and permission to reload the service — but no broader permissions than necessary.

Certificate Deployment

Where scripts are attached to deployment targets.

Deployment Rollback

Rollback re-executes the deployment script against the previous certificate.

Agent Config Push

Push configuration changes to the agent running your scripts.