TigerTrust renews certificates before they expire without human intervention. You enable auto-renewal on a certificate, point it at the right CA, and the platform handles the rest — generating CSRs, talking to the CA, deploying the new certificate, and recording everything in the audit log.
Renewal Automation

​
What it is

The renewal engine runs continuously and wakes on two conditions: a scheduled pass that checks for certificates entering the renewal window (default 30 days before expiry), and an on-demand trigger when an agent submits a CSR. It picks the renewal method that matches the certificate’s CA type and either talks to the CA directly or routes through a field agent to keep the private key on the target host.

​
When to use it

  • Automate Let’s Encrypt renewals for all public-facing services.
  • Renew internal PKI certificates on a rolling basis without operator involvement.
  • Keep private keys on-device by routing CSR generation through an agent.
  • Receive an alert when a renewal fails so you can intervene before expiry.

​
Supported renewal methods

MethodBacks
ACMELet’s Encrypt, ZeroSSL, Buypass, Sectigo ACME, Google Trust Services
SCEPSimple Certificate Enrollment Protocol (Cisco, mobile MDM)
ESTEnrollment over Secure Transport (RFC 7030)
DigiCertDigiCert CertCentral
EntrustEntrust Certificate Services
SectigoSectigo Certificate Manager
ZeroSSLZeroSSL REST API
GoDaddyGoDaddy SSL API
AWS Private CAAWS Private Certificate Authority
Microsoft ADCSActive Directory Certificate Services
HashiCorp VaultVault PKI secrets engine
step-caSmallstep CA
Internal CATigerTrust’s built-in PKI
Manual CSRFallback — generate a CSR, upload the signed cert
The method is selected automatically from the certificate’s CA. You can query the recommended method for any certificate from Certificates > Renewal.

​
Set it up

1

Enable auto-renewal on a certificate

Open the certificate from Certificates, scroll to the Auto-renewal toggle, and turn it on. For bulk enablement, select multiple certificates and use Enable auto-renewal from the bulk action toolbar.
2

Confirm the CA is connected

Go to CA Management and verify the certificate’s issuing CA shows a healthy status. The renewal engine skips CAs marked as unhealthy.
3

Set an agent (optional)

If the private key must stay on the endpoint, assign an agent under the certificate’s Deployment settings. The engine will route CSR generation through that agent rather than generating the key centrally.
4

Check the renewal queue

Go to Certificates > Renewal to see certificates entering the window, pending renewals, and history. Any certificate without a confirmed deployment path shows a warning.

​
What you’ll see

After auto-renewal is enabled, the certificate appears in Certificates > Renewal > Queue when it enters the 30-day window. When renewal succeeds, the new expiry date updates in Certificates and a certificate_renewed event appears in the audit log. Failures raise an alert at high severity with the error detail.
Auto-renewal only fires for certificates with the auto-renewal toggle on. Certificates discovered by a scan start with it off — enable it once you have confirmed the deployment path and CA credentials. A renewal attempt without a valid path ends in a failure alert.

​
Tips

  • The renewal window defaults to 30 days but you can override it per CA or per certificate template to suit your SLA.
  • A failed renewal pauses auto-renewal on that certificate until you acknowledge the alert, preventing tight retry loops.
  • For certificates deployed to multiple locations, TigerTrust uses the existing private key so every location gets the same consistent key/cert pair after renewal.

ACME

HTTP-01 and DNS-01 challenge flow for ACME-backed renewals.

Certificate renewal

Renewal window, queue, and manual override details.

Workflows

Wrap renewals in approvals or add pre/post steps.