Every certificate managed by TigerTrust moves through the same five stages. Understanding this pipeline is the fastest way to make sense of the product, the API, and how the pieces fit together.

​
The five stages

Discover

Find every certificate already deployed.

Issue

Sign a new certificate against a CA.

Deploy

Push the certificate and key to the endpoint.

Renew

Replace before expiry.

Revoke

Invalidate compromised or retired certificates.

​
1. Discover

Certificates enter TigerTrust in three ways:
  • Agent discovery — field agents scan filesystems, Kubernetes secrets, Java keystores, PKCS#11 tokens, and listening TLS ports on managed hosts.
  • Cloud discovery — TigerTrust enumerates AWS ACM, Azure Key Vault, GCP Certificate Manager, and other cloud certificate stores.
  • Manual import — operators upload PEM files or use the API to import certificates directly.
Discovered certificates land in a staging area. You review them and import only the ones you want to manage. Imported certificates become eligible for policy evaluation, renewal windows, and deployment automation.

​
2. Issue

A new certificate is created from Certificates > Issue certificate or via the API. TigerTrust routes the request to the correct CA type:
CA typeHow it issues
Internal (PKI Core)TigerTrust’s built-in CA signs the certificate directly
Let’s Encrypt / ZeroSSL / BuypassACME flow with HTTP-01, DNS-01, or TLS-ALPN-01 challenge
DigiCert / Sectigo / GoDaddy / EntrustVendor API using stored credentials
Microsoft ADCSWindows enrollment via SCEP or DCOM
AWS Private CA / HashiCorp VaultCloud-native issuance
If TigerTrust generates the key, it is encrypted at rest. If you or an agent provides a CSR, the private key never touches TigerTrust.

​
3. Deploy

Issuance alone does not put a certificate on an endpoint. Deployment is a separate tracked stage. You connect a certificate to one or more target locations (a file path, a Kubernetes secret, a cloud ARN, a load balancer virtual server), and TigerTrust pushes the certificate to each target. Deployment subscriptions make this automatic: a subscription binds a certificate to a target and says “deploy here on every renewal.” Without a subscription, a renewed certificate is issued but never pushed to the endpoint.
Set up a deployment subscription immediately after deploying a certificate for the first time. This ensures every future renewal reaches the endpoint automatically.

​
4. Renew

TigerTrust continuously monitors certificate expiry and triggers renewal when a certificate enters its renewal window (typically 30 days before expiry). The renewal method is determined by the CA type and matches the original issuance path.
1

Queue renewal

TigerTrust schedules renewal when the certificate enters its renewal window.
2

Generate CSR

For agent-backed certificates, the agent generates a CSR from the key on the host. For cloud or internal certificates, TigerTrust generates it.
3

Sign

The CSR is submitted to the CA and the new certificate is recorded with an updated expiry and serial number.
4

Auto-deploy

Every deployment subscription with auto-deploy enabled fires automatically, pushing the new certificate to its configured targets.
You can also trigger renewal manually from Certificates > Renew on any certificate.

​
5. Revoke

Revocation is initiated from Certificates > Revoke on the certificate detail panel. For certificates issued by an internal CA, revocation propagates to the CRL and OCSP responder immediately. For externally-issued certificates, TigerTrust marks its own record as revoked and calls the upstream vendor API where supported. Every stage transition is recorded in the audit log with the actor, timestamp, and action — providing the evidence trail required for SOC 2, ISO 27001, and similar frameworks.

Certificate inventory

Filter, search, and act on every certificate in your estate.

Certificate renewal

Renewal windows, methods, and automation options.

Certificate deployment

How TigerTrust pushes certificates to endpoints.