Issuance stores a certificate. Deployment puts it on the endpoint that actually terminates TLS. TigerTrust models deployment as a first-class concept so you can track where every certificate lives, automate re-deployment after renewal, and roll back in seconds if something goes wrong.
Certificate Deployment

​
What it is

You select a certificate and one or more targets (a field agent, a Kubernetes cluster, a load balancer, or a cloud certificate manager), configure target-specific options (path, namespace, cloud region), and TigerTrust dispatches the push. Optionally you create a subscription — a durable binding that redeploys the certificate automatically every time it is renewed.

​
When to use it

  • Push a newly-issued certificate to the web servers that serve it.
  • Set up auto-deploy so every renewal reaches the endpoint without an operator step.
  • Deploy a certificate to multiple cloud regions in one batch.
  • Roll back to the previous certificate if a deployment verification fails.

​
Supported target types

Agent (filesystem, keystore)

A field agent writes the certificate and key to a path, optionally reloading a service (for example, systemctl reload nginx).

Kubernetes secret

Creates or updates a kubernetes.io/tls secret in the configured namespace, optionally restarting deployments that reference it.

Load balancer

F5 BIG-IP, NGINX Plus, HAProxy, AWS ALB, Azure App Gateway — uploads the certificate bundle and swaps the virtual server binding.

Cloud certificate manager

AWS ACM, Azure Key Vault, GCP Certificate Manager — imports the certificate and updates the referenced listener or binding.

​
Set it up

1

Open the deployment console

Go to Certificates > Deploy or open a certificate’s detail panel and click Deploy.
2

Select a certificate

Choose the certificate to deploy. You can deploy any certificate in your inventory.
3

Add targets

Click Add target and select from your registered agents, Kubernetes clusters, load balancers, and cloud integrations. For each target, fill in the target-specific config (path, namespace, secret name, cloud region, resource ARN).
4

Create a subscription (optional)

Toggle Auto-deploy on renewal to create a permanent binding. On every subsequent successful renewal, TigerTrust redeploys automatically to this target.
5

Deploy

Click Deploy now. TigerTrust creates one deployment job per target and streams status. A green check on each target confirms the certificate was accepted. The job page shows logs and timing for each target.

​
What you’ll see

Certificates > Deploy shows open and recent deployment jobs with per-target status (pending, deploying, deployed, failed). Click any job to see detailed logs, timing, and the previous certificate that was replaced. The certificate’s detail panel shows a live deployment map of all locations where it currently lives.

​
Rollback

Click Roll back on any deployment job to restore the previous certificate on all targets that were already updated. Rollback is instant if the previous certificate is still valid and held by TigerTrust. If the previous certificate has expired, rollback is refused and a critical alert is raised — fix the underlying issue and re-deploy manually.
Rollback assumes the previous certificate is still valid. If it has been revoked or its private key was rotated out, rollback succeeds technically but the service may not start. Verify with a health check after rollback.

​
Subscriptions vs locations vs jobs

Three concepts to keep distinct:
ConceptRepresentsLifetime
LocationWhere a certificate currently lives (a path, an ARN, a secret name)Persistent — updated as the certificate moves
Subscription”Deploy this certificate to this target on every renewal”Persistent binding
Deployment jobA single push attemptHistorical record per attempt

Kubernetes management

Cluster registration, cert-manager integration, and multi-cluster fan-out.

Load-balancer automation

F5, NGINX, HAProxy, and cloud load balancer target details.

Certificate renewal

Where subscriptions are evaluated automatically on renewal.