TigerTrust’s renewal engine turns “certificate expires in 30 days” into “certificate already replaced, deployed, and audit-logged.” It runs continuously, supports 14 renewal methods, and lets private keys stay on the endpoint host without ever touching TigerTrust.
Certificate Renewal

​
What it is

The renewal engine monitors your inventory for certificates entering the renewal window (default 30 days before expiry). For each eligible certificate, it picks the renewal method that matches the issuing CA type and either talks to the CA directly or routes through a field agent so the private key never leaves the endpoint.

​
When to use it

  • Automate renewal for all Let’s Encrypt certificates in one workspace setting.
  • See the pending renewal queue before your on-call shift starts.
  • Manually trigger renewal for a specific certificate before it enters the automatic window.
  • Upload a certificate that was signed by an external process (for example, an EV certificate after organization validation).

​
The renewal window

A certificate is eligible for renewal when expiry − renewalWindow < today. The window defaults to 30 days and is overridable per CA, per template, or per certificate. Certificates > Renewal shows three tabs:

Expiring

Certificates entering the window in the next N days.

Queue

Renewals currently pending or in progress.

History

Every renewal attempt with method, result, and timestamps.

​
Supported renewal methods

MethodBacks
ACMELet’s Encrypt, ZeroSSL, Buypass, Sectigo ACME, Google Trust Services
SCEPCisco, mobile MDM, ADCS
ESTRFC 7030
DigiCertDigiCert CertCentral
EntrustEntrust Certificate Services
SectigoSectigo Certificate Manager
ZeroSSLZeroSSL REST API
GoDaddyGoDaddy SSL API
AWS Private CAAWS Private Certificate Authority
Microsoft ADCSActive Directory Certificate Services (SCEP or DCOM)
HashiCorp VaultVault PKI secrets engine
step-caSmallstep CA
Internal CATigerTrust’s built-in PKI
Manual CSRFallback — generate a CSR, notify you to sign upstream
The recommended method for any certificate is shown on the Certificates > Renewal queue. You can also check it from the certificate’s detail panel.

​
Agent-generated CSR flow

For certificates whose private key must stay on the endpoint:
1

Renewal engine enqueues a CSR task

A task is dispatched to the primary field agent assigned to the certificate.
2

Agent generates the CSR

The agent creates the CSR locally using the existing key (or a new key if rotation is requested).
3

Agent submits the CSR

The CSR is returned through the agent’s secure channel to TigerTrust.
4

TigerTrust signs

The renewal method handler (ACME, DigiCert, and so on) submits the CSR to the CA and receives the new certificate.
5

Deploy

The renewed certificate is pushed to every subscribed deployment target.

​
Manual renewal

For certificates that require human intervention (EV certs, highly audited environments):
1

Generate a CSR

On the certificate’s detail panel, click Generate CSR. TigerTrust creates the CSR and key server-side (or queues a CSR generation task on the assigned agent).
2

Sign out-of-band

Submit the CSR to your CA through whatever out-of-band process is required.
3

Upload the result

Return to the certificate’s panel, click Upload renewed certificate, and paste the signed PEM. TigerTrust updates the certificate record and triggers any configured deployment subscriptions.

​
Failure handling

Renewals that fail are recorded in the renewal history with the error message. The engine retries with exponential backoff up to the configured maximum. Persistent failures raise a high severity alert and pause auto-renewal on the certificate until you acknowledge the alert, preventing tight failure loops.
A renewal that succeeds but whose deployment fails is still treated as a failure. TigerTrust joins renewal and deployment outcomes so alerts fire when either step breaks.

Certificate deployment

What the auto-deploy step does with a renewed certificate.

Agents and Collector

How agents produce CSRs without leaking private keys.

DNS providers

Configure Route 53, Cloudflare, and others for DNS-01 challenges.