Skip to content

Adopt an endpoint that already serves a certificate

What you'll have at the end: an endpoint that was merely observed is now managed — assigned a renewal profile, eligible for Renew Now and autopilot, and counted in the managed estate.

Prerequisites:

  • The endpoint shows on Manage as Untracked — i.e. a Scout has observed it serving. If it isn't there yet, do Track a new endpoint first.
  • At least one renewal profile exists that matches how this endpoint should renew (right CA, right validation method, right key handling). If the endpoint must keep its private key, make sure the profile has Reuse private key across renewals enabled before adopting — see Key reuse and pinning.

Time: under 2 minutes.

The example endpoint is shop.example.com, served by the Scout web-01.

Step 1 — Find the row on Manage

Open Manage (https://hub.example.internal/manage) and locate shop.example.com.

You should see the row labelled Untracked, carrying a single action. Which action depends on the certificate group it belongs to:

  • Promote — one click, no questions. The endpoint's certificate group already has a renewal profile (a managed sibling brought one), and this endpoint inherits it. Assigning a different profile per member isn't offered, because the profile belongs to the certificate: one certificate never renews under two disagreeing configurations.
  • Adopt with a profile picker — the certificate has no profile anywhere yet. The picker (Renewal profile → Apply) is asking a certificate-level question once.

Step 2 — Click it

Click Promote (or pick the profile and Apply).

You should now see the row leave the Not managed section and render as a managed endpoint. Behind the click, the Hub:

  • marked the endpoint managed with Scout-local delivery;
  • wrote the chosen profile across the whole certificate group, not just this row;
  • inherited the group's autopilot state if a managed sibling already has automation on.

What it did not do: order anything. Adoption changes management state only — no ACME order, no cost, no DNS work. The first renewal happens when you click Renew Now or when autopilot's window arrives.

Two refusals you might see

  • endpoint is not unmanaged (state: …) — the row changed under you (someone else adopted it, or it was already managed). Re-read the page.
  • a renewal profile is required before promoting — the group has no profile and none was picked. Create one under Settings → Renewal Profiles and retry.

You do not need to rename anything first

Cyphers identifies certificates by their content, never by filename, and finds the private key by public-key match. Whatever your files are called — 1.pem, server.crt, mykey.pem — they are found, and the path your web server already reads keeps working. See Certificate files: naming & takeover.

Step 3 — Check the siblings (multi-name certificates)

If the certificate covers several names (shop.example.com + api.example.com on one SAN certificate), the other names may still show as covered or Untracked. That is expected: adoption clicks apply to the endpoint you clicked. The remaining eligible siblings — served proof, same Scout — are adopted automatically the first time a renewal of this certificate verifies, so the group converges on managed without you clicking N times. If you don't want to wait for a renewal, Promote them individually now; each inherits the same group profile.

Where to next