Skip to content

Enable autopilot safely

What you'll have at the end: a certificate the Hub renews on its own — ordered inside the CA-suggested (or fallback) renewal window, delivered by the endpoint's Scout, deployed inside your deploy window — with you watching the Activity feed instead of a calendar.

Prerequisites:

  • The endpoint is adopted with a renewal profile assigned. Autopilot is never offered without one — an explicit profile is what autopilot renews with.
  • The endpoint's Scout is connected and healthy (green on Scouts).
  • At least one manual renewal has closed cleanly on this certificate. This is the "safely" in the title — see Step 1.
  • The profile's lane can complete without an operator. HTTP-01 and the internal CA always can. DNS-01 (Manual TXT) cannot — every order waits for a TXT record a person publishes — so the Hub refuses autopilot on it, and a certificate already on autopilot that is moved onto such a profile (or whose profile is edited onto that lane) is taken off autopilot, with a dialog naming it and a Warning in Activity. Before automating a DNS-01 profile, give the Hub credentials for your DNS provider and move it to DNS-01 (Automatic via API): Route 53 · Cloudflare · Google Cloud DNS.

Time: about 10 minutes, after one manual renewal has already closed.

The example endpoint is shop.example.com on Scout web-01.

Step 1 — Prove the lane manually first

On Manage, click Renew Now on the certificate's group header (or the row, for a standalone endpoint) and let the renewal run to the end. The header only carries Renew Now once a member is due — for a certificate that isn't due yet, the manual renewal is offered in the endpoint drawer's available actions instead.

You should now see the newest entry in the drawer's Renewals tab read Closed.

Do not skip this. A manual renewal exercises the entire lane — pre-flight, issuance, delivery, the reload hook, post-install verification — while you are watching, and the manual path can show you a refusal and offer choices. Autopilot cannot: on the automated path a blocking pre-flight finding is a silent skip (plus a Warning in Activity), retried every cycle. There is no "Proceed anyway" under autopilot. A lane that has never closed manually can sit in a skip-and-alert loop indefinitely, and the first time you notice may be an expiry warning.

Step 2 — Check the profile's timing and deploy window

Open Settings → Renewal Profiles and edit the endpoint's profile. Three settings decide when autopilot acts:

  • Use CA-suggested renewal timing (ARI) — when enabled and the CA publishes renewal windows, the CA tells the Hub exactly when to renew. This is the preferred source.
  • Fallback Renewal Window (%) — used only when ARI is disabled, or the CA has never given the Hub a renewal window for the certificate: renew when this percentage of certificate lifetime remains (33% = renew at two-thirds through). A check that fails after the CA has answered does not switch the Hub to this window: it keeps the CA's last suggested time until the CA answers again.
  • Deploy Window — days and hours (UTC) when autopilot may place an order. A window that is set is always enforced: autopilot holds a due renewal until the window opens. One exception: in the certificate's last 24 hours autopilot renews outside the window rather than let it expire, with a Warning in Activity. A window may run overnight (22:00–04:00).

You should now see timing you would be comfortable having executed without you: a sane fallback percentage and a deploy window that matches your change policy.

Step 3 — Flip the Autopilot switch

On Manage, open the endpoint's drawer (click the row). Find the Automation card — it reads Manual, with "The Hub manages this endpoint but renews it only when you ask." — and flip its Autopilot switch.

You should now see the card read Autopilot with "The Hub renews this endpoint on its own schedule." Under it, Scheduled renewal gives the date the Hub will renew and one sentence saying where the date comes from: the time the certificate's CA suggested, or the profile's fallback window with its percentage. Check it against what you set in Step 2 — this is the date the renewal sweep acts on, so a date you did not expect is a profile setting to revisit now, not a surprise to find later. What each sentence means.

A fallback date on a profile that uses CA-suggested timing

Right after a renewal the card gives the fallback window and says the CA's suggested time is not available. That is expected: the Hub has not asked the CA about the new certificate yet, and opening the drawer never asks. The date changes to the CA's suggestion once the Hub has it, and from then on the Hub keeps that suggestion even through a check that fails, saying so on the card.

Autopilot is a property of the certificate, not the endpoint

A renewal covers the certificate's whole name set, so its automation state is one fact. Flipping the switch on any member of a multi-name certificate applies it to the certificate's managed members together — you do not (and cannot) enable it name by name. See Certificates: identity and observation.

If the switch isn't there

The card shows the current mode but no switch when the Hub is not offering the transition. Common reasons: no renewal profile assigned yet, the endpoint's Scout is not currently healthy, the endpoint has never been observed serving, or its delivery mode is manual (autopilot cannot deploy what only you can install).

Step 4 — Confirm the certificate-level state

Back on the Manage list, look at the certificate's group header.

You should now see the automation chip read Autopilot. (Mixed means members that predate certificate-level automation still disagree; one flip of the switch converges the whole certificate.)

Step 5 — Watch it work

Open Activity. Autopilot's renewal sweep runs every few minutes; nothing happens until the certificate actually enters its renewal window, and then you'll see the renewal dispatched, delivered and closed here — the same trail a manual renewal leaves. If autopilot declines to act, this is also where it says so:

Autopilot renewal skipped for `shop.example.com` — 1 preparation issue(s): This renewal includes the wildcard name *.example.com and the profile's issuance path is 'http01' — a wildcard can only be validated via DNS-01

The line names the issue itself. It appears once, when the sweep first declines, and again when the set of issues changes or when the sweep has passed the endpoint and later declines it again; a refusal that stands unchanged is not repeated on every sweep.

You should now see (eventually — at the next renewal window) an automated renewal close with no click from you. Until then, a quiet feed is the correct result.

What autopilot does

  • Sweeps the estate every few minutes and considers each certificate once — one order covers every name the certificate spans, one delivery writes one set of files.
  • Times the order by ARI when the CA publishes it, else by the profile's Fallback Renewal Window (%). The endpoint drawer's Automation card states the resulting date and which of the two it is.
  • Refuses to double-spend: it skips a certificate with a renewal already in flight under any of its names, anything installed within the last 7 days, and any certificate whose replacement already exists (superseded).
  • Respects the profile's Deploy Window, deferring until the window opens — except in the certificate's last 24 hours, when it renews rather than let it expire, and says so in Activity.
  • Runs the full renewal pre-flight before every dispatch. A blocking finding means skip and alert — a Warning in Activity naming the endpoint — and a retry next cycle once you've fixed the preparation issue.

What autopilot will NOT do

  • It never touches an endpoint the Hub has not observed serving — unproven endpoints get no renewal automation at all.
  • It never renews without a profile: there is no default issuance path it falls back to.
  • It never overrides a pre-flight refusal. Anything the manual path would ask you to confirm, autopilot declines and reports.

Paid CAs: autopilot spends money on a schedule

On a CA that bills per certificate, every automated order is a purchase, and on an account whose domains are prevalidated there is no DNS step and no confirmation between dispatch and a billed certificate — the order finalizes on its own within seconds. Enabling autopilot on such a profile means authorizing recurring spend at the renewal cadence. Keep Max Retries at 0 on paid profiles, make sure the manual lane closes cleanly first (Step 1), and consider whether a certificate this expensive should stay on Manual with a calendar reminder instead. See Renew through a third-party CA for where money is spent on that lane.

Where to next