Skip to content

Enable autopilot safely

What you'll have at the end: a certificate the Hub renews on its own — ordered inside the CA-suggested (or fallback) renewal window, delivered by the endpoint's Scout, deployed inside your deploy window — with you watching the Activity feed instead of a calendar.

Prerequisites:

  • The endpoint is adopted with a renewal profile assigned. Autopilot is never offered without one — an explicit profile is what autopilot renews with.
  • The endpoint's Scout is connected and healthy (green on Scouts).
  • At least one manual renewal has closed cleanly on this certificate. This is the "safely" in the title — see Step 1.
  • The profile's lane can complete without an operator. HTTP-01 and the internal CA always can. ⚠️ DNS-01 (Manual TXT) cannot, and nothing stops you enabling autopilot on it: the sweep will dispatch, the order will park waiting for a TXT record nobody is there to publish, and it will fail when the manual-DNS window lapses after five minutes. Before automating a DNS-01 profile, give the Hub credentials for your DNS provider and move it to DNS-01 (Automatic via API): Route 53 · Cloudflare · Google Cloud DNS.

Time: about 10 minutes, after one manual renewal has already closed.

The example endpoint is shop.example.com on Scout web-01.

Step 1 — Prove the lane manually first

On Manage, click Renew Now on the certificate's group header (or the row, for a standalone endpoint) and let the renewal run to the end. The header only carries Renew Now once a member is due — for a certificate that isn't due yet, the manual renewal is offered in the endpoint drawer's available actions instead.

You should now see the newest entry in the drawer's Renewals tab read Closed.

Do not skip this. A manual renewal exercises the entire lane — pre-flight, issuance, delivery, the reload hook, post-install verification — while you are watching, and the manual path can show you a refusal and offer choices. Autopilot cannot: on the automated path a blocking pre-flight finding is a silent skip (plus a Warning in Activity), retried every cycle. There is no "Proceed anyway" under autopilot. A lane that has never closed manually can sit in a skip-and-alert loop indefinitely, and the first time you notice may be an expiry warning.

Step 2 — Check the profile's timing and deploy window

Open Settings → Renewal Profiles and edit the endpoint's profile. Three settings decide when autopilot acts:

  • Use CA-suggested renewal timing (ARI) — when enabled and the CA publishes renewal windows, the CA tells the Hub exactly when to renew. This is the preferred source.
  • Fallback Renewal Window (%) — used only when ARI is unavailable or disabled: renew when this percentage of certificate lifetime remains (33% = renew at two-thirds through).
  • Deploy Window — days and hours when deployment is allowed, plus Enforce deploy window (delay renewals outside this window). With enforcement on, autopilot defers a due renewal until the window opens. One exception: a renewal that has become urgent (the certificate is close to running out of runway) bypasses the deploy window rather than expire waiting for it.

You should now see timing you would be comfortable having executed without you: a sane fallback percentage and a deploy window that matches your change policy.

Step 3 — Flip the Autopilot switch

On Manage, open the endpoint's drawer (click the row). Find the Automation card — it reads Manual, with "The Hub manages this endpoint but renews it only when you ask." — and flip its Autopilot switch.

You should now see the card read Autopilot with "The Hub renews this endpoint on its own schedule."

Autopilot is a property of the certificate, not the endpoint

A renewal covers the certificate's whole name set, so its automation state is one fact. Flipping the switch on any member of a multi-name certificate applies it to the certificate's managed members together — you do not (and cannot) enable it name by name. See Certificates: identity and observation.

If the switch isn't there

The card shows the current mode but no switch when the Hub is not offering the transition. Common reasons: no renewal profile assigned yet, the endpoint's Scout is not currently healthy, the endpoint has never been observed serving, or its delivery mode is manual (autopilot cannot deploy what only you can install).

Step 4 — Confirm the certificate-level state

Back on the Manage list, look at the certificate's group header.

You should now see the automation chip read Autopilot. (Mixed means members that predate certificate-level automation still disagree; one flip of the switch converges the whole certificate.)

Step 5 — Watch it work

Open Activity. Autopilot's renewal sweep runs every few minutes; nothing happens until the certificate actually enters its renewal window, and then you'll see the renewal dispatched, delivered and closed here — the same trail a manual renewal leaves. If autopilot declines to act, this is also where it says so:

Autopilot renewal skipped for `shop.example.com` — 1 preparation issue(s); see endpoint

You should now see (eventually — at the next renewal window) an automated renewal close with no click from you. Until then, a quiet feed is the correct result.

What autopilot does

  • Sweeps the estate every few minutes and considers each certificate once — one order covers every name the certificate spans, one delivery writes one set of files.
  • Times the order by ARI when the CA publishes it, else by the profile's Fallback Renewal Window (%).
  • Refuses to double-spend: it skips a certificate with a renewal already in flight under any of its names, anything installed within the last 7 days, and any certificate whose replacement already exists (superseded).
  • Respects the profile's Deploy Window when enforcement is on, deferring until the window opens — except for an urgent renewal, which proceeds rather than expire.
  • Runs the full renewal pre-flight before every dispatch. A blocking finding means skip and alert — a Warning in Activity naming the endpoint — and a retry next cycle once you've fixed the preparation issue.

What autopilot will NOT do

  • It never touches an endpoint the Hub has not observed serving — unproven endpoints get no renewal automation at all.
  • It never renews without a profile: there is no default issuance path it falls back to.
  • It never overrides a pre-flight refusal. Anything the manual path would ask you to confirm, autopilot declines and reports.

Paid CAs: autopilot spends money on a schedule

On a CA that bills per certificate, every automated order is a purchase, and on an account whose domains are prevalidated there is no DNS step and no confirmation between dispatch and a billed certificate — the order finalizes on its own within seconds. Enabling autopilot on such a profile means authorizing recurring spend at the renewal cadence. Keep Max Retries at 0 on paid profiles, make sure the manual lane closes cleanly first (Step 1), and consider whether a certificate this expensive should stay on Manual with a calendar reminder instead. See Renew through a third-party CA for where money is spent on that lane.

Where to next