Hub — renewal profiles¶
A renewal profile is a reusable bundle of issuance and renewal settings: which CA issues, how the domain is validated, what key the certificate gets, and how delivery behaves. Endpoints are assigned a profile when they are adopted (or via + Add endpoint), and every renewal of that endpoint's certificate — manual or autopilot — runs with the profile's settings.
Profiles live under Settings → Certificate issuance → Renewal Profiles. The panel lists each profile's name, contact email, issuance method, and environment; New Profile opens the editor.
The editor, panel by panel¶
Identity¶
| Field | Meaning |
|---|---|
| Profile Name | Unique, 1–128 characters — this is what adoption dialogs and dropdowns show. Name it for what it does: production-le, digicert-rsa-reuse. |
| Contact Email | Used for ACME account registration (or as the certificate contact on the internal CA). ACME accounts are keyed by (email, provider, environment) — profiles that agree on all three share one CA account. |
Certificate Issuer¶
Issuer Type — Public ACME or Hub Internal CA. Choosing the internal
CA collapses the rest of this panel: no provider, no staging, no ARI — the
Hub signs directly.
For a Public ACME profile:
| Field | Options | Notes |
|---|---|---|
| Provider | every registered certificate provider | A provider that requires EAB and has none stored is flagged — configure EAB in Settings before the first issuance. |
| Environment | Production / Staging |
Staging is only selectable when the provider actually publishes a staging directory; a provider without one is production-only. |
| Validation Method | HTTP-01 · DNS-01 (Manual TXT) · DNS-01 (Automatic via API) |
DNS-01 (Automatic via API) is the default a new profile opens with. HTTP-01 is offered on Let's Encrypt only in this phase. Automatic needs a DNS provider that resolves for the endpoint and fails rather than degrading if there isn't one. A profile saved earlier may show a fourth option, DNS-01 (Automatic via API — legacy "delegated") — see the note below. See Renewal lanes for choosing. |
| Key Type | ECDSA P-256 · ECDSA P-384 (recommended) · RSA 2048 · RSA 4096 |
Filtered to the provider's required key family when it has one (e.g. the SSL.com per-family rows). On the Hub-driven DNS-01 lanes an RSA type is honored through key reuse, not fresh generation. |
| Preferred Chain | Default (CA decides), plus the ISRG Root X1/X2 short-chain options on Let's Encrypt |
Every provider other than Let's Encrypt accepts only Default. |
| SAN Policy | Preserve SANs from predecessor / Strict (exact domains only) |
Preserve is the default and what keeps a multi-name certificate renewing as one unit. |
| Delivery Mode | Scout (installs and reloads locally) / Manual |
Scout delivery is the normal path: install, hooks, reload, verify. Manual hands you the certificate instead. |
| Key Handling | ☐ Reuse private key across renewals (for pins/DANE) |
The renewal reuses the held key; if it can't be reused, the renewal is refused rather than silently rotating the key. See Key reuse and pinning. |
| ACME Renewal Information (ARI) | ☐ Use CA-suggested renewal timing |
On a provider that doesn't publish ARI (or that the Hub doesn't poll yet), the fallback window below applies. |
The legacy \"delegated\" option is the automatic lane under an old name
A profile saved before this was cleaned up may show
DNS-01 (Automatic via API — legacy "delegated"). It is a survivor of the
removed Master/Satellite split: there is no delegation service, and the
verb runs the same code against the same Hub-held DNS provider as the
automatic lane. Nothing needs doing, and it needs a DNS provider
configured the same way. The option appears only on profiles that already
store it — a new profile cannot choose it, and saving such a profile
leaves its lane unchanged.
Operational Controls¶
| Field | Range | Meaning |
|---|---|---|
| Fallback Renewal Window (%) | 10–90 (default 33) | Used when ARI is unavailable: renew when this percentage of the certificate's lifetime remains. 33% ≈ renew at two-thirds through. |
| Max Retries | 0–20 (default 3) | Automatic retry attempts before a renewal is marked failed. 0 means one attempt, no retries — the right value when every order costs money. |
Deploy Window — optionally constrain when deployments may happen:
Window Start (UTC) / Window End (UTC) (24-hour HH:MM), the weekday
checkboxes, and ☐ Enforce deploy window (delay renewals outside this
window). With no days selected the window is ignored. A renewal issued
outside an enforced window is held until the next open slot, not discarded.
Hooks¶
Informational only: pre/deploy/post hooks are executables the operator
places on each Scout at <data-dir>/hooks/{pre,deploy,post}. The Hub cannot
create or push them — by design. See
Scout → Security.
Deleting a profile¶
Delete Profile (edit view) removes the profile; endpoints that were assigned it fall back to inline configuration rather than breaking. Prefer reassigning endpoints first so nothing renews with implicit settings.
The DNS provider (for the automatic DNS-01 lanes)¶
The DNS-01 (Automatic via API) lane — and the legacy \"delegated\" spelling of
it — needs the Hub to publish a TXT record in your zone, so it needs credentials for
whichever DNS service hosts that zone. Providers are configured under
Settings → Certificate issuance → DNS providers, and a profile picks
which one it uses.
| Provider | Fields | Setup guide | Proven end to end? |
|---|---|---|---|
| Route 53 | Access key ID, Secret access key, Hosted zone ID, Region | AWS Route 53 | Yes — a live Let's Encrypt renewal on 2026-08-22 |
| Cloudflare | API token, Zone ID | Cloudflare | Health check only |
| Google Cloud DNS | Project ID, Managed zone, Service account JSON | Google Cloud DNS | Health check only |
Each provider also gets a DNS provider ID — a short name of your
choosing, like corp-route53 — and a display name. The ID is what the
profile stores, so keep it stable; re-saving the same ID replaces that
provider's credentials without disturbing the profiles that name it, which
is how you rotate a key.
On a DNS-01 automatic lane the profile form shows a DNS Provider select:
- Hub default — the profile uses the Hub's single legacy provider (the one configured before per-profile selection existed). Every profile that has never been touched sits here, and keeps renewing exactly as before.
- A named provider — the profile publishes through that one, and only that one. If the provider is later removed, the profile's renewals refuse with a message naming both, rather than quietly writing into some other zone.
Credentials are health-checked live against the service before they are stored, so a bad key is refused at save time rather than discovered mid-renewal. Test re-runs that check for one provider; Remove is refused while any renewal profile still names it, and the provider's entry lists which profiles those are.
Zones on different services
This is what per-profile selection is for. Give each DNS service its own provider entry, then make one renewal profile per service and assign endpoints to the profile whose zone actually holds their names.
⚠️ The health check only proves the Hub can read the zone. A credential with read but not write permission passes it and fails at the first renewal.
⚠️ Removing a provider does not push profiles back onto the manual lane.
A profile whose validation method is DNS-01 (Automatic via API) (under
either spelling) fails its renewal outright rather than degrading —
deliberately, because an operator who asked for automation should not have it
silently withdrawn. Moving those profiles to DNS-01 (Manual TXT) is part of
removing a provider, not a consequence of it.
Only Cloudflare can also be configured from the environment
(CLOUDFLARE_API_TOKEN + CLOUDFLARE_ZONE_ID); Route 53 and Google Cloud DNS
are dashboard-only.
The domain allowlist¶
The Hub only orders public certificates for domains on its ACME domain
allowlist (Settings → Certificate issuance → ACME accounts → Domains).
You rarely tend it by hand: renewing an endpoint from Manage, adding an
endpoint, and the autopilot sweep all add the names they order for
automatically. The list is the backstop that stops a misconfigured request
from ordering for a domain you never meant to touch — entries look like
example.com or *.example.com, and removing one closes issuance for it.