Skip to content

Provision certificates to machines

Certificate Manager - SaaS provisions a certificate by installing it on the system that a machine connects to. You can provision one certificate at a time, provision all of a machine's queued installations at once, or let a schedule do it. The fields in the Provision a certificate dialog depend on the machine type, and each machine type has its own provision page. To find it, see the machine types table in About machines.

Before you begin

  • A machine whose status is Verified, for a machine type that supports provisioning.
  • The certificate to provision in the Certificate Manager - SaaS certificate inventory, requested with Automated Secure Keypair so that Certificate Manager - SaaS has its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team. You also need to own the certificate.

How renewals work during scheduled provisioning

When a certificate is renewed, Certificate Manager - SaaS sets the status of its installation on the machine to New. Running discovery keeps the status at New, so the renewed certificate stays queued. The next provisioning run, scheduled or batch, installs the renewed certificate in place of the previous version.

To provision a certificate to a machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Fill in the fields under Certificate Information and, if the dialog shows it, Installation Endpoint. These fields depend on the machine type, so follow the machine type's provision page.

  6. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
  7. Click Save. To save and then provision another certificate, click Save & New.

Provision doesn't appear on a machine's more options menu if the machine's status isn't Verified or if the machine type doesn't support provisioning.

To provision all of a machine's installations

Batch provisioning provisions every installation on a machine in a single operation.

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the name of the machine.

  4. Click Provision Now.

    A message under the machine's name shows when provisioning started. Refresh the page to see when it finishes. To stop provisioning before it finishes, click Abort Provision. Stopping can take some time to finish.

Set up machine provision schedule

A provisioning schedule provisions only the installations that are queued for deployment, such as renewed certificates, so renewals install during the window you choose. It works best together with the application auto-renewal schedule. Configure auto-renewal first, and the machine then provisions renewed certificates at its scheduled time instead of right away. To learn more, see Configure auto-renewal.

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the name of the machine.
  4. Click the Provisioning tab.
  5. Enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).
  6. Click Save.

You can also set the provisioning schedule when you create a machine, on the wizard's Provisioning step.