- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Renewal Manager Setup
This section provides a comprehensive installation guide for the Renewal Manager agent service, which works with CertSecure Manager to automate and manage SSL/TLS certificate renewals for web servers (IIS, Apache, Nginx, Tomcat) and databases (MSSQL, MongoDB, OracleDB) running on Windows and Linux environments.
The purpose of this section is to facilitate the seamless deployment and configuration of the Renewal Manager on either a virtual machine (VM) or a physical machine. This section assumes that CertSecure Manager is already up and running in your environment.
Prerequisites
Before proceeding with the deployment, ensure that the CertSecure Manager frontend and backend are fully operational.
Supported Targets
The Renewal Manager supports the following applications on the target operating systems shown below. Any combination not marked in the table is not supported in the current release.
| Application | Windows (Server 2016 or later) | Linux (Ubuntu 22.04, SLES 15, RHEL 9 or later) |
|---|---|---|
| IIS | Supported | N/A |
| Apache | Supported | Supported |
| Nginx | Supported | Supported |
| Tomcat | Supported | Supported |
| MSSQL | Supported | - |
| MongoDB | Supported | - |
| OracleDB | Supported | - |
| Cloudflare | Managed through its API | Managed through its API |
| AudioCodes | Managed through its management interface | Managed through its management interface |
| Cisco ISE | Managed through its management interface | Managed through its management interface |
| Cisco ACI | Managed through its API | Managed through its API |
| Palo Alto PAN-OS | Managed through its API | Managed through its API |
Note: Cloudflare, AudioCodes, Cisco ISE, Cisco ACI, and Palo Alto PAN-OS are not installed on an operating system that the Renewal Manager logs in to. The Windows and Linux columns do not apply to them.
Renewal Manager Host Requirements
Hardware Requirements
The machine running the Renewal Manager service must meet the following minimum hardware requirements:
- CPU: Minimum 4 cores
- RAM: Minimum 8 GB
- Storage: Minimum 40 GB free
Software Requirements
The host running the Renewal Manager service must adhere to the following software requirements:
- Accounts and Permissions: A dedicated service account (optional) to run the service with full control access to the Renewal Manager installation directory.
- Outbound HTTPS (TCP on the port the backend is running) access from the Renewal Manager host to the CertSecure Manager backend.
- Outbound TCP reachability to each onboarded application on the port it serves TLS on (any port — 443, 8443, custom). Required so the Renewal Manager can perform a TLS handshake to read the currently deployed certificate.
- Outbound WinRM (TCP 5985/HTTP, 5986/HTTPS) access from the Renewal Manager host to all target Windows servers that are to be onboarded through the CertSecure Manager portal.
- Outbound SSH (TCP 22) access from the Renewal Manager host to all target Linux servers that are to be onboarded through the CertSecure Manager portal.
- Outbound HTTPS access from the Renewal Manager host to the management interface of each Cloudflare, AudioCodes, Cisco ISE, Cisco ACI, and Palo Alto PAN-OS target that is onboarded: api.cloudflare.com for Cloudflare, the Primary Admin Node for Cisco ISE, the APIC for Cisco ACI, the SBC (port 443 unless the SBC Web Port is changed) for AudioCodes, and the management address of the firewall or Panorama for PAN-OS.
Target Server Requirements
The following requirements apply to each server that will be onboarded through the CertSecure Manager portal after the Renewal Manager is installed.
Software Required on Target
The Renewal Manager generates the CSR and installs the renewed certificate on the target itself. The tooling it invokes for that depends on the target type:
| Target | Windows Tooling | Linux Tooling |
|---|---|---|
| IIS | certreq.exe (built into Windows) | N/A |
| Apache | OpenSSL on PATH | OpenSSL on PATH (comes pre-installed) |
| Nginx | OpenSSL on PATH | OpenSSL on PATH (comes pre-installed) |
| Tomcat | OpenSSL on PATH | OpenSSL on PATH (comes pre-installed) |
| MSSQL | certreq.exe (built into Windows) | Not supported currently |
| MongoDB | OpenSSL on PATH | Not supported currently |
| OracleDB | OpenSSL on PATH, and orapki (ships with Oracle DB) | Not supported currently |
| Cloudflare | None. Managed through its API | None. Managed through its API |
| AudioCodes | None. Managed through its management interface | None. Managed through its management interface |
| Cisco ISE | None. Managed through its management interface | None. Managed through its management interface |
| Cisco ACI | None. Managed through its API | None. Managed through its API |
| Palo Alto PAN-OS | None. Managed through its API | None. Managed through its API |
Note: IIS and MSSQL targets do not require OpenSSL because certreq.exe is built into Windows and handles CSR generation and certificate installation natively. All other target types require OpenSSL to be installed on the target machine and available on the machine PATH.
Remote Access
The Renewal Manager reaches each target over a single remote channel; the protocol depends on the target OS.
| Target OS | Protocol | Port | Direction |
|---|---|---|---|
| Windows | WinRM (HTTP) | 5985 | Inbound from Renewal Manager host |
| Windows | WinRM (HTTPS) | 5986 | Inbound from Renewal Manager host |
| Linux | SSH | 22 | Inbound from Renewal Manager host |
Account Permissions by Target Type
A dedicated account must be added while onboarding each target through the CertSecure Manager portal. The account must have administrative access (in most cases) on the target because operations such as writing to the Windows certificate store, writing to protected key directories on Linux, and restarting services all require elevated privileges. The exact requirements per target type are given below.
IIS — Windows only
- Log on remotely via WinRM.
- Access to the Local Machine "My" certificate store (import new certificates, list existing).
- Membership in the local Administrators group, required to modify site bindings via New-WebBinding, Remove-WebBinding, and Set-ItemProperty.
Importing certificates into the Local Machine store and modifying IIS site bindings are all privileged operations. Without administrative rights, the renewal will fail at the cert-import step or the binding-rebind step, and the site will continue serving the old certificate until an administrator intervenes manually.
Apache — Windows or Linux
- Log on remotely via WinRM (Windows) or SSH (Linux).
- Full access to the cert and key paths configured in the portal.
- Permission to restart the Apache Windows service or systemd service on Linux.
The Apache cert and key files typically live in paths owned by root (Linux) or SYSTEM (Windows), and Apache must be restarted for a new certificate to take effect. Both writing to those paths and restarting the service require elevated privileges. A non-privileged account will fail either at the file-write step or at the service-restart step, leaving the site on the old certificate.
Nginx — Windows or Linux
- Log on remotely via WinRM (Windows) or SSH (Linux).
- Full access to the cert and key paths configured in the portal.
- Permission to restart the Nginx Windows service or systemd service on Linux.
Same requirements as Apache — the renewal writes to protected paths and restarts the service, both of which need elevated privileges.
Tomcat — Windows or Linux
- Log on remotely via WinRM (Windows) or SSH (Linux).
- Full access to the cert and key paths configured in the portal.
- Permission to restart the Tomcat Windows service or systemd service on Linux.
Same requirements as Apache — the renewal writes to protected paths and restarts the service, both of which need elevated privileges.
MSSQL — Windows only
- Log on remotely via WinRM.
- Access to the Local Machine "My" certificate store, used by certreq.exe to install the renewed certificate.
-
Access to the SQL Server instance's SuperSocketNetLib registry key
(
HKLM\SOFTWARE\Microsoft\MicrosoftSQLServer\<InstanceID>\MSSQLServer\SuperSocketNetLib) so the new certificate's thumbprint can be written into the Certificate value. -
Permission to grant the SQL Server service account Read access on the
private key file of the newly installed certificate. The SQL service
account (registered in the portal as
sql_service_account) must resolve to a real Windows or AD account on the target. -
Permission to restart the SQL Server instance service —
MSSQLSERVERfor the default instance, orMSSQL$<instance_name>for a named instance. - Membership in the local Administrators group.
The MSSQL renewal writes into HKLM, ACLs a private-key file, and restarts a Windows service — all privileged operations. Without administrative rights, the renewal will fail at the cert-install, ACL-grant, registry-write, or service-restart step, and the instance will continue serving the old certificate on the next TLS handshake.
MongoDB — Windows only
- Log on remotely via WinRM.
- OpenSSL installed on the target and available on the machine PATH, used to generate the CSR and to verify the renewed certificate against the private key at push time.
-
Full read/write access to the combined key+cert PEM file registered in
the portal as
cert_path. MongoDB reads the certificate from this single file (net.tls.certificateKeyFilein mongod.conf). -
Permission to restart the mongod Windows service registered in the
portal as
service_name. - Membership in the local Administrators group.
The MongoDB renewal overwrites the combined key+cert file and restarts the mongod service. If the account can't write to the PEM path or can't restart the service, the endpoint will continue serving the old certificate until an administrator intervenes.
OracleDB — Windows only
- Log on remotely via WinRM.
- OpenSSL installed on the target and available on the machine PATH, used to generate the CSR and to bundle the renewed key + cert into a PKCS12 that orapki can import.
- orapki on the machine PATH, used to inspect the wallet and to import the renewed PKCS12 into it. orapki ships with the Oracle Database installation.
-
Full read/write access to the wallet directory registered in the
portal as
wallet_path. -
The wallet password registered in the portal as
wallet_password. It is stored encrypted end-to-end and decrypted only on the agent host for the duration of an orapki call. -
Permission to grant the Oracle listener service account Read on the
wallet files. The listener service account (registered in the portal
as
listener_service_account) must resolve to a real Windows or AD account on the target. -
Permission to restart the Oracle listener service registered in the
portal as
listener_service_name. - Membership in the local Administrators group.
The OracleDB renewal mutates the wallet via orapki, re-ACLs the wallet files for the listener service account, and restarts the listener. Every one of these steps needs elevated privileges; a non-privileged or mis-scoped account will fail at wallet import, ACL grant, or service restart, and the listener will continue serving the old certificate.
Cloudflare — API only
- An API token with the permission Zone → SSL and Certificates → Edit on the zones to be managed, and Zone → Zone → Read to list them. Alternatively, the Cloudflare account email together with the Global API Key.
- Outbound HTTPS (TCP 443) access from the CertSecure Manager backend to api.cloudflare.com when the server is added, so that its domains can be imported.
Custom certificates are available only on Cloudflare zones whose plan includes them. A zone that the token or the plan does not allow is reported when the domains are imported, and the other zones are still imported.
Cisco ISE — API only
- The credentials of an ISE administrator account, saved on the server. The ISE Open API service must be enabled.
- Renewing a certificate that holds the Admin role restarts the ISE node. Turn on Allow Admin Node Restart on the server if Admin endpoints are to be renewed automatically.
The Renewal Manager changes system certificates and, for the Admin role, restarts the node. Credentials that ISE rejects fail the renewal with an ISE credential error.
AudioCodes, Cisco ACI, and Palo Alto PAN-OS — API only
- The credentials of an account that can sign in to the management interface of the device. For Palo Alto PAN-OS this is an admin with XML API access. For Cisco ACI, a login domain is needed only for a remote (TACACS+, RADIUS, or LDAP) user.
See the page of each target for its other requirements: Cloudflare, AudioCodes, Cisco ISE, Cisco ACI, and Palo Alto PAN-OS.
Trust Chain Requirements
The Renewal Manager operates only on leaf certificates — it installs the renewed leaf and updates the application binding, but it does not modify trust anchors. Every target that will serve a renewed certificate must already trust the Root CA and any Intermediate CAs in the chain of the leaf being issued.
Key operational notes:
- Trust anchors are configured once at onboarding and are not rotated by the Renewal Manager currently. If the CA hierarchy changes after onboarding, the trust store on each target must be updated manually before the next renewal.
- If you plan to rotate between certificate authorities (for example, moving from an internal CA to a public CA later), pre-load all CA hierarchies you may issue from at onboarding time. This allows the Renewal Manager to switch between issuers without requiring any wallet or trust-store change mid-renewal.
- Cisco ISE and Cisco ACI are the exceptions. For these targets the Renewal Manager loads the CA certificates of the issued chain onto the device when it binds the new certificate, so the root and intermediate CAs do not have to be added to ISE or the APIC beforehand.
Deploying Renewal Manager
Once the requirements are met, the installation and setup of the renewal manager service will be done as follows:
Installation and Registration
-
Download the zip from the CertSecure Manager Portal by going to Utilities, then Integrations, then clicking on any of the application icons, and then finally clicking on the download button.
-
Note: The Download and Registration Token buttons are at the top of the Renewal Manager page, next to Refresh.
-
Extract the zip, Mount the ISO, and run the installer as an Administrator.
-
Proceed with the installation by accepting the terms and continue forward until the installer asks for the backend IP or URL and the service account credentials; provide the details, press Next, and then click on the Install button.
-
During the installation, the installer will ask for a registration token that can be generated from the portal by going under Utilities, Integrations, and then clicking on the Registration Token button, copy it, and then submit the token and wait for the service to start automatically.
-
Close the installer after successful installation.
-
Now go to services.msc and look for EC_Renewal_Manager; you can manage the service from here.
Validation
-
Now go to Utilities, Integrations, and then click on any of the application icons to see the renewal manager up and running. You can now start adding servers and automating SSL/TLS certificate renewals for applications running on your infrastructure.
-
To get a detailed guide on how to onboard servers, applications, and manage and automate renewals, go to the Integrations section by accessing the CertSecure Manager Documentation.
