First certificate

Configure a certificate, verify the served fingerprint and exercise failed-rollout recovery before expanding.

First certificate

Prove the whole loop.

  1. 01

    Configure

    Create a certificate with domains, key type, issuer chain, assigned runner and deployment targets. Add a TLS verification address and explicit server name for the intended endpoint.

  2. 02

    Run check

    Queue the ordinary check. It respects renewal thresholds and failure backoff. It does not force a new paid order. Confirm active status and the served fingerprint after deployment.

  3. 03

    Exercise recovery

    In staging, deliberately fail a rollout and inspect recovery. Rollback is connector-dependent; incomplete recovery requires inspection. Confirm the endpoint still serves the expected previous certificate.

  4. 04

    Hand over

    Assign an owner, test notifications and save the inventory view. Record the recovery steps, backup location and who responds when verification fails.

Pilot acceptance

A small estate, fully exercised.

  • One organisation, one eligible CA account and a disposable staging DNS zone.
  • A target and operating-system version within the integration validation limits.
  • Successful issuance, renewal and served-fingerprint verification.
  • A failed-rollout recovery exercise and agent offline/restart report replay.
  • A delivered notification, isolated backup/restore and a staged signed worker update.
  • Named operators, private credential handling and an agreed support boundary before expansion.

Shared SaaS onboarding remains gated on the queued scalability and multi-tenant isolation review. The service operator uses release-candidate acceptance and isolated restore drills. Coordinate target, notification and agent-update acceptance with them before expanding.