Skip to content

simple-acme and the current Windows Agent

The current Windows Agent and simple-acme are two separate ways to own a certificate renewal. Choose one owner for each certificate:

  • Use an agent certificate workflow when the agent should create the ACME account, complete Delegated DNS-01, retain renewal state, issue the certificate, install it and renew it automatically.
  • Keep simple-acme as the renewal owner when an existing wacs.exe configuration must remain in place. Use CertIntel's reporting scripts to send its check-ins and renewal results to the platform.

The current certintel-agent.exe does not implement the old dns01 create, dns01 delete or acme-hook commands. Do not configure those commands as simple-acme validation, installation or notification scripts, and do not use the retired C:\Program Files\CertIntel\Agent executable path.

Create the certificate under Workflows → New certificate, configure its Delegated DNS-01 mapping, then select the required storage and installation destinations. Disable or remove the corresponding simple-acme renewal only after the agent workflow has issued and installed successfully, so two clients do not renew or deploy the same certificate concurrently.

Keep simple-acme and report it to CertIntel

The reporting bundle contains three PowerShell scripts:

  • Checkin-Wrapper.ps1 replaces wacs.exe as the scheduled-task action and reports that the scheduled run started and completed;
  • Installation-Script.ps1 reports the newly issued certificate details from an additional simple-acme installation step; and
  • Notification-Script.ps1 reports the renewal outcome from simple-acme's global notification configuration.

Download the scripts and follow the bundled README on ACME check-ins and renewals. That integration posts directly to the CertIntel API using a write-scoped API key; it does not depend on the locally installed Windows Agent.

Use all three scripts. The installation report supplies certificate details, the notification supplies the outcome, and the wrapper records scheduled runs even when no certificate is due. Keep the same renewal identifier across the installation and notification reports so CertIntel can correlate them.

Warning

Do not put an API key directly in a command-line argument. Configure the scripts through their documented environment variables or protected deployment mechanism. Command lines and scheduled-task definitions are often visible to local administrators and inventory tools.

Delegated DNS-01 with simple-acme

The agent's Delegated DNS-01 provider is intentionally internal to native agent workflows and is not a general-purpose script hook. If simple-acme remains the ACME client, configure one of the DNS validation plugins it supports. If you want the CertIntel Agent to manage the CertIntel delegation, move that certificate to an agent workflow instead.

Avoid duplicate ownership

Do not leave automatic renewal enabled in both products for the same certificate. Duplicate owners can create unnecessary ACME orders, compete for DNS challenge values, overwrite deployment files, and make renewal history ambiguous. Reporting a simple-acme renewal to CertIntel does not transfer ownership to the agent; a native workflow does.