Downloads¶

CertIntel Agent¶

Install a new Agent with the one-line command from the dashboard's Install Tokens page (see Windows Agent and Linux Agent). It runs the CertIntel bootstrap, which resolves the current release, cross-checks the two signed release records below, verifies the versioned installer and runs it. Use the raw artifacts here only when you need them for offline installation, manual signature/checksum verification, or your own packaging.

Each release directory also contains the signed installer scripts install-windows.ps1, install-windows-silent.ps1 and install-linux.sh. They have no .sha256 sidecar; their hashes are the installWindowsSha256 and installLinuxSha256 fields of the release record. The Windows MSI, EXE and scripts are Authenticode-signed by CN=CertIntel Code Signing, O=CertIntel (thumbprint DD3F69F48412C05A9365E4863B7FFFBE254FE62D, currently self-signed).

Release metadata is published in two independent places that must always agree - the installers and the Agent updater refuse to proceed if they don't:

• assets.certin.tel/downloads/agent/latest/info.json
• api.certin.tel/api/v1/releases/agent/latest.json

The installer scripts have their own component records at https://api.certin.tel/api/v1/releases/windows-installer/latest.json and .../linux-installer/latest.json. Records are signed, expire 30 days after signing and are re-signed on a schedule; an "expired" record usually means a wrong clock or a publishing delay rather than a new version.

A .sha256 sidecar alone is not publisher authentication. Windows release artifacts also require the expected Authenticode signer. Linux Agent downloads are authenticated through signed metadata; they do not currently carry an X.509 certificate-backed binary signature. Do not infer signing-policy compliance from a checksum.

latest links are convenience aliases. For a pinned deployment, use the exact immutable URL from the release record; filenames include the version (for example /downloads/agent/1.3.81/certintel-agent_windows_amd64_1.3.81.msi). Do not construct a pinned URL by replacing only the latest directory. The raw MSI installs the service only and does not accept connection credentials; connect the agent afterwards as described on the Windows Agent page.

The Agent update service verifies Ed25519-signed metadata, expiry, target, exact size, hash, and native MSI identity before installation, and never installs an older version. See Windows update verification and Linux updates.

ACME client plugins¶

Each plugin guide downloads the latest release from its JSON release record and checks the file's SHA-256. Retired direct latest plugin artifact URLs no longer work. Plugins handle DNS-01; reporting scripts are separate. The current plugin release is 0.1.12.

Client scripts¶

The CertIntel Agent is the preferred method for certificate monitoring, renewals and reporting. Its built-in workflows, scheduling and reporting make setup and ongoing operation easier. Start with the Windows Agent or Linux Agent.

These are optional example scripts that use the API to report similar information when a custom integration or existing ACME client is needed. They are available without signing in and are source examples, not a promise of signed release artifacts. Review the source and run them through your approved script deployment process. See each family's setup guide and bundled README.md for configuration.

All scripts read their CertIntel API base URL and API key from environment variables, falling back to values you edit at the top of the file - see each family's README for the exact variable names.