Skip to content

Recent changes

Updated September 25, 2026, against the current CertIntel platform and Agent repositories. Agent workflow screenshots and instructions cover the 1.3.26 UI. Use Downloads for current release artifacts.

Agent workflows

  • + New certificate workflow opens a searchable template library, then the Workflow studio, then the three-stage certificate setup. Existing certificates use Edit workflow…. See the illustrated walkthrough.
  • Setup, Steps, Review, and Advanced separate shared settings, execution order, validation, and protected secret declarations. Steps support search, duplication, drag/reordering, and session undo/redo.
  • Insert value… selects variables, secrets, and earlier outputs; Compare a value builds conditions without writing JSON. Labels remain separate from stable reference IDs. See references and types.
  • Workflows can be exported and imported as independent copies. Protected secret values are not read into exports; set them on the destination.
  • Windows store/IIS templates remove the recorded predecessor after successful replacement confirmation by default. Set Remove previous certificate after confirmation to No to retain it. IIS-bound predecessors and private-key containers are retained.
  • Install again reruns saved installation using the issued certificate. Job logs start at the top and keep the reading position stable; Follow latest activity is optional. See actions and progress.

ACME issuance still completes before modular steps execute. These editing changes do not turn the obtain action into a pre-issuance hook or enable parallel execution.

Monitoring and reporting

  • Native Windows Agents honor active AD CS template assignments when scanning LocalMachine\My, including pagination, pauses, and normalized template-OID matching.
  • Renewal reporting distinguishes the stable policy ID from an immutable attempt ID. Retries retain the attempt ID; a new issuance gets a new one, preserving previous success/failure history.
  • Organization expiry settings control warning/critical classification with smaller thresholds for short-lived certificates. Expiry digests use the owning organization's effective settings.
  • Trusted CA validation checks the X.509 path; fingerprint recognition alone is insufficient. Hostname matching remains a separate result.
  • Webhook deliveries keep a stable retry ID so a receiver can deduplicate repeated delivery.

Installation and access

The Install Tokens page provides installer commands with size/hash checks and interactive/silent choices. The Windows updater requires matching signed release records and checks the exact MSI before launch. MSI completion also checks the new service version and health.

Credential creation remains within the issuer's organization/workspace scope. Disabling an SSO provider invalidates its existing sessions.