Documentation › Using Steward IT Census
Certificate renewal
Assets › Certificate renewal (administrators) keeps your servers' certificates renewed with free, trusted certificates from Let's Encrypt and binds each new certificate to the services that use it: Exchange, IIS, Remote Desktop Services, WSUS, Remote Desktop, or Linux services such as nginx and Postfix. It works like a certificate client on every server, managed in one place.
Licensing#
Real certificates on one server are free, and Let's Encrypt's test service (staging) is free on any number of servers: try Census on all of them with staging certificates first. For more servers with real certificates, add certificate renewal to your license: $50 per server or $500 for unlimited servers. The page shows how many servers use real certificates and how many your license covers.
- A server counts once it has a real (not staging) entry, whether it's switched on or not; several certificates on one server count once.
- The free server can move. When you use more servers than you bought (the free one is in use), removing a server from the list, or switching it to staging, revokes its certificate at Let's Encrypt (Census asks before it does), and the free place can move to another server again after 14 days. Put another certificate on that server first: clients that check revocation (such as Firefox and many Windows programs) will refuse the revoked one. Removing a server that never got a real certificate costs nothing.
- If a license key is removed, the servers added first keep their renewals; the others pause until the license covers them again.
How it works#
For each server on the list, about 30 days before the certificate expires:
- The server makes its own private key and a certificate request (Windows:
certreqin the computer's certificate store; Linux:openssl). The private key never leaves the server: Census never sees or stores it. - Census orders the certificate from Let's Encrypt for that request. It proves you own the names with the DNS check, through the DNS provider set under HTTPS certificate (the provider's token stays on the Census server; the server itself needs no internet access and no open port). Census also checks that the request asks for exactly the names on the list.
- The server installs the certificate, pairs it with its waiting key and binds it to the chosen services. Census then connects to the server's ports (443, 3389, 8531…) to check they serve the new certificate; for a server at a remote site, the site's scanner does that check (scanner 0.66.0 or later; with an older scanner the history says to update it).
Census runs both server steps like a deployment: through the Census agent when it's online, otherwise over WinRM or SSH with your stored credentials, or through the site's remote scanner. Each step appears under Deployment › Deployment history as Certificate renewal: …, with its output, and in the entry's Log.
Before you start#
The page's Get started steps walk through this:
- Connect your DNS provider (once): choose where your domain's public DNS is hosted and enter its API token, right on the Certificate renewal page. Let's Encrypt proves you own the names with a temporary TXT record; Census creates and deletes it with that token. You don't need a Let's Encrypt account, an open port or a Let's Encrypt certificate for the console itself (the same setting is used for Configuration › HTTPS certificate). Test DNS provider then creates a temporary TXT record for a name you enter, waits until public DNS shows it and deletes it again: a check of the token and the zone without asking Let's Encrypt. Where to create the token for each provider: HTTPS certificate; for DNS hosts without an API: Any DNS host.
- The names must be in a public domain you own (
mail.example.com), not an internal one (server.corp.local). - The server must be reachable by Census (agent, WinRM or SSH as an administrator / root).
Adding a server#
Servers found on the Certificate renewal page lists the servers Census has inventoried (Census agent, WinRM or SSH) that run a service it can bind a certificate to (IIS, Exchange, SQL Server, AD FS, a domain controller, nginx, Postfix…) and aren't on the list yet. Set up opens the form with that server's services ticked and the names of its current certificates filled in.
Or click Renew a certificate here automatically… on a server's Certificates tab (or Renew automatically next to one of its certificates), or click Add a server on the Certificate renewal page (the form opens at the top; Edit on a server opens it the same way):
- Server: the computer that uses the certificate. Census suggests the names from its current certificates and the services it runs.
- Names: the names clients connect to, the first one being the main name. Wildcards (
*.example.com) work. - Bind to: what the certificate is for (below).
- Renew this many days before expiry (default 30). Let's Encrypt also suggests a renewal time for each certificate, which Census follows.
- Test with Let's Encrypt staging: a certificate browsers don't trust, for a test without touching Let's Encrypt's limits. Free on any number of servers.
Add and renew now starts the first certificate right away.
What Census binds#
| Choice | What happens |
|---|---|
| Certificate store only | Installs it into the computer's Personal store (LocalMachine\My), named after the main name. Use this for anything Census doesn't bind: the trusted certificate is there to select by hand. |
| IIS | Every https binding with one of the names as host name, or that used the previous certificate, gets the new one. The first time, when a site's bindings have no host name, enter the IIS site: all its https bindings get it. |
| Exchange | Enable-ExchangeCertificate for IIS and SMTP. Connectors that name the previous certificate (as the Hybrid Configuration Wizard sets them up) are updated to the new one. |
| Remote Desktop Services | On the connection broker of an RDS deployment: the Gateway, Web Access, Redirector and Publishing roles the deployment has (the certificate is copied to the deployment's other servers, so its key is made exportable). On a standalone RD Gateway: the gateway's certificate. |
| WSUS | The SSL binding of the WSUS Administration site (port 8531). Turning SSL on in WSUS the first time is still done by hand. |
| Remote Desktop (RDP) | The certificate the computer's Remote Desktop listener presents. |
| SQL Server | Every SQL Server instance on the server gets the certificate for encrypted connections (the instance's Certificate setting), and its service account may read the key. SQL Server only loads a new certificate when it starts: tick Restart SQL Server after each renewal to have Census restart each instance and the SQL Server Agent right away (connections drop for a few seconds), or restart it yourself before the old certificate expires. Clients that check the certificate need the server's own name on it. |
| AD FS | On an AD FS server: the SSL certificate (Set-AdfsSslCertificate) and the service-communications certificate (Set-AdfsCertificate, only possible on the primary server of a farm), then AD FS restarts. On a Web Application Proxy: its certificate and every published application that used the previous one. Token-signing certificates are not touched. Set-AdfsSslCertificate reaches every farm server through PowerShell remoting, which isn't possible from Census's remote session; Census then binds the certificate to this server's AD FS bindings directly (the result says so), so add every AD FS server of a farm to Census. In a farm all nodes must use the same service-communications certificate: use this on single-server AD FS, or on the primary server and import that certificate on the others by hand. |
| LDAPS (domain controller) | Secure LDAP (port 636) and Global Catalog SSL (3269): the certificate goes into the AD DS service's own store (which takes priority over other certificates on the domain controller) and AD DS loads it at once, without a restart. The certificate must name the domain controller (e.g. dc1.corp.example.com), so its names must be in a public domain you own. |
| WinRM HTTPS | The computer's WinRM HTTPS listeners (port 5986). The listener's host name is set to one of the certificate's names. |
| Windows Admin Center | Windows Admin Center on this server: the current version (2.x) through its configuration module (it finds the certificate by its subject name; Census gives its service account read access to the new key), the older gateway through its HTTPS binding. It restarts. Windows Admin Center only starts with a certificate the server trusts, so Census checks the chain first (Let's Encrypt's test service is refused with a message) and puts the previous certificate back if it doesn't start. |
| SSTP VPN | Routing and Remote Access (SSTP) uses the certificate (Set-RemoteAccess), and the HTTPS bindings on the SSTP port (443) get it too, which SSTP needs to start. If IIS also answers on port 443 without a host name, it shares that binding and so gets this certificate as well: put the web site's names on the same certificate. RRAS restarts, so VPN users reconnect once. |
| Reporting Services | SQL Server Reporting Services or Power BI Report Server: its HTTPS URLs (Web Service and Web Portal) that use the previous certificate or one for these names get the new one. The first time, add an HTTPS URL in Report Server Configuration Manager with any certificate for these names. |
| IIS FTP (FTPS) | IIS FTP sites whose SSL certificate is the previous one or one for these names, or the site entered as IIS site. |
| Other HTTPS ports | Any other port that was bound to the previous certificate in Windows' HTTP service (netsh http show sslcert), for example a self-hosted web application, gets the new one. The first certificate has no predecessor, so this applies from the first renewal on. |
| Certificate files (Linux / macOS) | Writes cert.pem, chain.pem, fullchain.pem, privkey.pem (mode 600) and combined.pem (for haproxy) to /etc/ssl/census/<main name>/. Census reloads the services you tick (nginx, Apache, haproxy, Postfix, Dovecot, lighttpd, Caddy) after each renewal. |
| nginx (Linux) | Census reads nginx's configuration (nginx -T), finds the server blocks whose server_name is one of the certificate's names, and points their ssl_certificate and ssl_certificate_key at the files above. See nginx and Apache. |
| Apache (Linux) | The same for Apache virtual hosts (ServerName / ServerAlias, found with apachectl -S): SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile. |
| Postfix (Linux) | Incoming mail (STARTTLS): smtpd_tls_chain_files, or smtpd_tls_cert_file and smtpd_tls_key_file, point at the files (postconf), checked with postfix check (main.cf is put back if it fails), then Postfix reloads. If TLS is off for incoming mail, the result says so. |
| Dovecot (Linux) | Census writes /etc/dovecot/census-ssl.conf (Dovecot 2.4 ssl_server_cert_file, 2.3 ssl_cert = <…) and includes it at the end of dovecot.conf, checks with doveconf that Dovecot reads the certificate (otherwise it puts everything back and says which certificate Dovecot uses instead), then reloads Dovecot. |
| HAProxy (Linux) | Every certificate named on a bind … crt line: a file holding the previous certificate or one for the main name is replaced with combined.pem's content, a folder gets census-<name>.pem (HAProxy picks certificates by name). Checked with haproxy -c, put back on failure, reloaded. The first time, point a bind line at /etc/ssl/census/<name>/combined.pem or at a folder. |
| Proxmox (Linux) | The web console of Proxmox VE (port 8006; with pvenode cert set), Proxmox Backup Server (8007) and Proxmox Mail Gateway (console, and mail when it has a TLS certificate), whichever run on the server. |
| Cockpit (Linux) | /etc/cockpit/ws-certs.d/99-census.crt and .key (one combined .cert on older versions); Census checks that Cockpit picks it (it takes the last file by name) and restarts Cockpit. |
| Webmin (Linux) | Webmin and Usermin (miniserv.conf: keyfile, certfile, extracas); restarted, and the file is put back if Webmin doesn't start. |
| UniFi Network (Linux) | The self-hosted UniFi Network Application's keystore (port 8443), imported with Java's keytool; put back if the import fails. UniFi restarts. UniFi consoles (Dream Machine, Cloud Key) are not covered. |
| Run a command | Your own command after each renewal, for software Census doesn't know. See Your own command. |
If a binding fails, the certificate stays installed, the previous certificate stays bound there, and the entry shows the problem.
nginx and Apache#
With nginx or Apache ticked, Census configures the web server itself after installing the files:
- Every configuration file it changes is copied first to
/etc/ssl/census/<main name>/backup-<date and time>/. Symbolic links (sites-enabled) stay links: the file they point to is changed. - Only the certificate lines of the sites for the certificate's names change. Other sites, and anything else in those files, stay as they are.
- Census tests the configuration (
nginx -t,apachectl -t). If the test fails, every change is put back and the entry shows the web server's message; the running web server isn't touched. - If the test passes, the web server is reloaded (no dropped connections).
At later renewals the sites already use the files, so nothing changes in the configuration: the new certificate is written to the same files and the web server reloaded.
Add HTTPS to sites that only have HTTP (off by default): for a site with these names that only answers on HTTP, nginx gets listen 443 ssl (and [::]:443 when the site listens on IPv6) in the same server block; Apache gets a copy of the virtual host on port 443 in a new file census-<name>-ssl.conf next to the original, enabled like a2ensite does (on Debian/Ubuntu Census also runs a2enmod ssl; on Red Hat-like systems mod_ssl must be installed). HTTP keeps working as before: add a redirect to HTTPS yourself if you want one.
Sites set up by another certificate tool (for example certbot) are switched to Census's files too; turn that tool's renewal off for those names.
Your own command#
Run a command runs what you enter after the certificate is installed and the other choices are done. A non-zero exit code (or an error) is reported as a problem; the last lines of its output show in the result.
- Linux / macOS: runs with
shas root (through the Census agent, or the SSH login with sudo). It getsCENSUS_CERT,CENSUS_CHAIN,CENSUS_FULLCHAIN,CENSUS_KEY,CENSUS_COMBINED(file names),CENSUS_CERT_DIR,CENSUS_NAMESandCENSUS_THUMBPRINT. Example:cp "$CENSUS_FULLCHAIN" /opt/app/tls.crt && cp "$CENSUS_KEY" /opt/app/tls.key && systemctl restart app. - Windows: runs in Windows PowerShell as SYSTEM (through the Census agent) or as the administrator account Census signs in with (WinRM). It gets
$env:CENSUS_THUMBPRINT,CENSUS_OLD_THUMBPRINT,CENSUS_NAMESandCENSUS_CERT(a.cerfile). Example:Set-MyAppCertificate -Thumbprint $env:CENSUS_THUMBPRINT. - Also save a PFX file (Windows): for software that wants a PFX file with the key, Census exports one to
C:\ProgramData\StewardCensus\certs\<main name>\cert.pfx(readable by SYSTEM and Administrators only) with a new random password incert.pfx.passwordnext to it and in$env:CENSUS_PFX_PASSWORD(with$env:CENSUS_PFXfor the file). This makes the key exportable, from the next certificate Census requests on.
Only administrators can set the command; it runs with full rights on that server, like a script deployment.
Exchange hybrid#
Routine renewals need no Office 365 sign-in: Exchange Online recognizes your servers by the certificate's names, which don't change. Census only updates the on-premises connectors.
If you change the names of a certificate on an Exchange server with hybrid set up, Census installs and binds the new certificate, then marks the entry Needs an administrator: run the Hybrid Configuration Wizard (it signs in to Office 365) so Exchange Online uses the new names, then click Done. Census never stores Office 365 administrator credentials.
Several servers with the same names#
Servers behind one name (Exchange servers behind mail.example.com, a load-balanced IIS farm, an RD Gateway farm) each get their own certificate for the same names, with their own key. Add each server to the list.
Let's Encrypt issues at most 5 new certificates for the same set of names per week. Census orders at most 4 new ones a week per set of names and spaces the rest out (the entry shows waiting with the date). Renewals don't count: Census renews each certificate as a replacement of the previous one (ACME Renewal Info), which Let's Encrypt exempts from its limits, so this only matters when you add many servers at once.
Failures and alerts#
A failed renewal is retried after 1, 3, 6 and 12 hours, then daily, while the current certificate keeps working. A certificate that was issued but couldn't be installed is installed again (not ordered again). The Certificate renewal needs attention alert emails you when a renewal fails or needs an administrator.
Renew now starts a renewal at once, Log shows the last run, Remove stops renewing (the certificate already on the server stays, unless removing it moves the free server: see Licensing). The server of an entry can't be changed; add a new entry for another server.
Notes#
- Census uses RSA 2048-bit keys, which every Windows service accepts.
- Windows keys are made with the Microsoft RSA SChannel provider in the computer's store and are not exportable (except for RDS deployments, which need to copy the certificate between servers, and with Also save a PFX file).
- Linux services Census changes (Postfix, Dovecot, HAProxy, Webmin, UniFi…) keep a copy of each file it changes in
/etc/ssl/census/<main name>/backup-<date and time>/. - Old certificates stay in the store after a renewal; remove them when you like.
- Certificates from your own certificate authority (Active Directory Certificate Services) aren't renewed by Census.