Supported platforms
CertPilot's host agent installs certificates on the platforms listed below. Each page covers the configuration required, the commands the agent runs, and the limitations that apply.
| Platform | Type | Notes |
|---|---|---|
| nginx | Web server | Reloads without dropping connections |
| Apache httpd | Web server | Graceful restart completes in-flight requests |
| HAProxy | Load balancer | Requires certificate and key in a single file |
| Caddy | Web server | Requires auto_https off |
| Apache Tomcat | Java application server | Requires a PKCS#12 keystore |
| PostgreSQL | Database | Reloads without a restart |
| MariaDB and MySQL | Database | Reloads via FLUSH SSL |
| Postfix | Mail transfer agent | Certificate presented on port 25 |
| Dovecot | IMAP and POP3 server | Certificate presented to mail clients |
| Microsoft IIS | Web server | Windows. Imports into the certificate store; reads no file |
A platform is listed here only after it has been tested. Platforms that have not been tested are not listed, which does not mean they cannot be used — see Unlisted platforms below.
How platforms are tested
Each Linux platform has an automated test, run by make verify-profiles. It needs a container runtime, so it is run on demand rather than in CI. For each platform, the test:
- Starts the service in a container with an initial certificate.
- Installs a second, different certificate using the agent.
- Runs the platform's configuration check and reload commands.
- Opens a TLS connection from outside the container and confirms the service returns the newly installed certificate and its chain.
IIS cannot run in a container and is tested in CI on a Windows runner instead, to the same standard: install, then renew, then a deliberately unprovable install, with a TLS handshake from outside after each. See how this platform is tested.
The versions each platform was last tested against are recorded in the agent and shown by certpilot-agent profiles <name>.
Configuration check coverage
Before reloading a service, the agent runs that platform's configuration check command. If the check fails, the previous certificate is restored and the service is not reloaded.
Check commands differ in what they detect. The table below records results measured by running each check against a live instance in three states.
| Check command | Missing certificate file | Certificate and key mismatch | Syntax error |
|---|---|---|---|
nginx -t | Detected | Detected | Detected |
Apache configtest | Detected | Not detected | Detected |
HAProxy -c | Detected | Detected | Detected |
Caddy validate | Detected | Detected | Detected |
Dovecot doveconf -n | Not detected | Not detected | Detected |
Postfix check | Not detected | Not detected | Detected |
| PostgreSQL | No check command available | ||
| MariaDB and MySQL | No check command available | ||
| Apache Tomcat | No check command available | ||
| Microsoft IIS | No check command available; verify reconnects afterwards |
Where a check command does not detect a fault, or does not exist, post-renewal verification provides the backstop: it reconnects to the endpoint after deployment and reports the certificate the service is actually serving.
Unlisted platforms
Platforms without a tested profile. Jetty, Kafka, Elasticsearch, Traefik, Redis, Prometheus and LiteSpeed are not listed because they have not been tested, not because they are unsupported. The agent requires only a file path, a format, a check command and a reload command, which can be specified manually. See agent.md for the configuration format.
Windows services other than IIS. Exchange, ADFS, Network Policy Server and Remote Desktop Services read from the same certificate store as IIS and differ only in the command that binds a thumbprint to them. Each is the IIS profile with a different bind, and none has been run by this project — see other consumers of the store. The Linux profiles above do not apply on Windows: each describes a service reloaded with systemctl, and naming one there is refused. See where the agent runs.
Appliances without a writable filesystem. F5 BIG-IP and Azure Key Vault are updated through their APIs by CertPilot Core rather than by the host agent. See deployment.md.