6.4 Built-in Deploy Templates

Deployment recipes for common software

CertKit includes a library of built-in deployment templates for common services and platforms. These templates pre-fill deployment configurations with optimized certificate formats and post-deployment update scripts.

Windows Templates

Basic Starters

Standard templates for common certificate formats with no pre-configured post-deployment scripts.

Template	Format	Variables Provided
Custom Windows Certificate Store Template	`windows-cert-store`	`$thumbprint`, `$certificate` (X509Certificate2)
Custom PFX Template	`pfx`	`$certPath`, `$pfxPasswordFilePath`
Custom PFX with Password	`pfx`	Copies the PFX to PFX Destination, protected with PFX Password.
Custom PEM Template	`pem-key`	`$certPath`, `$keyPath`, `$chainPath`
Custom Java KeyStore Template	`jks`	`$certPath` (to .jks file)

Service Specific

Windows roles and services

These run on the Windows server that hosts the service.

IIS site binding: Binds the certificate to an IIS site’s HTTPS binding on the port you choose. Creates the binding if none exists.
IIS site binding (SNI / host header): Binds the certificate by hostname for sites sharing an IP address and HTTPS port.
Remote Desktop (RDP listener): Sets the RDP-tcp listener certificate through WMI. No restart is needed.
Remote Desktop Services (full deployment): Sets the certificate on the RD Gateway, RD Web Access, RDRedirector, and RDPublishing roles from the Connection Broker. Needs Windows Server 2019 or later. A Windows Server 2016 version of this template covers older brokers. See the Remote Desktop Services guide.
Remote Desktop Gateway (standalone): Sets the certificate on a stand-alone RD Gateway and restarts the TSGateway service. Not for gateways managed by a Connection Broker.
Remote Desktop Web Client (HTML5): Re-imports the Connection Broker certificate into the HTML5 web client, which keeps its own copy. Pair it with a full deployment template.
Microsoft Exchange Server: Enables the certificate for Exchange IIS and SMTP, then refreshes Send and Receive connectors and the hybrid TLS certificate that still point at the old one. RSA keys only. See the Exchange guide.
Active Directory Federation Services (AD FS): Replaces the SSL and service communications certificates and restarts the adfssrv service. RSA keys only. See the AD FS guide.
AD FS Web Application Proxy (WAP): Replaces the certificate on the proxy servers in front of AD FS and re-points published apps still on the old certificate. RSA keys only.
Network Policy Server (NPS / RADIUS): Updates the PEAP and EAP-TLS certificate on the network policies you name, then restarts NPS. See the NPS guide.
SQL Server TLS (registry bind): Writes the thumbprint to the instance’s SuperSocketNetLib registry key, grants the service account access to the private key, and restarts SQL Server. RSA keys only. See the SQL Server guide.
SQL Server Reporting Services (SSRS): Rebinds the SSRS HTTPS bindings to the new certificate and restarts the service. See the SSRS guide.
WinRM HTTPS listener: Recreates the HTTPS listener bound to the host FQDN.
netsh HTTP listener (port 443): Binds the certificate to 0.0.0.0:443 with netsh http for Web Deploy, WCF, and other HTTP.sys services.

Applications

These run on the server that hosts the application.

Oracle WebLogic Server: Replaces WebLogic’s keystore file and reloads its SSL settings without a restart. See the WebLogic guide.
Absolute Secure Access (NetMotion Mobility) Server: Replaces the console certificate and restarts the web server service. See the Absolute Secure Access guide.
Omnissa Horizon Connection Server (formerly VMware Horizon) (beta): Imports the certificate for Horizon, restarts the Connection Server, and keeps the previous certificate for rollback. RSA keys only. See the Omnissa Horizon guide.
OpenVPN Community Edition Server: Writes the certificate and key next to the server profile, points the profile at them, and restarts the OpenVPN service. See the OpenVPN guide.
Fortra Intermapper: Writes a single PEM file to Intermapper’s certificate folder and restarts the InterMapper service. RSA keys only.
OCLC EZproxy: Writes the certificate as number 99 in EZproxy’s ssl folder and restarts EZproxy. See the EZproxy guide.

Network appliances

The agent pushes the certificate to the appliance over its management API or SSH. Templates for the same product are listed together.

A10 Thunder: Client SSL Template swaps the certificate into the Client SSL templates you list. Management Web UI replaces the certificate on the web GUI and aXAPI. See the A10 Thunder guide.
Aruba Mobility Controller: Admin WebUI and Captive Portal install the certificate over SSH and save the configuration. See the Aruba Mobility Controller guide.
Aruba ClearPass: HTTPS(RSA) Server Certificate, HTTPS(ECC) Server Certificate, RADIUS/EAP Server Certificate, and Service Certificate (Per-Service RADIUS/EAP) import the certificate as a PFX through the REST API. The ECC template needs an EC key. See the ClearPass guide.
Cisco Firepower: Remote Access VPN and SAML Server templates for devices managed by FDM, and the same pair for devices managed by FMC 7.7 or later (FMC in beta). The SAML templates need an RSA key. See the Cisco Firepower guide.
Cisco ISE: Portal and EAP Authentication deploy the system certificate to every Connected node through the ISE OpenAPI. See the Cisco ISE guide.
Citrix NetScaler: Single Host, HA Pair, and Cluster, each with Private Key Auth or Password Auth. Uploads the files over SCP and refreshes the named certkey pair over SSH. The HA Pair and Cluster templates are experimental. See the NetScaler guide.
F5 BIG-IP: SSL Client Profile (REST API) and SSL Server Profile (REST API) upload the certificate and key over iControl REST and swap them into the profile you name. See the F5 BIG-IP guide.
Fortinet FortiGate: Admin UI, IPsec VPN, SSL-VPN, and User Authentication Services upload the certificate through the FortiOS REST API and bind it to that service. See the FortiGate guide.
Ivanti Connect Secure (Pulse Secure): VPN Device Certificate: Installs the device certificate through the REST API and assigns it to the selected ports. See the Ivanti guide.
Juniper SRX: IPsec VPN: Loads the certificate into the SRX PKI store and binds it to the IKE policy of the VPN you name. See the Juniper SRX guide.
Kemp LoadMaster (REST API): Replaces a named certificate so Virtual Service bindings keep working. See the Kemp LoadMaster guide.
Omnissa Unified Access Gateway (formerly VMware UAG) (beta): Uploads the certificate as a PFX to the Internet-facing interface and checks that the appliance serves it. RSA keys only. See the Omnissa Horizon guide.
Palo Alto: Firewall, Panorama, and Panorama Template import the certificate through the PAN-OS XML API and commit. The Panorama Template version can also push to a Template Stack. See the Palo Alto guide.
SonicWall Firewall: SSL VPN and IPSec VPN import the certificate as a PFX through the SonicOS API and bind it to that service. See the SonicWall guide.
WatchGuard Firebox (beta): Web Server Certificate, Mobile VPN with IKEv2 Certificate, and Inbound HTTPS Proxy Server Certificate deploy over SSH to a locally managed Firebox. See the WatchGuard guide.

Cloud services and platforms

The agent pushes the certificate to the service over its API.

Azure Key Vault: Imports the certificate as a PFX into the vault you choose, signing in with a service principal. See the Azure Key Vault guide.
Microsoft Entra Application Proxy (beta): Client Secret Auth and Managed Identity Auth update the SSL certificate on App Proxy apps that use your own domain. See the Entra Application Proxy guide.
Boomi: Runtime: Shared Web Server Certificate, API Gateway Certificate, and Developer Portal Certificate update a Boomi X.509 certificate component in place. The gateway and portal templates need one manual click in Boomi per renewal. See the Boomi guide.
IBM i (AS/400) RSE API (beta): Imports the certificate into the DCM *SYSTEM store, assigns it to the applications you list, and restarts IBM HTTP Server instances. RSA keys only. See the IBM i guide.

Generic

Restart a Windows service: Restarts a Windows service after deployment.
Log only (no side effects): Logs the deployment and changes nothing. Useful for testing.

Linux Templates

Basic Starters

Template	Format	Variables Provided
Custom PEM Template	`pem-key`	`$CERT_PATH`, `$KEY_PATH`, `$CHAIN_PATH`
Custom PFX Template	`pfx`	`$CERT_PATH`, `$PFX_PASSWORD_FILE_PATH`
Custom Java KeyStore Template	`jks`	`$CERT_PATH` (to .jks file)

Service Specific

Services on the agent host

nginx: Runs nginx -t followed by nginx -s reload.
Apache HTTP Server: Runs apachectl configtest followed by apachectl graceful.
HAProxy: Validates the configuration and reloads the service.
Traefik: Reloads Traefik so it picks up the new certificate from disk.
PostgreSQL: Reloads the service to pick up new certificate material.
MySQL / MariaDB: Performs a service restart (required for TLS certificate updates).
Postfix: Validates the configuration and reloads the service.
Dovecot: Reloads Dovecot with doveadm reload.
Prometheus: Reloads the Prometheus configuration.
Elasticsearch: Writes the PEM files, sets their group and permissions, and restarts Elasticsearch.
Kibana: Writes the PEM files, sets their permissions, and restarts Kibana.
PM2 (Node.js process manager): Runs pm2 reload all as root by default. See the PM2 guide to use a different account.
OpenVPN Community Edition Server: Replaces the certificate and key in the server config, restarts OpenVPN, and rolls back if it fails to start. See the OpenVPN guide.
OpenVPN Access Server: Web Services Certificate: Applies the certificate to the Access Server web interfaces with sacli. VPN sessions stay connected. See the OpenVPN guide.
Sisense (beta): Replaces the TLS secret used by the Sisense ingress controller. See the Sisense guide.
Docker container (SIGHUP): Sends SIGHUP to a specific container to trigger a configuration reload.

Remote targets

The agent pushes the certificate to another system over its API.

Kubernetes TLS secret: Creates or updates a kubernetes.io/tls secret with kubectl. See the Kubernetes guide.
AWS ACM Import: Imports the certificate and chain into AWS Certificate Manager. See the AWS Certificate Manager guide.
F5 BIG-IP: SSL Client Profile (REST API): Shell version of the Windows template. Uploads the certificate and key over iControl REST and swaps them into a client-ssl profile. See the F5 BIG-IP guide.
Palo Alto Firewall (PAN-OS API): Imports the certificate through the PAN-OS XML API and commits. See the Palo Alto guide.

Generic

Restart a systemd service: Reloads a systemd-managed service after deployment.
Log only (no side effects): Logs the deployment and changes nothing. Useful for testing.

For appliance and platform requirements, see the Deployment Knowledge Base. It has a guide for every network appliance and cloud template on this page.

For services not listed here, you can create a Custom Deploy Template.

Platform requirements and troubleshooting

Templates that require vendor API access, external tools, special permissions, or one-time trust configuration have permanent setup and troubleshooting notes in the Deployment Knowledge Base. The template chooser remains the source for the current script and its input fields. The knowledge base explains the surrounding platform configuration.