6.5 Certificate Deployment Knowledge Base

This knowledge base covers built-in deployment templates that require platform-specific permissions, external tools, network access, or one-time configuration. Basic file deployments and simple service reloads remain documented in Built-in Deploy Templates.

Microsoft and Windows

Platform	Why it has a guide
Remote Desktop Services	Connection Broker, stand-alone Gateway, and HTML5 web client use different certificate paths.
Microsoft Exchange Server	Service selection, hybrid connector TLS bindings, and multi-server deployment.
Network Policy Server	Policy selection, ambiguous EAP certificates, and an NPS service restart.
SQL Server	Instance-specific registry paths, private-key permissions, and a service restart.
SQL Server Reporting Services	Existing HTTPS configuration, version-specific instance names, and binding recreation.
Azure Key Vault	Az modules, service-principal permissions, and soft-deleted certificate names.

Cloud platforms

Platform	Why it has a guide
AWS Certificate Manager	AWS CLI credentials, region selection, and ARN-based in-place replacement.
Kubernetes	kubectl context, namespace, RBAC, and secret naming.

Load balancers and network appliances

Platform	Why it has a guide
F5 BIG-IP	iControl REST permissions, administrative partitions, and client SSL profiles.
Citrix NetScaler	SSH keys and distinct single-host, HA, and cluster workflows.
Palo Alto	XML API Import and Commit permissions.
Fortinet FortiGate	REST API token permissions, certificate scope, VDOMs, and target selection.
SonicWall	SonicOS API enablement and certificate-authenticated VPN policy requirements.
Cisco Firepower	FDM deployment behavior and target object selection.
Cisco ISE	OpenAPI, node reachability, portal tags, and manual CA trust import.
Aruba ClearPass	API permissions, callback networking, service restarts, key algorithms, and Trust List requirements.
Juniper SRX	Junos REST enablement, PKI privileges, and shared IKE policy behavior.
Kemp LoadMaster	API enablement, certificate permissions, fixed names, and intermediate certificates.

Before troubleshooting

Check the failed deployment’s output first. The built-in templates validate required settings and usually identify the failed API request, target object, or missing prerequisite. For agent installation, upgrade, or runtime problems that are not specific to a deployment target, use Agent Troubleshooting.