Concepts and Requirements
Platform and deployment settings
| Setting | Where to obtain it or how to choose it |
|---|---|
| Node ID | Deployment node identifier in the platform, such as node-… |
| Node Token | Node authentication credential, stored in config.yaml under node.token |
| Certificate ID | Platform certificate identifier, such as cert-…, used for output directories and advanced mappings; ordinary setup does not require entering it |
| Certificate-to-node association | Associate the certificates to deploy with the node in the platform |
| Local destination | Certificate and key paths the application reads, or the DSM/IIS target |
| Activation method | For example, an nginx reload command, a custom script, or the built-in DSM/IIS operation |
| Runtime account | An account that can read credentials, write outputs, and perform deployment operations |
node-REPLACE, cert-REPLACE, example.com, and YOUR_TAG are example values. Replace them before use.
Terminology
| Term | Meaning |
|---|---|
| Node | A logical platform deployment node identified by a node ID and Token |
| Instance | An actual CertOne installation with its own persistent instance ID |
| Target | A set of local deployment operations, such as updating nginx certificates and reloading nginx |
| Node association | A certificate linked to a deployment node in the platform; discovered automatically without entering certificate IDs |
State directory (state_dir) | Stores instance identity, cached certificates, deployment records, and recovery information |
One node can have multiple instances, such as two web servers. They may share node credentials, but each must have its own state directory.
Environment requirements
- The package must match the OS and CPU architecture, and the system clock must be correct.
- The runtime must be able to connect outbound to the CertOne platform. Proxies and firewalls must allow persistent WebSocket connections. The agent includes the connection settings; no platform address needs to be configured.
- State and certificate output directories need sufficient space and must be writable by the runtime account.
- Applications and commands required by file targets must be installed.
- Synology targets must be able to reach the DSM API from the agent environment.
- IIS targets require Windows, IIS management permissions, and the WebAdministration module.
Permissions and startup procedures vary across OS versions, DSM versions, and application images. Complete a one-time deployment and verify the application before enabling automatic deployment.