Operations

This page covers day-to-day operation after Acmebot has been deployed.

Scheduled Renewal

The RenewCertificates timer runs once per day at midnight UTC. It lists Key Vault certificates and ensures a renewal scheduler is running for certificates that:

• Are enabled.
• Are tagged as issued by Acmebot.
• Match the currently configured ACME endpoint.

Each managed certificate has its own renewal state, next check time, and retry behavior. Once started, its Durable Functions scheduler wakes at the next check time independently of the daily timer. A certificate that is waiting, retrying, or falling back to an expiry-based policy does not reset the renewal schedule for other certificates.

Acmebot supports ACME Renewal Information (ARI). When the CA provides renewal information for a certificate, Acmebot selects a renewal time inside the certificate authority's suggestedWindow. The selection spreads certificates across the window and stays the same for the same certificate identifier and window. Acmebot renews when that selected time is reached and marks the new order as replacing the previous certificate when the CA supports it.

The next check is the earlier of the selected renewal time and the next ARI refresh. The refresh interval uses Retry-After when provided, bounded to one minute through one day, or six hours when absent. A refresh can update the renewal time if the CA changes its suggested window.

When renewal information is unavailable for a certificate, only that certificate falls back to Acmebot__RenewBeforeExpiry.

The default fallback renewal threshold is 30% of the certificate lifetime:

Acmebot__RenewBeforeExpiry=30

For example, a 90-day certificate is renewed when about 27 days remain. Use a larger value when downstream distribution takes longer or your organization requires a longer safety margin.

No separate pre-processing delay is added before due certificates are renewed.

If automatic renewal fails, that certificate records a retrying state and checks again after six hours.

Durable Functions History

When upgrading from the issuance workflow that enumerates zones separately in each DNS activity, allow in-flight certificate issuance operations to finish before deploying. DNS activity inputs and the precondition output now carry zone data, so previously persisted issuance histories cannot be replayed with the new formats. Renewal schedulers waiting between issuance operations can continue normally.

The PurgeInstanceHistory timer runs monthly and deletes completed or failed Durable Functions history older than one month, so the storage account does not accumulate old orchestration history.

Monitoring

Use Application Insights and Log Analytics to watch for:

• Function invocation failures.
• Durable orchestration failures.
• Outbound HTTP failures to ACME, DNS providers, Key Vault, or webhook endpoints.
• Webhook delivery warnings.
• Repeated DNS propagation retry messages.

Function execution logs, dependency telemetry, and exception telemetry are the most useful categories.

Webhook Notifications

Set Acmebot__Webhook__Endpoint to receive notification events:

Acmebot__Webhook__Endpoint=https://example.com/webhook

By default, the payload format is selected from the webhook host:

Host	Payload
hooks.slack.com	Slack attachment payload.
.logic.azure.com	Teams-style Adaptive Card payload.
.environment.api.powerplatform.com	Teams-style Adaptive Card payload.
Other hosts	Generic JSON payload.

Set Acmebot__Webhook__PayloadType to Generic, Teams, or Slack to override automatic detection. Explicitly select Generic when sending to a custom Logic App because Teams Workflows and custom Logic Apps can both use .logic.azure.com endpoints.

Use Acmebot__Webhook__Events to select which certificate operation events send notifications. The default is All.

# Send only failure notifications with a generic JSON payload.
Acmebot__Webhook__Endpoint=https://example.com/webhook
Acmebot__Webhook__PayloadType=Generic
Acmebot__Webhook__Events=Failed

Supported event values are Completed, Failed, All, and None. Combine Completed and Failed with a comma when listing them explicitly. The legacy Acmebot__Webhook=https://example.com/webhook setting remains supported with automatic payload detection and all events enabled.

Webhook failures are logged as warnings and never roll back certificate issuance.

Secret Rotation

To rotate DNS provider credentials:

1. Create the new credential in the DNS provider.
2. Update the Function App app setting.
3. Restart the Function App.
4. Load DNS zones from the dashboard to confirm the new credential works.
5. Revoke the old credential.

For Azure DNS and Key Vault, rotate by updating RBAC assignments or switching to a new user-assigned managed identity.

Common Failures

The most frequent operational issues are:

• Dashboard returns 401: App Service Authentication is not configured or does not require sign-in.
• DNS zones do not load: provider app settings or permissions are invalid; for Azure DNS, the managed identity may lack DNS access in the zone subscription.
• Name server precondition fails: the domain is not delegated to the provider's name servers.
• TXT record is not found: propagation is slow, or the validation design requires an internal resolver (Acmebot__UseSystemNameServer=true).
• ACME order becomes invalid: review the ACME problem details; persistent configuration errors require a new operation after the DNS issue is fixed.
• Certificate is not renewed: the certificate is disabled, lacks Acmebot metadata, was issued for a different endpoint, is outside the renewal window, or is not readable by the Function App identity.
• Endpoint still serves the old certificate: the certificate is current in Key Vault, but the consuming Azure service has not synced it.

See Troubleshooting for the full decision tree, and Azure Service Integration for downstream sync behavior.