Skip to main content
A profile defines a kind of certificate the broker may issue. Profile names are referenced by hosts (in policy) and by the agent (in agent.yml’s certificates[].profile).

​
Fields

The schema rejects unknown fields per profile (additionalProperties: false).

​
type: wildcard

For *.zone certificates.
  • dns_names must contain exactly one entry of the form *.<zone>.
  • acme.challenge must be dns-01 (Let’s Encrypt does not allow http-01 for wildcards).
  • acme.credentials is required and resolves to your DNS provider credential.
The agent’s CSR must request a SAN whose host label sits under the same wildcard zone.

​
type: multi_san

For certificates with a fixed list of SANs.
  • dns_names lists every SAN the profile may include.
  • acme.challenge may be dns-01 or http-01.
  • acme.credentials is required for dns-01.
  • The agent’s CSR SANs must be a subset of dns_names.

​
renew_before

This is the broker-side renewal window. When an agent asks for a cached certificate and the cache entry is within renew_before of expiry, the broker requests a fresh certificate from ACME instead of returning the cached one. Agents have their own renew_before in agent.yml — they should be roughly equal to avoid an agent asking too late. Common values: 720h (30 days) for 90-day Let’s Encrypt certificates.

​
Credential references

The acme.credentials string is opaque to the policy compiler. It is interpreted by the configured secrets provider in broker.yml: See Secrets providers and Vault and OpenBao secrets.