Skip to main content

⚙️ Workflow Management

This guide explains step by step how to configure certificate lifecycle automation rules, create and manage workflows in SecTrail CM.

About the Feature

Workflow management enables you to automate certificate renewal, deployment, and notification processes. With server-based automation rules, you can centrally manage certificate lifecycles.

Automatic Operation Principle: Once configured, the system regularly monitors certificate expiration based on your renewal threshold value (e.g., 15 days). As expiration approaches, it automatically initiates the workflow steps you've defined (approval, renewal, deployment) and performs certificate renewal and installation when the time comes.

Workflow Policies List​

View and manage all created workflow policies.

Access Path

To access workflow policies: Go to Workflow → Policy menu.

Workflow Policies List

Workflow Policies - All Automation Rules

List Information​

The following details are displayed for each policy in the workflow list:

ColumnDescription
Workflow IdentifierAutomatically generated unique identifier for the workflow (e.g., ST-0b6c4befb1)
Created AtPolicy creation date and time
TypeWorkflow type (Certificate-Renewal-Confirmation, Certificate-Renewal, Deliver, Deployment)
Common NameCommon name information of the certificate to which the workflow applies
Certificate Signature TypesCertificate signature type (ACME, RSA, ECDSA)
Certificate Expire DateExpiration date of the associated certificate
ActionsAction buttons for editing and deleting
StatusWorkflow status: Active or Inactive

Workflow Details​

Each workflow record can be expanded to view detailed information:

Detail Fields​

  • Renewal Confirmation Mails: Email addresses for renewal approval notifications
  • CA Type: Certificate authority type used (ACME, Internal CA)
  • Deliver mails: Email addresses to receive certificate delivery notifications
  • Host: Server IP address for deployment
  • Device Type: Target device type (Apache, Nginx, F5, etc.)
  • Virtual Host: Virtual host configuration
  • ServerName: Server name information

Available Actions​

Top Menu Actions​

  • Add New Flow - Create new workflow policy
  • Search - Search workflows by identifier number
  • Edit - Edit existing policy (pencil icon)
  • Delete - Delete policy (trash icon)
  • Expand/Collapse - Show/hide detail information
Caution

Deleting an active workflow will stop automatic certificate renewal and deployment processes. Make sure before deleting.

Creating New Workflow​

Create certificate lifecycle automation rules.

Access Path

To create a new workflow: Click the Add New Flow button on the Workflow → Policy page.

Add Workflow Rule

Creating New Workflow Rule

Basic Configuration​

1. Workflow Type and Certificate Selection​

ParameterDescriptionOptions
Workflow TypeSpecify the automation rule typeServer Based Automation
Discover CertificateSelect the discovered certificate to which the workflow appliesCertificate selection from discovery list
Select ServersSpecify the servers where automation will runIP address or hostname selection (supports multiple selection)
Renewal ThresholdCertificate renewal threshold value (days)How many days before certificate expiration to renew (default: 15)
TemplateCertificate template to useSelection from predefined templates

Steps​

  1. Select Server Based Automation as Workflow Type
  2. Select the relevant certificate from the Discover Certificate dropdown
  3. Select target servers in the Select Servers field (multiple servers can be selected)
  4. Enter the number of days for Renewal Threshold (e.g., 15)
  5. Select the appropriate template from the Template dropdown

2. Deployment Configuration​

Deployment Configuration

Deployment Settings

Configure certificate deployment parameters.

ParameterDescription
DeploymentEnable automatic deployment (checkbox)
DevicesSelect target device type (F5, Apache, Nginx, etc.)
Virtual HostsSelect virtual host configurations for deployment
Devices (Secondary)IP address for secondary devices
Virtual Hosts (Secondary)Secondary virtual host configurations
Deployment TimeTime when deployment will occur (in HH:MM format)
Retry LimitNumber of retries for failed deployment

Configuration Steps​

  1. Check the Deployment checkbox
  2. Select the device type from the Devices dropdown
  3. Select relevant configurations for Virtual Hosts
  4. Enter IP address for secondary devices
  5. Enter time information in the Deployment Time field (e.g., 01:00)
  6. Specify the number of retries for Retry Limit (e.g., 1)

3. Confirmation Configuration​

Confirmation Configuration

Approval Notifications Settings

Configure approval processes for certificate renewal and deployment.

ParameterDescription
ConfirmationEnable confirmation mechanism
Renewal Confirmation EmailsEmail addresses for renewal approval (comma-separated)
Renewal Confirmation Emails ContentContent of renewal approval email
Deployment Confirmation EmailsEmail addresses for deployment approval
Deployment Confirmation Emails ContentContent of deployment approval email

Configuration Steps​

  1. Check the Confirmation checkbox
  2. Enter email addresses in the Renewal Confirmation Emails field
  3. Write the email text in the relevant content field
  4. Repeat the same steps for Deployment Confirmation Emails
  5. Add additional email addresses with the Add More button

4. Notification Configuration​

Notification Configuration

Notification Settings

Configure notification parameters for workflow processes.

ParameterDescription
NotificationEnable notification mechanism
Notification E-mailEmail addresses to receive notifications
Workflow Confirmation Error Message/Mail SubjectConfirmation error email subject and content
Workflow Renewal Error Message/Mail SubjectRenewal error email subject and content
Workflow Deployment Error Message/Mail SubjectDeployment error email subject and content
Workflow Completed Message/Mail SubjectSuccessful completion email subject and content

5. Send Certificate via Email​

Send Certificate via Email

Send Certificate via Email

Automatically send renewed certificates via email.

ParameterDescription
Send Inventory Certificate via EmailEnable email sending feature
Email to be sentEmail addresses to receive the certificate
BCCEmail addresses to receive blind copy
Mail SubjectEmail subject line
Mail TextEmail content text

Configuration Steps​

  1. Check the Send Inventory Certificate via Email checkbox
  2. Enter recipient email addresses in the Email to be sent field
  3. Add blind copy recipient addresses in the BCC field
  4. Write an appropriate subject for Mail Subject (e.g., "SecTrailCM Renewed Certificate")
  5. Enter the email content in the Mail Text field
  6. Click the Create button to save the workflow

Workflow History​

View the execution history and details of created workflows.

Access Path

To access workflow history: Click on a workflow identifier in the Workflow → Processes list.

Workflow History

Workflow History - Process Steps

History Information​

The following information is displayed for each workflow execution:

ColumnDescription
TypeOperation type (Certificate-Renewal-Confirmation, Certificate-Renewal, Deliver, Deployment)
StatusOperation status (Completed, Failed, Pending)
Deployment IdDeployment identification number
DetailsOperation details and descriptions
Created AtOperation start date and time
End AtOperation completion date and time

Status Indicators​

StatusDescription
🟢 CompletedOperation completed successfully
🔴 FailedOperation failed
🟡 PendingOperation in progress

Deployment Details​

When deployment records are expanded, the following details are displayed:

  • Devices: Target device list (e.g., f5_prod)
  • IP: Target server IP address
  • Port: Target port number
  • Virtual Host: Related virtual host configuration
  • Type: Deployment type (Client-Side, Server-Side)
  • Profile Name: Profile name used

Sample Deployment Record​

• Devices: f5_prod
• IP: 10.34.23.213
• Port: 443
• Virtual Host: Eğitim-SecTrail-Redirection
• Type: Client-Side
• Profile Name: wildcard_bntpro_com_2024_Q4_ST-4cb3205188

Search and Filtering​

  • Search: Search by workflow identifier
  • Date Filter: Filter history records by date range
  • Status Filter: Filter records by status
Pagination

At the bottom of the list, you can navigate through "Showing 1 to 5 of 5 entries" information and page numbers.

Workflow Scenario Example​

Below is a step-by-step workflow configuration with a real-world use case scenario.

Scenario: Automatic Wildcard Certificate Renewal and Deployment​

Situation: Your company uses a wildcard certificate for *.bntpro.com. This certificate is used on multiple servers (Apache, F5 load balancer).

Requirement: The certificate should be automatically renewed before expiration and deployed to all servers.

Step 1: Certificate Discovery​

  1. Create a certificate discovery rule from the Discovery → Discovery List menu
  2. Add target servers (10.34.23.213, 10.34.24.181, cm.bntpro.com:443)
  3. Start discovery and wait for certificates to be detected

Step 2: Workflow Creation​

  1. Click the Add New Flow button from the Workflow → Workflow Policies page
  2. Workflow Type: Select Server Based Automation
  3. Discover Certificate: Select CN=bntpro.com - 21-01-2026 09:52:47
  4. Select Servers: Select all servers
    • 10.34.23.213:443
    • 10.34.24.181:443
    • cm.bntpro.com:443
    • 0.0.0.0:443
    • crm.bntpro.com:443
    • sa.bntpro.com:443
  5. Renewal Threshold: Set to 15 days
  6. Template: Select lets_encrypt_template

Step 3: Deployment Configuration​

  1. Check the Deployment checkbox
  2. Devices (Primary): Select f5_prod
  3. Virtual Hosts (Primary):
    • Eğitim-SecTrail-Redirection - wildcard_bntpro_com_2024_Q4_ST-ad038846dc2 - 10.34.23.213:443
    • Eğitim_ss - wildcard_bntpro_com_2024_Q4_ST-ad038846dc2 - 192.192.192.193:443
  4. Devices (Secondary): 10.34.24.181
  5. Virtual Hosts (Secondary): cm.bntpro.com -*443
  6. Deployment Time: 01:00 (1:00 AM)
  7. Retry Limit: 1

Step 4: Confirmation Mechanism​

  1. Check the Confirmation checkbox
  2. Renewal Confirmation Emails: admin@example.com, sdg-dev@bntpro.com, destek@bntpro.com
  3. Deployment Confirmation Emails: admin@example.com

Step 5: Notification Configuration​

  1. Check the Notification checkbox
  2. Notification E-mail: admin@example.com
  3. Workflow Confirmation Error Message
  4. Workflow Renewal Error Message
  5. Workflow Deployment Error Message
  6. Workflow Completed Message

Step 6: Email Delivery​

  1. Check the Send Inventory Certificate via Email checkbox
  2. Email to be sent: admin@example.com, sdg-dev@bntpro.com, destek@bntpro.com
  3. BCC: admin@example.com
  4. Mail Subject: SecTrailCM Renewed Certificate

Step 7: Save and Activation​

  1. Click the Create button to save the workflow
  2. The workflow automatically becomes Active
  3. The system automatically starts the renewal process 15 days before certificate expiration

Workflow Execution Sequence​

The created workflow runs in the following sequence:

  1. Day 0-15: System checks certificate expiration
  2. Day 15 (Renewal Start):
    • Renewal approval email is sent
    • Waits for approval
  3. After Approval:
    • Certificate renewal process begins (ACME/Let's Encrypt)
    • New certificate is created
  4. Deployment Approval:
    • Deployment approval email is sent
    • Waits for approval
  5. At 01:00 (Deployment):
    • Deployment to F5 load balancer
    • Deployment to Apache server
    • Retry for each deployment (if failed)
  6. Completion:
    • If all operations succeed, notification email is sent
    • New certificate is shared via email
  7. Error State:
    • If an error occurs in any step, relevant error notification is sent
    • Detailed log record is created in Workflow Logs
Best Practices
  • Deployment Time: Set deployment time to low-traffic hours (1:00 AM-4:00 AM)
  • Retry Limit: Increase retry limit for critical systems
  • Notification: Add multiple administrator emails
  • BCC: Use BCC for archiving in all email notifications
  • Testing: Test with a test certificate during initial setup