Skip to content
Tidehawk Docs

Renewals and supersession

When a certificate is renewed, Tidehawk does not leave you with two rows for the same hostname. The new certificate supersedes the old one, and the alerts and tickets raised against the old one close themselves.

Supersession

Section titled “Supersession”

Every time discovery finds a certificate, Tidehawk compares it with the certificates already held for the same common name on the same client.

A certificate supersedes another when it expires later. Where two certificates share an expiry date, the one issued later wins, which handles a reissue on the same expiry boundary.

Once a predecessor is superseded, three things happen in order:

  1. The old certificate is stamped as superseded and linked to its replacement. It leaves the inventory and reads Resolved.
  2. Every open alert on the old certificate is resolved, with the reason recorded as superseded.
  3. Any PSA ticket one of those alerts opened is closed.

The comparison works in both directions. If a CT directory returns certificates newest first, an older certificate arriving after its successor is marked superseded immediately rather than slipping through unresolved.

Tidehawk also counts renewals: each successor inherits its predecessor’s renewal count and adds one, which is what feeds the auto-renew figures on the dashboard.

Renewal tracks

Section titled “Renewal tracks”

Every certificate sits on one of three tracks. Tidehawk assigns the track when it first sees the certificate, and you can change it.

Auto-renewing is for certificates a system renews for you. Tidehawk assigns it to certificates from Let’s Encrypt, ZeroSSL, Google Trust Services and AWS Certificate Manager, and to any certificate with a validity period of 100 days or less, since a lifetime that short means something is automating it. The picker describes the behaviour as “Alert only if renewal appears stuck (≤20 days)”: Tidehawk expects it to renew itself and speaks up only when it has not.

Manual is everything else, including every wildcard certificate. A wildcard is always put on the manual track even when its issuer automates renewal, because a wildcard needs a DNS-based challenge and has more ways to fail quietly. The picker describes it as “Alert per your rules — renewal needs human action”.

Excluded means the certificate is not your responsibility. The picker describes it as “Never alert — not your responsibility”.

Change a certificate’s track

Section titled “Change a certificate’s track”
  1. Open the certificate from the inventory or a client page.
  2. Select Change track.
  3. Choose Auto-renewing, Manual or Excluded. The current track is labelled.

The change is saved immediately and recorded in the client’s history.

Record a renewal yourself

Section titled “Record a renewal yourself”

Sometimes you renew a certificate and want Tidehawk to catch up now rather than at the next scheduled scan. What the button does depends on the track.

On an auto-renewing certificate, select Re-scan now. Tidehawk queues a fresh discovery run across that client’s domains. The old certificate stays visible until the new one is actually found, so nothing disappears on the strength of a promise.

On a manual certificate, select Mark renewed. Choose how long the new certificate is valid for, from 90, 180, 365 or 397 days, and confirm. Tidehawk marks the certificate resolved and records the new expiry date, and the client’s history notes that you recorded a renewal.

Section titled “Related”