Agent groups

An agent group is a named set of agents. Each agent belongs to at most one group. A certificate can target either a single agent or a whole group - targeting a group creates one issuance job per current member, and every future renewal does the same against whichever agents are in the group at that time.

Creating a group

Go to Manage > Agent Groups and create one, then assign agents to it from Manage > Agents - each agent's edit dialog has a group selector.

What happens when membership changes

• Adding an agent to a group doesn't retroactively issue it certificates from that group's existing jobs - it picks up the group's certificates starting from the next renewal or the next manual "Renew now".
• Removing an agent from a group stops it from receiving future renewals for that group's certificates, but doesn't revoke certificates already deployed to it.
• Deleting a group is blocked while any certificate still targets it - reassign or delete those certificates first.

When to use a group vs. a single agent

Use a single agent for a standalone server. Use a group for anything that's horizontally scaled - identical web servers behind a load balancer, a cluster of the same application - where every member should present the same certificate.