Certificates, upgrades and maintenance

Use the packaged controller with the exact signed release and protected configuration. Plan a maintenance window, stop new admission where the procedure requires it, and reconcile running or uncertain work. Task and receipt investigation

Certificate renewal

As root, prepare a protected staging directory, for example mode 0700, with regular root-owned files in mode 0400. Name them tls.crt, tls.key, keycloak_internal_tls_certificate, keycloak_internal_tls_private_key and keycloak_internal_ca_certificate. The public certificate must cover the application and identity hosts. The internal certificate must identify identity and verify under the staged internal CA. Quiesce external sandboxes before renewal.

epmctl renew-certificates --staging-dir /absolute/protected/path

The controller checks key matches, trust and minimum remaining validity before downtime. It preserves the current set, promotes the staged files and verifies platform health and the served public fingerprint. On promotion or health failure it attempts to restore the prior certificate set and restart the release. On success, expect certificate_renewal=complete, release_health=verified and rollback_material=removed. Verify the served fingerprints and repeat browser login and MCP authentication.

Upgrade

1. Obtain the signed candidate, detached manifest signature and independent trust roots. Use the approved candidate controller with the exact existing project and release configuration. Run epmctl doctor and qualify the change in isolation before the maintenance window.
2. On the running source project, drain accepted, waiting, running or interrupt-requested work and classify tasks that need inspection. Start the controlled upgrade with epmctl upgrade. Use --forecast-boundary-map FILE only when the approved migration requires its reviewed absolute-path map.
3. The controller runs compatibility preflight and requires a verified independent backup before it stops the mutable services and runs migrations. Check upgrade=complete, pre_upgrade_backup=verified and volumes=preserved. Verify liveness, readiness, unsigned denial, browser sign-in and an authorized scoped read.

If the upgrade fails, record the exact phase and preserve the verified bundle. Reconcile the database and service state before reopening admission or choosing the isolated restore procedure.