Certificates - Manage Certificates for Native Connectors and Secure Access
Certificates - Manage Certificates for Native Connectors and Secure Access
Overview
The Certificates tab, found under Connectors, gives administrators a self-service way to upload, review, and manage the certificates used by Native Connectors and Secure Access (previously known as ESA). Certificates can still be placed on disk manually, but the Certificates tab now shows every certificate in one table, regardless of how it was added, along with where it is used, its validity, and its trust chain.
Prerequisites
- Administrator access to the Connectors module.
- The certificate file, in base64 encoded pem formatted file, with file extension one of these:
.pem,.crt, or.cert(maximum file size 10 MB). - Knowledge of which target the certificate is for: Native Connectors (Event Tasks), Native Connectors (Scheduled Tasks), or Secure Access (Authentication Tasks).
Although intermediate and leaf certificates are supported, using the root certificate is highly recommended.
How it Works
Open the Certificates tab
Go to Connectors in the top navigation, then select the Certificates tab. Within it, there are two sub-tabs: Certificates (the certificate list described below) and Notification Configuration.
View and Filter Certificates
The certificate table lists every certificate currently known to Connectors, with the following columns:
| Column | Description |
|---|---|
| Certificate Name | The name given to the certificate on upload, or its file name if imported from disk. |
| Description | A free-text description, or an automatic note such as "Imported from worker disk" for certificates found on disk rather than uploaded. |
| Target | Where the certificate is used: Native Connectors (Event Tasks), Native Connectors (Scheduled Tasks), or Secure Access (Authentication Tasks). |
| Data Source | The connector type the certificate applies to, for example LDAP. |
| Status | Active or Expired. |
| Valid Until | The certificate's expiration date. |
| Manage | View, edit, download, or remove the certificate. |
Use the filter field above the table (requires at least 2 characters) to narrow the list. The toolbar also offers:
- Refresh — reload the table.
- Force Secure Access Reload — manually trigger Secure Access to pick up certificate changes immediately, instead of waiting for the automatic sync. This can be used at most once every 10 minutes.
Upload a New Certificate
- Click Upload Certificate.
- Drag the certificate file into the upload area, or click Browse to select it. Certificate must be base64 encoded pem formatted file, with file extension one of these:
.pem,.crt, or.cert(maximum file size 10 MB). - Enter a Name for the certificate (required), can be e.g. same as filename.
- Optionally enter a Description.
- Select the Target (required) — the connector or authentication task type this certificate applies to.
- Click Upload.
View Certificate Details
Click the view icon in the Manage column to open the certificate's details, which include:
- Placement — Target and Data Source.
- Status — Active or Expired.
- Validity — Valid From and Valid Until dates.
- File — file name and file size.
- Chain of Trust — Issuer, Subject, and SHA-256 fingerprint.
- Audit — who or what created the certificate entry, and when.
Manage Existing Certificates
Each row in the table has four actions in the Manage column:
- View — open the certificate details described above.
- Edit — update the certificate's description.
- Download — download the certificate file to your own computer. This is useful if you need to move certificate from one environment to an other.
- Remove — delete the certificate.
When Do Certificate Changes Take Effect?
Certificates placed on disk manually follow the same timing as certificates uploaded through this tab, they are only imported and shown in the table once applied.
- Native Connectors (Event Tasks): applied immediately.
- Native Connectors (Scheduled Tasks): applied on the next task run.
- Secure Access (Authentication Tasks): synced automatically every day at 3 AM (provided settings allow Secure Access to reload), or sooner by using Force Secure Access Reload (limited to once every 10 minutes).
Related Articles
Table of Contents