About certificate object settings

Refreshes the contents of the current page.

Clears all errors and stages on the certificate and its associated application(s), then restarts processing from the beginning.

In Policy Tree, this option is available under Fix > Restart Processing from the Beginning.

This option is provided for circumstances in which the certificate or application was misconfigured. This option allows you to restart the certificate processing so the correct information can be used. For example, if you misspelled the certificate’s common name, you could correct the spelling error, then restart the renewal process so the change is reflected in the new certificate. You can use the Restart option at any point during the renewal process.

This option is relevant only to certificates managed under Enrollment or Provisioning.

For more information, see About clearing certificate workflow errors.

Clears errors and stages on the certificate and its associated applications, then stops processing.

In Policy Tree, this option is available under Fix > Reset Errors and Stop Operation.

This option is provided for circumstances in which there is an error at some stage of the certificate lifecycle and you decide to abort the current renewal process. For example, if a certificate completed the enrollment process, but failed when installing on one of the associated applications, you could manually install the certificate on the application, and then click Reset to clear the error. In this instance, no further processing would be necessary.

This option is relevant only to certificates managed under Enrollment or Provisioning.

For more information, see About clearing certificate workflow errors.

The Revoke option submits a revocation request to the certificate CA.

The Revoke and Disable option sends a revocation request to the certificate CA and disables the current Certificate object. If you disable the Certificate object, Trust Protection Platform stops all certificate processing—that is, it will not monitor, enroll, or provision the certificate.

For more information, see About revoking certificates manually.

If the certificate is currently under processing, Trust Protection Platform indicates the current stage of the certificate lifecycle. For example, if Trust Protection Platform is currently waiting to retrieve the certificate from the CA, it displays the following:

700 (Retrieving certificate from CA)

If the certificate is not currently under processing, the processing stage is “None.” If processing is disabled on the application, the processing stage is “n/a” (not applicable).

The processing stages listed are specific to each device. For more information, see About certificate lifecycle management.

The date the certificate expires.

Result of the most recent Network Validation.

This option is available only in Policy Tree.

Downloads the certificate and, optionally, the private key and root chain from the Trust Protection Platform database and allows you to save it to a Base64, DER, PKCS#7, or PKCS#12 formatted file. If you select PKCS#12 format, you can define a password that will be required to access the downloaded certificate and private key.

For more information, see Downloading certificates, private keys, and root chains.

This option is available only in Policy Tree.

Retrieves the certificate from a designated host or IP address and port.

Trust Protection Platform supports both IPv4 and IPv6 connections.

If the current certificate is managed at the Monitoring level, you can use this option to update the certificate in the Trust Protection Platform database after you have manually renewed the certificate on the target device.

You can set up a Notification to alert you when the certificate has been updated on the target application. For more information on this configuration, see Review validation results.

If the current certificate is managed at the Enrollment or Provisioning levels, you can use this option to retrieve the certificate from the CA.

You must have the view and write permissions to the certificate object to retrieve a certificate.

For more information, see Retrieving certificates.

Unique name for the certificate object.

This is a mandatory field.

User or group Identities assigned to this object.Default system notifications are sent to the contact identities.

Default contact = master administrator

To select the object contacts

1. Click the Browse button.

   The Identity Selector dialog opens.

2. If the Identity Selector dialog is not populated, enter a search query to retrieve the Identity list. The administration console does not automatically display external users and groups. You must first enter a search string so Trust Protection Platform can query the external Identity store and return the list of requested users or groups.If you want to display all user or group entries, enter the wildcard character (*).

3. Select a User or Group Identity, and then click Select.

   Press Shift+click to select multiple, contiguous users and groups. Press Ctrl+click to select multiple, discontiguous users and groups.

User or group Identities assigned to approve workflows (certificate approval or injection command) for the current certificate object. For more information on defining workflow objects, see Workflow management.

Default approver = master administrator

To select the Certificate object approvers

1. Click the Browse button.

   The Identity Selector dialog opens.

2. If the Identity Selector dialog is not populated, enter a search query to retrieve the Identity list. The administration console does not automatically display external users and groups. You must first enter a search string so Trust Protection Platform can query the external Identity store and return the list of requested users or groups.If you want to display all user or group entries, enter the wildcard character (*).

3. Select a User or Group Identity, and then click Select.

   Press Shift+click to select multiple, contiguous users and groups. Press Ctrl+click to select multiple, discontiguous users and groups.

   You can manage this setting at the policy level. To configure the setting via Policy, go to the Settings > Certificate tab in the Policy object configuration. The setting defined in the Policy object may be inherited by all subordinate Certificate objects. For more information, see Policy object certificate settings.

Level where subordinate certificates are to be managed.

Change a certificate's management type.

Trust Protection Platform provides the following levels of certificate management for Kubernetes Policy, Cluster, and Namespace objects:

• Monitoring: Trust Protection Platform monitors existing certificates and provides current information on the certificate status and lifecycle. When the certificate nears the end of its lifecycle, Trust Protection Platform notifies the administrator. It does not, however, renew the certificate. The administrator must manually create the CSR, send it to the certificate authority (CA), then retrieve and install the renewed certificate.
• Enrollment: Trust Protection Platform can automatically generate and submit CSRs to Certificate Authorities using the parameters defined in designated CA Template objects. If preferred, the administrator can manually generate the CSR, then upload it to Trust Protection Platform to complete the enrollment process with the appropriate CA. After the CA signs the certificate, Trust Protection Platform retrieves the certificate and securely stores it in the central database. The administrator must then download the certificate from Trust Protection Platform and install it on the target systems.
• Provisioning: Trust Protection Platform manages the entire certificate lifecycle—it automatically requests, installs, and monitors your system certificates.
• Unassigned: Unlicensed Trust Protection Platform certificates and keys that do not allow network validation, expiration monitoring, enrollment, provisioning, or onboard validation. However, they are included in selected reports and on the dashboard.

You can manage this setting at the policy level. To configure the setting via Policy, go to the Settings > Certificate tab in the Policy object configuration. The setting defined in the Policy object may be inherited by all subordinate Certificate objects. For more information, see Policy object certificate settings.

Determines where the CSR and the private key are generated.

If you do not select this option, the CSR and the private key are centrally generated on the Trust Protection Platform server, then securely copied to the application.

If you do select this option, the CSR and the private key are locally generated on the application’s server.

In the case of central generation, the certificate and private key are archived in the Trust Protection Platform database. However, for remote generation, only the certificate is stored in the database.

You can manage this setting at the policy level. To configure the setting via Policy, go to the Settings > Certificate tab in the Policy object configuration. The setting defined in the Policy object may be inherited by all subordinate Certificate objects. For more information, see Policy object certificate settings.

Allows the administrator to paste the CSR data or upload a CSR file to the Trust Protection Platform database. The CSR file must be Base64 encoded.

If Service Generated CSR is selected, then the uploaded CSR values are added only to the unlocked SubjectDN fields that are editable. No check is made to ensure that the values adhere to the policy.

If User Provided CSR is selected, then the uploaded CSR values must adhere to the policy before they are applied to the Certificate object. If they do adhere to the policy, they are added to the certificate and stored in the Trust Protection Platform database when the Certificate object is saved.

For more information, see Manually uploading the CSR.

If the CSR is user provided, you may also want to upload the private key so it is archived in the Trust Protection Platform database. Trust Protection Platform must have a copy of the certificate’s private key to provision certificates and key pairs. For more information, see Manually Uploading the Private Key.

Typically, the fully qualified domain name.

Name that uniquely identifies the organization in the certificate.

You can manage this setting at the policy level. To configure the setting via Policy, go to the Settings > Certificate tab in the Policy object configuration. The setting defined in the Policy object may be inherited by all subordinate Certificate objects. For more information, see Policy object certificate settings.

Location (city, state/province, and country) of your Organization or Organizational Unit.

You can manage this setting at the policy level. To configure the setting via Policy, go to the Settings > Certificate tab in the Policy object configuration. The setting defined in the Policy object may be inherited by all subordinate Certificate objects. For more information, see Policy object certificate settings.

Enter the suffix of allowed domains.

Examples:

• .com
• acme.com
• sales.acme.com

If you leave this field blank, ALL domains will be allowed.

The default is Yes. Select No to require unique names.

Indicates whether Trust Protection Platform currently has a copy of the certificate’s private key—Yes or No.

Trust Protection Platform must have a copy of the private key to provision certificates and key pairs.

If Trust Protection Platform does not have a copy of the certificate’s private key, then you can do one of the following:

Manually import the certificate and private key. For more information, see Manually Uploading the Private Key.

If Automate Renewal is selected, you can wait until Trust Protection Platformrenews the certificate or click Renew Now to generate a new key pair.

Reuses the original private key when renewing the certificate.

You can manage this setting at the policy level. To configure the setting via Policy, go to the Settings > Certificate tab in the Policy object configuration. The setting defined in the Policy object may be inherited by all subordinate Certificate objects. For more information, see Policy object certificate settings.

Allows the administrator to paste the private key data or upload a private key file to the Trust Protection Platform database.

The private key must be base64 encoded and you must specify the password required to access the private key. You must have the Ppivate key write, view, and write permissions to the Certificate object to upload a private key.

If the CSR is user provided, you may also want to upload the private key so it is archived in the Trust Protection Platform database. Trust Protection Platform must have a copy of the certificate’s private key to provision certificates and key pairs.

For more information, see Manually Uploading the Private Key.

CA template object that Venafi TLS Protect references to generate the CSR and submit it to the CA.

To select the CA template object

1. Click the Browse button.

   The Configuration Object Selector dialog opens.

2. Select a CA template object, and then click Select.

Disables automatic enrollment and provisioning for the current certificate. This means that Venafi TLS Protect will not attempt to renew or install the current certificate on its own. However, Venafi TLS Protect still provides monitoring, validation, and notification for the certificate object.

Trust Protection Platform automatically selects this option when it renews a certificate in response to a SCEP request. For more information, see Certificate enrollment via SCEP protocol.

Period of time (in months) that the certificate is valid.

The options available in this menu are determined by the Available Validity Periods configured on the CA template object.

When you associate the Entrust Certificate Services template object configuration with the certificate object, you can define additional settings that are specific to the certificate. These settings are passed to the Entrust Certificate Services when Trust Protection Platform renews the certificate.

In Policy Tree, you must click the Entrust Certificate Services tab to access the Entrust Certificate Services settings.

For more information, see Entrust Certificate Services—certificate settings.

Period of time (in months) that the certificate is valid.

The options available in this menu are determined by the Available Validity Periods configured in the Entrust Certificate Services template object configuration.

Person the Entrust Certificate Services identifies as the certificate owner.

Certificate owner’s last name.

Certificate owner’s telephone number.

Period of time (in months) that the certificate is valid.

The options available in this menu are determined by the Available Validity Periods configured in the RSA CA template object configuration.

This option is available only if you select Override Default Key Update Policy.

Period of time (in months) that the certificate is valid.

The options available in this menu are determined by the Available Validity Periods configured in the Thawte CA template object configuration.

This option is available only if you select Override Default Key Update Policy.

Application where the certificate is installed.

Password Credential required to retrieve or revoke a Symantec certificate. The Challenge Credential is given to Symantec when the certificate’s CSR is submitted for enrollment. Symantec subsequently requires the Challenge Credential to retrieve or revoke the certificate.

To select the Challenge Credential

1. Click the Browse button.

   The Credential Selector dialog appears.

2. Select the Certificate Credential you created with the Symantec Administrator Certificate, and then click Select.

For more information, see Working with system credentials.

You can manage this setting at the policy level. To configure the setting via Policy, go to the Settings > Certificate Authorities tab in the Policy object configuration. The setting defined in the Policy object may be inherited by all subordinate Certificate objects. For more information, see Policy object certificate settings.

Number of licenses (i.e., concurrent installations) to be issued with the certificate.

Any information you want to store with the certificate.

Symantec Certificate Owner’s first name.

Symantec Certificate Owner’s email address.

Your certificate may include additional certificate fields. These are custom fields defined by your organization in the Symantec MPKI Control Center. Venafi TLS Protect includes these values in the certificate signing request it submits to the Symantec CA.

If the custom fields are required, you must define the fields in the Certificate object. If you do not complete required custom fields, the Symantec CA will not accept the CSR. If the fields are optional, you can optionally define the fields in the Certificate object.

The Compliance tab provides an assessment of the certificate’s compliance with its parent folder.

For more information, see Determining certificate compliance.

The Renewal Value column lists the certificate values currently defined in the Certificate object. Renewal values also reflect policy status.

Submits a revocation request to the certificate CA for previous versions of the certificate that have not yet expired. For example, if you renew a certificate several months before it expires, you could provision the certificate on all of its associated servers. Then, after ensuring everything is functioning properly, you could revoke all previous, valid versions of the certificate from the Certificate > History tab.

For more information, see About revoking certificates manually.

Frequency (in days) at which you want Trust Protection Platform to generate expiration events.

Number of days before a certificate expires that you want to start generating escalated expiration events.

Trust Protection Platform provides Network Validation for Certificate objects. During the Network Validation process, Trust Protection Platform sends an SSL request to the certificate’s server. If the server responds to the SSL request, Trust Protection Platform retrieves the certificate’s serial number and compares it to the certificate that Trust Protection Platform has archived for the corresponding Certificate object.

The purpose of Network Validation is to confirm that the certificate is functional and to verify that the correct certificate is being used. If the server responds to the SSL request, Trust Protection Platform knows the certificate is functional. When it retrieves the certificate serial number, Trust Protection Platform can determine if the correct certificate is being used.

When you enable Network Validation on the Certificate object, the Validation Manager module runs daily validation checks and reports the results on the object Summary and Validation tab.

For more information, see About certificate and application validation.

Disables all validation for the current Certificate object, including all validation-based notifications.

Disables Network Validation for the current Application object, including all related notifications.

You can also disable Network Validation at the policy level. To disable Network Validation via Policy, go to the Settings > Certificate tab in the Policy object configuration. Disabling Network Validation in the Policy object disables Network Validation for all subordinate Network Certificate objects. For more information, see Policy object certificate settings.

IP address or hostname you want to validate.

Venafi TLS Protect supports both IPv4 and IPv6 connections.

This option is read only if you select Specify Address.

The following fields display the results of the last validation. These fields are informational only and cannot be edited. For more information on validation status messages, see Review validation results.

Result of the most recent Network Validation.

Provides a view of all events triggered for the current object.

An administrator must have a minimum of the Read permission to view this tab.

For more information on the Log tab options, see Viewing log events.