Documentation Suite v25.4

Submit Search

Application Settings

Tip: Where to find this in the Management Portal:

System Settings → Application Settings

Many of the settings that control the behavior of Keyfactor Command features are configurable from the Applications Settings on the System setting menu.The tables below provide a brief description of these settings.

Each tab of the Applications Settings page is organized into sections—a General section and additional sections based on the functionality controlled by each tab. Click the plus (/) next to a section to toggle expand/collapse that section.

Depending on your Keyfactor Command license, not all application settings may be applicable in your environment.

Note: Application settings can only be updated one tab at a time. Save or Undo the settings on one tab before moving to another tab.

Application Settings: Console Tab

Figure 406: Console Application Settings: General

Figure 407: Console Application Settings: Certificate Cleanup and Monitoring

Figure 408: Console Application Settings: UI Customizations

Table 30: Console Application Settings

Tab	Section	Field	Description
Console	Certificate Cleanup	Include Certificates with Archived Key in Cleanup	Determines whether certificates with a private key stored in the system are eligible for removal. The default is Off. Important: If a certificate with a stored private key is deleted and later restored, the stored private key will not be restored.
Console	Certificate Cleanup	Enable Certificate Cleanup	If toggled to On, enabled the periodic cleanup job to remove expired certificates from the Keyfactor Command database. The default is Off. Certificates that are saved in the Keyfactor Command database will not be removed during cleanup if they are part of a certificate store or have been imported as the result of an SSL scan. Certificate cleanup settings can be configured at three levels: Certificate Template Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this template. These cleanup tasks are processed first. Certificate Authority (CA) Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this CA but not associated with any template. These cleanup tasks are processed second. System-Wide: Configured in the application settings, applies to all certificate authorities and templates in the system. These values are used when processing certificate cleanup tasks for certificates associated with neither a CA nor a template and when no overrides are set at the CA or template level. These cleanup tasks are processed last.
Console	Certificate Cleanup	Time After Expiration	The amount of time after expiration to wait until the certificate is eligible for removal. The default is 24.
Console	Certificate Cleanup	Time After Expiration Units	The time unit to apply to the expiration time. Options are days, weeks, or months. The default is months.
Console	General	Bulk Edit Batch Size	The number of certificates at a time that are saved to the database when using the Edit All feature to edit certificate metadata. This setting can be adjusted if there are responsiveness issues when editing large numbers of certificates at once. The default value is 3000.
Console	General	Bulk Edit Details Batch Size	The number of certificates at a time that are read from the database when using the Edit All feature to edit certificate metadata. This setting can be adjusted if there are responsiveness issues when editing large numbers of certificates at once. The default value is 5000.
Console	General	CA Sync Backward Offset Minutes	The number of minutes to offset when determining whether a certificate requested outside of Keyfactor Command should be included in an incremental synchronization. Adjusting this value can be helpful in situations of extreme clock skew or when the EJBCA Validity Offset setting is enabled. Note: For EJBCA CAs, if the certificate profile has a Validity Offset configured to a value greater than the value configured in the CA Sync Backward Offset Minutes application setting (15 minutes by default), certificates requested outside of Keyfactor Command will not be picked up on incremental scans. These certificates will only appear in Keyfactor Command on a full synchronization. The CA Sync Backward Offset Minutes application setting should be set to the same number of minutes as the Validity Offset value, if Validity Offset is configured. Figure 409: EJBCA Certificate Profile Validity Offset Greater than 15 Minutes
Console	General	CA Sync Consecutive Error Limit	The number of errors a CA synchronization can encounter before the synchronization job stops (without running to completion).
Console	General	Custom Help Link	The URL to a page to which users may be directed when they click on the custom help link from the help dropdown in the Keyfactor Command Management Portal. Keyfactor strongly urges caution when using this feature and confirming that the link to which users are redirected is thoroughly secured. For security, the user will receive a warning they will need to acknowledge to proceed. For visibility, the warning will display the domain the link is directed to. Figure 410: Custom Help Link
Console	General	Custom Help Link Title	The title text of the custom help link that appears on the help dropdown in the Keyfactor Command Management Portal.
Console	General	DCOM Sync Page Size	The number of records at a time that are read from a DCOM CA during a CA synchronization job. The default value is 10,000.
Console	General	Default Identity Provider	The identity provider to which the user’s logon request will be directed by default if an identity provider is not specified in the URL. This value is only relevant in environments using OAuth as an identity provider with more than one identity provider. In such environments, you can specify the identity provider to use for authentication in the URL using an identity provider hint (where IDP_NAME is the authentication scheme of the selected identity provider): https://KEYFACTOR_SERVER_FQDN/KeyfactorPortal/Login/Signin?idpHint=IDP_NAME Note: The identity provider(s) that appear in this dropdown are determined by the permissions of the user accessing the Management Portal and the permission set on the identity provider(s). The user must be assigned a security role that has been granted the Identity Providers > Read permission and that security role must have the same permission set applied to it as has been applied to the identity provider. For more information about permission sets, see Permission Sets.
Console	General	Display CA Hostname	If toggled to On, causes both the CA’s FQDN and logical name (e.g., ca2.keyexample.com\Corp Issuing CA Two) to display in the CA fields on the Certificate Authority and Certificate Requests pages of the Management Portal. If toggled to Off, only the CA’s logical name (e.g., Corp Issuing CA Two) displays on these pages. The default is Off.
Console	General	Extension Handler Path	The path to the location on the Keyfactor Command server where the event handler .dll files are stored. By default this is: C:\Program Files\Keyfactor\Keyfactor Platform\ExtensionLibrary\
Console	General	HTTPS Sync Page Size	The number of records at a time that are read from an HTTPS CA during a CA synchronization job. The default value is 500. Note: This value needs to be set less than or equal to the Maximum Query Count in you EJBCA instance. Find this in the EJBCA configuration under System Configuration → System Configuration → Basic Configurations in the Database Configuration section. If you have more than one EJBCA instance communicating with Keyfactor Command, this value needs to be less than or equal to the lowest Maximum Query Count of those EJBCA instances. Note: This setting was known as CA Sync Page Size in previous versions of Keyfactor Command.
Console	General	Immediately Sync Revoked Certificates	If toggled to On, causes certificates to immediately sync to Keyfactor Command upon revocation rather than waiting for the next scheduled synchronization cycle. The default is On.
Console	General	Lock Heartbeat Interval (seconds)	How often to update the lock to keep it alive while running a long running timer service job. Default is 60 seconds.
Console	General	Lock Hold Timeout (seconds)	How long to wait after the last successful heartbeat interval before the lock is considered to be lost and can be acquired by another machine. Default is 900 seconds.
Console	General	Lock Timeout (seconds)	The amount of time to attempt to acquire a lock ensuring that only one timer service job runs at a time across multiple servers. Default is 5 seconds.
Console	General	On-Prem Documentation	Used to determine which documentation set to use when accessing the documentation from the Keyfactor Command Management Portal help links (in the Navigator or from the help icon on individual screens): the On-Premises Documentation or the Managed Services Documentation Suite. When toggled to On, any help links will access On-Premises Documentation website. When toggled to Off, any help links will access the Managed Services Documentation Suite website. The setting defaults to the On for On-Premises Documentation. If you change this setting you will need to clear your cache to see the change.
Console	General	Revoke All Enabled	If toggled to On, causes the Revoke All button to appear at the top of certificate search and collection grids to allow users with appropriate permissions to revoke all certificates shown in the grid or included in the certificate collection. If toggled to Off, hides the Revoke All button and disables the POST /Certificates/RevokeAll API endpoint. The default is Off for new installations of Keyfactor Command beginning with release 10.4.
Console	General	Security Roles Cache Cleanup Interval	The number of minutes between executions of the security role cache cleanup job. The security role cache cleanup job updates the Keyfactor Command server cache of security roles and membership. A cache of security role information is stored on the server to limit requests to the database. The default is 1 minute.
Console	General	Timer Service Configuration Internal (minutes)	The number of minutes between executions of the Keyfactor Command Service job to check for new or updated service job task schedules.
Console	Monitoring	Expiration Alert Test Result Limit	The maximum number of expiration alert emails that will be sent when an expiration alert test is run from within the Management Portal. If the number set here is exceeded during a test, emails will not be sent, but a portion of the alerts will be visible on the expiration alerts test page (see Testing Expiration Alerts). The default value is 100.
Console	Monitoring	Key Rotation Alert Test Result Limit	The maximum number of key rotation alert emails that will be sent when a key rotation alert test is run from within the Management Portal. If the number set here is exceeded during a test, emails will not be sent, but a portion of the alerts will be visible on the key rotation alerts test page (see Testing Key Rotation Alerts). The default value is 100.
Console	Monitoring	Pending Alert Test Result Limit	The maximum number of pending alert emails that will be sent when a pending alert test is run from within the Management Portal. If the number set here is exceeded during a test, emails will not be sent, but a portion of the alerts will be visible on the pending alerts test page (see Testing Pending Request Alerts). The default value is 100.
Console	Monitoring	Pending Alerts Max Reminders	The maximum number of pending alert emails that will be sent for a given pending certificate. Every time a pending alert task is run, an email will be sent for a given pending certificate until the limit is reached. It is recommended that the number is kept at 5 or less. The default value is 1.
Console	UI Customization	Banner Color	The background color for the banner. There are 3 options to choose from: Notice (Blue). A blue background with white text. This is the default value. Error (Red). A red background with white text. Warning (Orange). An orange background with black text.
Console	UI Customization	Banner Message	The message of the banner.
Console	UI Customization	Banner Title	The title of the banner (75 character maximum).
Console	UI Customization	Banner Visible	Toggle the banner off/on. If on, the banner will appear on every page in Keyfactor Command. If off, the banner will not be visible on any page. Note: Users will need to clear the cache to see the banner changes.

Application Settings: Auditing Tab

Figure 411: Audit Log Application Settings

Table 31: Audit Log Application Settings

Tab	Section	Field	Description
Auditing	General	Audit Entry Retention Period	The number of weeks to retain the audit log entry details. The default value is 52 (for new databases only). Configuration wizard files from existing databases will not be populate this field upon upgrade to prevent changing the retention period to an potentially unwanted setting. Note: The audit log cleanup job runs once daily and removes any audit log entries older than the time specified in the retention parameter except those in the following protected categories: Security CertificateCollections ApplicationSettings SecurityClaims SecurityRoles IdentityProviders Audit logs belonging to protected categories are retained indefinitely and cannot be deleted. To retain all audit log entries indefinitely, disable the job.
Auditing	General	Purge Audit Log Batch Size	Records are deleted in batches. The number of records in a batch can be configured with this setting. The default value is 10k records.
Auditing	Log Server	Host Name	The host name of the centralized logging server to receive the Keyfactor Command audit log entries.
Auditing	Log Server	Port	The port to connect to the centralized logging server. The default port (configurable during install) is 514.
Auditing	Log Server	Use SysLog Server	If toggled to On, enables sending audit log details to a centralized logging server.
Auditing	Log Server	Use TLS Connection	If toggled to On, enables sending audit log details to a centralized logging server over a TLS connection.

Application Settings: CA Connectors Tab

Figure 412: CA Connectors Application Settings

Table 32: CA Connectors Application Settings

Tab	Section	Field	Description
CA Connectors	General	AuthZ Cache Expiration (minutes)	The lifetime, in minutes, of the authorization cache entries for the CA connector. The authorization cache is used to reduce database queries when authorization decisions are made during CA connector communications with Keyfactor Command. The default value is 5.
CA Connectors	General	Heartbeat Interval (minutes)	The frequency, in minutes, with which a CA connector should query the Keyfactor Command server for a status on the accuracy of its jobs list. The default value is 5.

Application Settings: Task Queue Tab

Figure 413: Task Queue Application Settings

Table 33: Task Queue Application Settings

Tab	Section	Field	Description
Task Queue	General	Job Data Retry Delay Seconds	The number of seconds the CA connector should wait before trying to resubmit job data. This may need to be adjusted for streaming jobs where the queue fills up because the publisher is too far ahead of the consumer. The default is 20.
Task Queue	General	Job Data Timeout Seconds	The number of seconds to wait for a job data response message before timeout. The job will not be retried. The default is 300.
Task Queue	General	Job Pickup Timeout Seconds	The number of seconds to wait before a job start message times out and the next CA connector (if any) is tried. The default is 30.
Task Queue	General	Queue Max Length	The maximum queue length for streaming tasks. The default is 30.

Application Settings: Enrollment Tab

Note: Regular expressions for enrollment

Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). that were previously configured under application settings are now configured on the enrollment patterns page (see Regular Expressions).

Figure 414: Enrollment Application Settings

Table 34: Enrollment Application Settings

Tab	Section	Field	Description
Enrollment	CSR	Allow CSR SAN Entry	If toggled to On, enables the section of the CSR Enrollment page that allows for entry of custom subject alternative names (SANs). The default is Off. Note: SANs that are submitted outside the CSR may be ignored, appended to, or overwrite the SANs in the CSR depending on the issuing CA’s configuration. Always verify the issued certificate’s SANs after enrollment. Any SANs added automatically for RFC 2818 compliance (see System-Wide: Policies Tab) will still be included alongside manually supplied values. Microsoft CA: See the SAN Attribute Policy Handler for the Keyfactor CA Policy Module if you need to support SANs outside the CSR. EJBCA: Behavior depends on Certificate Profile and End Entity Profile settings. By default, EJBCA uses the End Entity/RA-supplied SANs; to accept SANs from the CSR instead, enable Allow Extension Override for OID 2.5.29.17 (SubjectAltName) in the Certificate Profile. For more information, see Certificate Profile Fields in the EJBCA documentation.
Enrollment	CSR	Enable warning for CSR generated in Command	If toggled to On, enables the warning message that appears when a user attempts to enroll on the CSR Enrollment page using a CSR generated by Keyfactor Command using the CSR Generation page or equivalent API functionality. The default is On. If the Enable warning for CSR renewal with a Subject/SAN mismatch is also enabled, the CSR enrollment page will generate a warning on submission if the SANs/Subject are different from the SANs/Subject of the certificate that is being enrolled. This will appear in the same dialog popup as the warning that a CSR is generated from Keyfactor Command. Click OK on this popup to ignore the warning. Figure 415: CSR Warning Message Note: If both application setting and the next are enabled, and both situations are triggered by the current enrollment, both messages will appear in the same message pop-up box. Figure 416: CSR Warning Message shown with CSR SAN error message also.
Enrollment	CSR	Enable warning for CSR renewal with a Subject/SAN mismatch	Similar to the CSR generated in Command application setting, when this setting is toggled On, the CSR enrollment page will pop-up a warning on submission if the SANs/Subject are different from the SANs/Subject of the certificate that is being renewed. Click OK on this popup to ignore the warning. The default is On. Note: See note above regarding how both settings respond together. Figure 417: CSR SAN Warning Message
Enrollment	General	Allow Cryptographic Service Providers (CSPs)	If toggled to On, allows selection of a cryptographic service provider (CSP) on the PFX Enrollment page and on the Certificate Search download dialog for certificates with a stored private key when a format of PFX is selected. See also Cryptographic Service Providers (CSPs). The default is Off. The Target CSP field on the PFX Enrollment page and Certificate Search download dialog is required if Allow Cryptographic Service Providers (CSPs) is toggled to On.
Enrollment	General	Allow Periods in Certificate Filenames	If toggled to On, the file name generated for a certificate downloaded in PFX Enrollment, CSR Enrollment, or from the Certificate Search download dialog will include periods from the CN in the string. For example: server123.keyexample.com.pfx If toggled to Off, periods are removed from the CN when the filename is built. For example: server123keyexamplecom.pfx The default is On.
Enrollment	General	CA Template Cache Expiration (minutes)	The lifetime in minutes for the cache of certificate templates retrieved from the CA and stored locally in SQL to reduce requests to the CA during enrollment. The cache is automatically updated every 5 minutes as long as the update task is enabled. Note: CAs and certificate templates that become unavailable in the environment will not appear as unavailable for enrollment in Keyfactor Command until this cache expires. Likewise, enrollment patterns for new certificate templates will not be available for enrollment until added to this cache.
Enrollment	General	Cryptographic Service Providers (CSPs)	A comma-seperated list of cryptographic service providers (CSPs) from which to select on the PFX Enrollment page and on the Certificate Search download dialog for certificates with a stored private key when a format of PFX is selected if Allow Cryptographic Service Providers (CSPs) is toggled to On. The selected CSP is associated with the certificate in the Public Key Cryptography Standard #12 (PKCS #12) key provider name attribute (OID 1.3.6.1.4.1.311.17.1). Note: This option is dependent on the Allow Cryptographic Service Providers (CSPs) option and is grayed out unless Allow Cryptographic Service Providers (CSPs) is enabled. Figure 418: Target CSP Option in Certificate Download Note: Due to the large number of possible CSPs, the values entered in this field are not validated against known CSPs. Be sure to confirm that the data is entered correctly.
Enrollment	General	Display CA Hostname	If toggled to On, causes both the CA’s FQDN and logical name (e.g., ca2.keyexample.com\Corp Issuing CA Two) to display in the CA dropdowns in the Keyfactor Command Management Portal interfaces. If toggled to Off, only the CA’s logical name (e.g., Corp Issuing CA Two) displays in these dropdowns. The default is On.
Enrollment	General	Include Chain By Default	If toggled to On, enables the Include Chain toggle in PFX and CSR Enrollment and on the Certificate Search download dialog for select certificate formats by default.
Enrollment	General	Subject Format	The format of the subject field that will be created for the certificates requested through the Keyfactor Command Management Portal if the enrollment pattern used for enrollment is set to supply in request. For example: CN={CN},E={E},O=Key Example\, Inc.,OU={OU},L=Chicago,ST=IL,C=US The data in the subject format takes precedence over any data entered during PFX enrollment or supplied by enrollment defaults (see Enrollment Patterns - Enrollment Pattern: Enrollment Defaults Tab). For example, with the above subject format, the organization for certificates generated through PFX enrollment will always be Key Example, Inc. regardless of what is shown on the PFX enrollment page during enrollment. This setting applies to CSRs generated using the CSR generation method in the Keyfactor Command Management Portal and CSR and PFX enrollments done in the Keyfactor Command Management Portal. Data from the default subject does not display on the CSR or PFX enrollment page. To define defaults that will display in the PFX enrollment form (and can be modified by users), use enrollment defaults (see Enrollment Patterns - Enrollment Pattern: Enrollment Defaults Tab). Note: Backslashes are required before any commas embedded within values in the subject field (e.g., O=Key Example\, Inc.). Quotation marks should not be used in the strings in the fields except in the case where these are part of the desired subject value, as they are processed as literal values. Tip: The default subject format does not apply to enrollments done using the Keyfactor API.
Enrollment	General	URL to Subscriber Terms	The URL for a web page providing terms and conditions to which a user must agree before being allowed to enroll for a certificate if the CA setting of Require Subscriber Terms is enabled. For security, the user will receive a warning they will need to acknowledge to proceed. For visibility, the warning will display the domain the link is directed to. This setting applies only to the PFX Enrollment page.
Enrollment	PFX	Allow Custom Friendly Name	If toggled to On, enables the option on the PFX Enrollment page and on the Certificate Search download dialog for certificates with a stored private key when a format of PFX is selected that allows for entry of a custom friendly name for the certificate. The default is Off. See also Require Custom Friendly Name.
Enrollment	PFX	Allow Custom Password	If toggled to On, includes the Custom Password toggle and Password fields on the PFX Enrollment page and on the Certificate Search download dialog for certificates with a stored private key when a format of PFX is selected that allow for entry of a custom password for the certificate file. The default is Off.
Enrollment	PFX	Enable Legacy Encryption	If toggled to On, includes the Use Legacy Encryption toggle on the PFX Enrollment page and the Certificate Search download dialog for certificates with a stored private key when a file extension that includes the private key is selected. The user has the choice to enable it or not. See also Use Legacy Encryption By Default. If toggled to Off, the Use Legacy Encryption option does not appear. The default is Off. If the user enables the Use Legacy Encryption toggle, the historical algorithm set (3DES/SHA1/RC2) is used for the downloaded certificate. If the user disables the Use Legacy Encryption toggle, the newer algorithm set provided by Windows (AES256/SHA256/AES256) is used instead. Important: This must be toggled to On and the Use Legacy Encryption toggle enabled if you plan to install the resulting PFX file on a server running Windows Server 2016.
Enrollment	PFX	Include Private Key By Default	If toggled to On, enables the Include Private Key toggle on the Certificate Search download dialog by default.
Enrollment	PFX	Only use Alpha Numeric Chars	If toggled to On, the one-time passwords generated to encrypt the certificate files downloaded on the PFX Enrollment page (if the user’s Active Directory password is not used) and the Certificate Search download dialog for certificates with a stored private key when a format of PFX is selected will contain just numbers and letters. If toggled to Off, the passwords will contain numbers, letters and special characters. This setting is ignored in PFX Enrollment if Use Active Directory Password is toggled to On. The default is On.
Enrollment	PFX	Password Length	The number of characters in the one-time auto-generated password—or the required number of characters in the custom password—to encrypt the certificate files downloaded on the PFX Enrollment page and the Certificate Search download dialog for certificates with a stored private key when a format of PFX is selected. The default value is 12. This value will be displayed on the PFX Enrollment page and Certificate Search download dialog password section if Allow Custom Password is toggled to On. Important: Keyfactor highly recommends that you use strong passwords for any accounts or certificates related to Keyfactor Command and associated products, especially when these have elevated or administrative access. A strong password has at least 12 characters (more is better) and multiple character classes (lowercase letters, uppercase letters, numeral, and symbols). Ideally, each password would be randomly generated. Avoid password re-use.
Enrollment	PFX	Require Custom Friendly Name	If toggled to On, requires the user to enter a custom friendly name for the certificate on the PFX Enrollment page and on the Certificate Search download dialog for certificates with a stored private key when a format of PFX is selected. The default is Off. Note: This option is dependent on the Allow Custom Friendly Name option and is grayed out unless Allow Custom Friendly Name is enabled.
Enrollment	PFX	Use Active Directory Password	If toggled to On, uses the user’s Active Directory password to encrypt the certificate files downloaded on the PFX Enrollment page. If toggled to Off, generates a one-time password to encrypt the PFX file. The default is Off. This option does not apply to certificates downloaded through Certificate Search. Important: If you change this setting in the application settings you must also change the authentication method configured on the IIS virtual application KeyfactorPortal through the IIS Manager. If you toggled this option to On, you should configure only Basic Authentication in IIS. If you toggled this option to Off, you may configure either only Windows Authentication or both Basic Authentication and Windows Authentication (the default) in IIS. This is because when you authenticate to the Management Portal using integrated Windows authentication (Kerberos), Keyfactor Command does not have access to your credentials to apply your password to the PFX file.
Enrollment	PFX	Use Legacy Encryption By Default	If toggled to On, enables the Use Legacy Encryption toggle on the PFX Enrollment and Certificate Search download dialog by default. If toggled to Off, disables the Use Legacy Encryption toggle by default. The default is Off. Note: This option is dependent on the Enable Legacy Encryption option and is grayed out unless Enable Legacy Encryption is enabled.

Application Settings: Agents Tab

Configuration for orchestrator Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. client certificate authentication has moved to the appsettings.json file for the web agent services application. As a result, the Always Use Certificate from Header application setting is no longer available in application settings.

Figure 419: Agents Application Settings: General

Figure 420: Agents Application Settings

Table 35: Agents Application Settings

Tab	Section	Field	Description
Agents	F5	Ignore Server SSL Warnings	If toggled to On, the orchestrator will connect to the F5 device using SSL even if it detects a problem with the certificate on the F5 device (e.g., it doesn’t trust the issuer of the certificate because the certificate is self-signed). This option applies only to the F5 methods based on the F5 SOAP API (see Certificate Stores). The F5 methods based on the F5 iControl REST API automatically ignore SSL warnings without the need to set this option. The default is Off.
Agents	General	Certificate Authority For Submitted CSRs	The certificate authority used for reenrollment requests made from the Certificate Stores page. See Certificate Store ODKG.
Agents	General	Default ODKG Subject Input to Freeform	If toggled to On, on the On-Device Key Generation page, defaults the subject entry form to the Freeform format rather than the Strict format. The default is Off (Strict format).
Agents	General	Heartbeat Interval (minutes)	The frequency, in minutes, with which an orchestrator (e.g., Keyfactor Universal Orchestrator, Keyfactor Java Agent) should query the Keyfactor Command orchestrator server for a status on the accuracy of its jobs list. The default value is 5.
Agents	General	Job Failures and Warnings Age Out (days)	The number of days orchestrator job failures and warnings should be included in the count of failures on the orchestrator job history tab. The default value is 7.
Agents	General	Notification Alert Email Recipients	The email address(es) to receive notification.
Agents	General	Notification Alert Interval (minutes)	The timer service has a job that runs based on this application setting. If an orchestrator has not checked in between job runs, an email alert is sent to the configured recipients stating which orchestrator has not been seen.
Agents	General	Number of times a job will retry before reporting failure	The number of times an orchestrator job will attempt to retry running if it encounters an error before failing. The default value is 5.
Agents	General	Orchestrator Job History Limit	The number of orchestrator job history records to retain for recent inventory jobs for each certificate store. The default is 3.
Agents	General	Registration Check Interval (minutes)	The frequency, in minutes, with which an orchestrator should check with the Keyfactor Command server to see if it has been approved as an orchestrator. The default value is 30.
Agents	General	Registration Handler Timeout (seconds)	The maximum number of seconds an registration handler is allowed to attempt to run before being halted and declared to be deferred. The default value is 90 for more recently installed systems. Keyfactor recommends using a value of at least 60 seconds.
Agents	General	Revoke old Client Auth Certificate	If toggled to On, revokes the previous certificate used for orchestrator client certificate authentication after the certificate has successfully been renewed using the client certificate authentication renewal extension. The default is On.
Agents	General	Send Entropy during on device key generation (ODKG/Reenrollment)	If toggled to On, the configure call returns the property Entropy containing 2048 bytes during on device key generation (ODKG) for certificate store reenrollment. This property is optional via this application setting. The default is Off on upgrades and new installs.
Agents	General	Session Length (minutes)	The frequency, in minutes, with which an orchestrator renews its session with the Keyfactor Command server and obtains a new session token in the absence of any other reason for the orchestrator to renew the session token. The session token is also renewed when an orchestrator job changes (e.g., an inventory schedule changes, a certificate is scheduled for addition to a certificate store, or a certificate is scheduled for removal from a store) or the orchestrator is restarted. The default value is 1380.
Agents	General	Template For Submitted CSRs	The template used for reenrollment requests made from the Certificate Stores page. See Certificate Store ODKG. The template selected for this value must be available for enrollment against the CA listed in the Certificate Authority For Submitted CSRs setting.
Agents	SSH	Auto Register	If toggled to On, orchestrators with SSH cababilities with auto-register in Keyfactor Command. The default is Off.
Agents	SSL	Retain SSL Endpoint History (days)	The number of days old an endpoint history record must be before it is available for deletion by the endpoint history cleanup process. Endpoint history records older than this will be retained if they are the last records for the given endpoint. Both the last discovery and last monitoring records will be retained regardless of age. The default value is 30.
Agents	SSL	SSL Maximum Discovery Job Size	The maximum number of endpoints for scanning that will be assigned to any one orchestrator for a given discovery scan job part. Together with the SSL Scan Job Timeout setting, this can be used to fine tune the running of SSL discovery scan jobs. The default value is 16,384. Note: A change made to this setting takes effect with the next discovery scan job. It does not affect currently running jobs.
Agents	SSL	SSL Maximum Email Results	The maximum number of results to display in an SSL monitoring results email message table of certificates that have expired or are expiring shortly. The default value is 500.
Agents	SSL	SSL Maximum Monitoring Job Size	The maximum number of endpoints for scanning that will be assigned to any one orchestrator for a given monitoring scan job part. Together with the SSL Scan Job Timeout setting, this can be used to fine tune the running of SSL monitoring scan jobs. The default value is 16,384. Note: A change made to this setting takes effect with the next monitoring scan job. It does not affect currently running jobs.
Agents	SSL	SSL Scan Job Timeout (minutes)	The maximum number of minutes any one orchestrator is allowed to attempt to run an SSL scan job before the job for that orchestrator is abandoned and given to the next orchestrator in the orchestrator pool to run (if applicable). The default value is 180. Note: A change made to this setting takes effect immediately. It applies to currently running jobs as well as future jobs.
Agents	SSL	SSL Scan User Agent	Defines what is sent to endpoints when Request Robots.txt is enabled on a SSL Network.

Application Settings: API Tab

Figure 421: API Application Settings

Table 36: API Application Settings

Tab	Section	Field	Description
API	Certificate Enrollment	Authorization Token Timeout	This is considered deprecated and may be removed in a future release.
API	Certificate Enrollment	Reverse Legacy Enrollment Chain Order	This is considered deprecated and may be removed in a future release.
API	General	Allow Deprecated API Calls	If toggled to On, allow access to earlier versions of the API or other legacy API methods that have been replaced or updated. This can be useful for applications written against earlier versions of the API to retain operational functionality. In all other cases, this setting should be toggled to off, as the newer API methods have increased security measures. The default is on. Note: When this option is Off, requests that include X-Keyfactor-Requested-With: APIClient are rejected (403 Forbidden), while if the header is missing or null, GET requests proceed normally but POST/PUT requests are blocked by other middleware and return an error (status depends on that middleware). For more information, see Versioning in the Keyfactor API Reference Guide.

Tab

Section

Field

Description

API

Certificate Enrollment

Authorization Token Timeout

This is considered deprecated and may be removed in a future release.

API

Certificate Enrollment

Reverse Legacy Enrollment Chain Order

This is considered deprecated and may be removed in a future release.

API

General

Allow Deprecated API Calls

If toggled to On, allow access to earlier versions of the API or other legacy API methods that have been replaced or updated. This can be useful for applications written against earlier versions of the API to retain operational functionality. In all other cases, this setting should be toggled to off, as the newer API methods have increased security measures.

The default is on.

Note: When this option is Off, requests that include X-Keyfactor-Requested-With: APIClient are rejected (403 Forbidden), while if the header is missing or null, GET requests proceed normally but POST/PUT requests are blocked by other middleware and return an error (status depends on that middleware).

For more information, see Versioning in the Keyfactor API Reference Guide.

Application Settings: SSH Tab

The SSH The SSH (secure shell) protocol provides for secure connections between computers. It provides several options for authentication, including public key, and protects the communications with strong encryption. tab only appears if your installation supports and includes.

Figure 422: SSH Settings

Table 37: SSH Application Settings

Tab	Section	Field	Description
SSH	General	Key Lifetime (days)	The number of days for which an SSH key generated through My SSH Key (see Generate a New SSH Key) or Service Account Keys (see Service Account Key Operations) is considered valid. The default is 365 days.
SSH	General	SSH Key Password	The regular expression against which the password entered when creating, rotating or downloading keys for both user SSH keys (My SSH Key Operations) and service account SSH keys (Service Account Key Operations) will be validated. The default is a minimum of 12 characters configured as: ^.{12,}$
SSH	General	SSH Key Password Error Message	The error message displayed to the user in the relevant SSH pages of the Keyfactor Command Management Portal when the password referenced does not match the regular expression defined for the password using the SSH Key Password setting.

Application Settings: Workflow Tab

Figure 423: Workflow Settings

Table 38: Workflow Application Settings

Tab	Section	Field	Description
Workflow	General	Instance Cleanup Days	The number of days to retain completed workflow instances (successful or failed) before they are purged. The cleanup job runs daily at midnight. The default value is 14.
Workflow General	General	Use Deprecated Sans Token Parser	The $(sans) token functions differently in workflow output depending on the configuration of this setting. When this application setting is toggled to On, the $(sans) token output is very similar to the $(sansformattedprint) token output, with the SANs in a cleanly formatted string. When this application setting is toggled to Off, the $(sans) token output is a serialized as a JSON string, which supports the use of ConvertFrom-Json -AsHashtable. The default is Off.
Workflow	General	Workflow Step Run Timeout (seconds)	The number of seconds a workflow instance step will be allowed to run before timing out and setting the instance to a status of Failed. The default is 60 seconds.

Application Settings: Dashboard and Reports Tab

Figure 424: Dashboard and Reports Settings

Table 39: Dashboard and Reports Application Settings

Tab	Section	Field	Description
Console	Dashboard	Dashboard Collection Caching Interval (minutes)	The number of minutes before the contents of collections with user-specific tokens should be considered out-of-date, and refreshed. The default value is 10.
Console	Dashboard	Weeks of CA Stats	The number of weeks of CA data to include in the dashboard graphs. The default value is 24.
Console	General	Debug Dashboard and Embedded Reports	When toggled to On, a small debug icon () appears on each graph or chart on the dashboard and can be clicked to see debug information about the graph or chart. Dashboard panels with more than one graph or chart will show multiple debug icons. For reports, setting this value to On causes an Enable Debug check box to appear on the parameters page for reports you access and run from the Navigator (reports on the Reports menu dropdown of the Management Portal) or the Report Manager grid. If you check the Enable Debug box, the debug icon () appears at the bottom of the reports and can be clicked to see debug information about the report. When toggled to Off, the debug icons and Enable Debug option do not appear. The default is Off. Note: The debug icon only appears for users with full administrative permissions to the Keyfactor Command Management Portal. It will be hidden from users with more limited access even if enabled.
Console	Report	Report Footer	A string that appears at the bottom of Logi-based reports either generated from the Management Portal or generated with the Report Manager in PDF format. The report footer appears only at the very end of the report, not at the foot of every page in the report.
Console	Report	Report Footer Icon	The file name of an image to be used at the bottom of each page of exported and scheduled PDF reports. You can use this to replace the Keyfactor logo with a custom image on your reports. The image is auto set to a height of 30px. This image should be placed in the _SupportFiles folder under the Logi folder (located at C:\Program Files\Keyfactor\Keyfactor Platform\Logi by default).

Tip: Click the help icon (

) next to the Application Settings page title to open the Keyfactor Software & Documentation Portal to this section. You will receive a prompt indicating:

You are being redirected to an external website ‘software.keyfactor.com'. Would you like to proceed?

You can also find Help in the Navigator The Navigator is the Keyfactor Command left-hand (newer versions) or top (older versions) navigation menu. Certificate collections and reports can be configured to be added to the menu using user-defined Show in Navigator settings.. From here you can choose to open either the Keyfactor Software & Documentation Portal at the home page or the Keyfactor API Endpoint Utility.

Keyfactor provides two sets of documentation: the On-Premises Documentation Suite and the Managed Services Documentation Suite. Which documentation set is accessed is determined by the Application Settings: On-Prem Documentation setting (see Application Settings: Console Tab).

Was this page helpful? Provide Feedback

Version v25.4

On this page: