Workflows Created by Me Operations

On the Created by Me tab of the My Workflows page you can view all the workflows that the current user initiated.

Tip:  Where to find this in the Management Portal:
Workflow → My Workflows → Created by Me Tab
Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

/workflows/instances/read/mine/
OR
/workflows/instances/read/

Searching Workflows Created by Me

This page supports the standard query format described in Using Search in the Management Portal and includes its own set of query parsers specific to this operation. Use the following parsers to filter and refine results for this page.

View an Instance

To view details of a workflow instance:

  1. On the Created by Me tab of the My Workflows page, double-click an instance or select the instance and choose View from the toolbar or right-click menu.

  2. On the Workflow Signal Review page, review the information in the instance. Information on the review page includes:

    Name Description
    Id

    A GUID indicating the Keyfactor Command reference ID for the instance.
    Title

    A description for the action taking place in the step. For example:

    "KEYEXAMPLE\jsmith is enrolling for a certificate with CN=appsrvr12.keyexample.com."

    Or:

    "KEYEXAMPLE\mjones is revoking certificate with CN=appsrvr14.keyexample.com."
    Status

    The current status message of the workflow instance.

    For example, for an enrollment that succeeded, the status message might be:

    Issued. The private key was successfully retained.

    For a workflow suspended and awaiting approval, the status message might be:

    Awaiting 2 more approval(s) from approval roles.

    For an enrollment that could not be submitted because a regular expression rule was not met, the status message might be something like:

    Pre-process failed: Invalid ST provided: Value must be one of California, Washington, Texas, New York, Illinois or Ohio.

    For an enrollment that failed due to rejection by the CA, the status message might be:

    The certificate request failed with the reason '[CA reason]'

    A workflow that failed at a PowerShell step might include the PowerShell error in the status message:

    Step 'Run PowerShell' failed: At line:5 char:19
     +    [datetime]$Date
     +                   ~
     Missing ')' in function parameter list.
     At line:7 char:1
     + )
     + ~
     Unexpected token ')' in expression or statement.
    Current Step

    The display name defined for the workflow instance step at which the instance has paused or stopped. For a successfully completed workflow, this will be End-NOOP. For a suspended workflow, this will be the step that is awaiting user input to continue the workflow. For a failed workflow, this will be the step at which the workflow failed.

    Figure 260: Workflow Instance Review

    The data included in this section will vary depending on the request type and the configuration of the workflow.

    For a certificate that entered or left a certificate collectionClosed The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be available in other places in the Management Portal (for example expiration alerts and certain reports)., this section can include:

    Name Description

    (Custom)

    Optional user-generated custom fields returning response data from PowerShell scripts or REST requests. These will be sorted alphabetically in among the other fields on the page.

    Certificate Id

    The Keyfactor Command reference ID for the certificate added to or removed from the certificate collection.

    Tip:  Certificate Id and Keyfactor Id both refer to the same value—the Keyfactor Command–assigned reference ID for a certificate. You may see either name in different parts of the Management Portal or Keyfactor API because Certificate Id was the original term, and Keyfactor Id is its newer replacement. The updated name helps avoid confusion with a different value—the certificate’s identifier on the issuing CA—which is now called the CA Record ID.

    For a certificate that entered or left a certificate store, this section can include:

    Name Description

    (Custom)

    Optional user-generated custom fields returning response data from PowerShell scripts or REST requests. These will be sorted alphabetically in among the other fields on the page.

    Certificate Id

    The Keyfactor Command reference ID for the certificate added to or removed from the certificate collection.

    Tip:  Certificate Id and Keyfactor Id both refer to the same value—the Keyfactor Command–assigned reference ID for a certificate. You may see either name in different parts of the Management Portal or Keyfactor API because Certificate Id was the original term, and Keyfactor Id is its newer replacement. The updated name helps avoid confusion with a different value—the certificate’s identifier on the issuing CA—which is now called the CA Record ID.

    Certificate Store Id

    The Keyfactor Command reference GUID of the certificate store to which the certificate was added or removed.
    Container Id The optional Keyfactor Command reference ID of the certificate store application with which the certificate store is associated.
    Name Description

    (Custom)

    Optional user-generated custom fields returning response data from PowerShell scripts or REST requests. These will be sorted alphabetically in among the other fields on the page.

    Additional Attributes

    		 Values for any custom enrollment fields set on the certificate template to supply custom request attributes to the CA during the enrollment process.
    Alternative Key Length The alternative key size for the certificate.
    Alternative Key Type The alternative key encryption algorithm for the certificate.
    CA Certificate Request Id

    The ID assigned to the certificate request by the CA.

    Note:  This field is populated only if the certificate request fails at the CA level or requires manager approval at the CA level.
    CA Certificate Request Id

    A string containing the ID assigned to the certificate request by the CA.

    Note:  This field is populated only if the certificate request fails at the CA level or requires manager approval at the CA level.
    CA Certificate Request Status

    An integer indicating the status for the certificate as returned by the CA.

    Note:  This field is populated only if the certificate request fails at the CA level or requires manager approval at the CA level.
    CA Certificate Request Status

    An integer indicating the status for the certificate as returned by the CA.

    Note:  This field is populated only if the certificate request fails at the CA level or requires manager approval at the CA level.
    Certificate Authority The certificate authority that will be used to enroll against in hostname\logical name format.
    Certificate Chain Content A string containing the certificates in the certificate chain, if the Include Chain option was selected for the request.

    Certificate To Be Renewed

    Data for the certificate that this certificate replaces on a renewal including:

    • Certificate: The original certificate in Base64-encoded format.

    • CertificateId: The Keyfactor Command reference ID of the original certificate.
    CSR Key

    The unparsed version of the certificate signing request generated for the certificate request.
    Curve The elliptic curve for the certificate.

    Custom Name

    A custom friendly name for the certificate, if entered at enrollment.
    Disposition

    An integer indicating the reference ID of the disposition for the certificate request.

    Note:  This field is only populated only after the certificate request has been submitted to the CA.

    Disposition Message

    A message about the certificate request (for example, The private key was successfully retained.).

    Note:  This field is only populated only after the certificate request has been submitted to the CA.
    Enroll Step Executed A flag indicating whether the enrollment step of the workflow has initiated (True) or not (False).
    Enrollment Context

    A string containing the enrollment context returned to Keyfactor Command for external validation requests.

    Note:  This field is only populated only after the certificate request has been submitted to the CA.
    Enrollment Pattern Id The enrollment pattern ID used when requesting the certificate.
    Enrollment Start Time The date and time at which the enrollment request was initiated, in Coordinated Universal Time (UTC).
    Format

    The desired output format for the certificate. A value of STORE indicates that the certificate is intended to be delivered into one or more certificate stores.
    From PFX Enrollment A flag indicating whether the request was initiated from PFX enrollment.

    Include Chain

    A flag indicating whether to include the certificate chain in the enrollment response (True) or not (False).
    Issuer Dn The distinguished name of the issuer of the certificate.
    Key Length The key size for the certificate.

    Key Retention

    A flag indicating whether the private key for the certificate resulting from the enrollment will be retained in c (True) or not (False).

    Key Status

    A numeric value indicating the status of the private key retention for the certificate within Keyfactor Command. Possible values are:

    • 0: Unknown

    • 1: Saved

    • 2: Expected

    • 3: NoRetention

    • 4: Failure

    • 5: Temporary
    Key Type The key type of the certificate.
    Keyfactor Id

    The Keyfactor Command reference ID for the certificate.

    Tip:  Certificate Id and Keyfactor Id both refer to the same value—the Keyfactor Command–assigned reference ID for a certificate. You may see either name in different parts of the Management Portal or Keyfactor API because Certificate Id was the original term, and Keyfactor Id is its newer replacement. The updated name helps avoid confusion with a different value—the certificate’s identifier on the issuing CA—which is now called the CA Record ID.

    Management Job Time

    The schedule for the management job to add the certificate to any certificate stores.

    Metadata

    		 Values for the metadata fields that will be associated with the certificate once it is in Keyfactor Command.
    Owner Role Id The Keyfactor Command reference ID of the security role assigned as the certificate owner.
    Raw Certificate The raw certificate generated from a certificate enrollment, without BEGIN and END blocks.
    Requester Email The email address of the user making the enrollment request.

    SANs

    The subject alternate names defined for the certificate. Possible types that can be entered within Keyfactor Command are DNS Name, IPv4 Address, IPv6 Address, User Principal Name, and Email. Within each type is a list of entries for that type shown with a key name of the entry number and the actual value. For example, if you had two DNS SANs, the DNS Name section would look something like:

    Entry 1: myfirstsan.keyexample.com
Entry 2: mysecondsan.keyexample.com

    Serial Number

    The serial number of the certificate.
    Stores

    The certificate stores to which the certificate should be distributed, if applicable.
    Subject

    The distinguished name of the certificate.
    Template Name

    The template that was used when requesting the certificate.
    Thumbprint

    The thumbprint of the certificate.

    For a certificate expiration alert that uses workflow, this section can include:

    Name Description

    (Custom)

    Optional user-generated custom fields returning response data from PowerShell scripts or REST requests. These will be sorted alphabetically in among the other fields on the page.

    Alert Id

    The Keyfactor Command reference ID of the expiration alert.

    Certificate Id

    The Keyfactor Command reference ID for the certificate.

    Tip:  Certificate Id and Keyfactor Id both refer to the same value—the Keyfactor Command–assigned reference ID for a certificate. You may see either name in different parts of the Management Portal or Keyfactor API because Certificate Id was the original term, and Keyfactor Id is its newer replacement. The updated name helps avoid confusion with a different value—the certificate’s identifier on the issuing CA—which is now called the CA Record ID.

    For an SSHClosed The SSH (secure shell) protocol provides for secure connections between computers. It provides several options for authentication, including public key, and protects the communications with strong encryption. key rotation alert that uses workflow, this section can include:

    Name Description

    (Custom)

    Optional user-generated custom fields returning response data from PowerShell scripts or REST requests. These will be sorted alphabetically in among the other fields on the page.

    Alert Id

    The Keyfactor Command reference ID of the key rotation alert.

    Serial

    The certificate serial number.
    Username User name of the SSH user owning the key.

    For a revocation, this section may include:

    Name Description

    (Custom)

    Optional user-generated custom fields returning response data from PowerShell scripts or REST requests. These will be sorted alphabetically in among the other fields on the page.
    Certificate Authority

    The certificate authority that issued the certificate.

    Certificate Id

    The Keyfactor Command reference ID for the certificate being revoked.

    Tip:  Certificate Id and Keyfactor Id both refer to the same value—the Keyfactor Command–assigned reference ID for a certificate. You may see either name in different parts of the Management Portal or Keyfactor API because Certificate Id was the original term, and Keyfactor Id is its newer replacement. The updated name helps avoid confusion with a different value—the certificate’s identifier on the issuing CA—which is now called the CA Record ID.

    Comment

    A freeform reason or comment to explain why the certificate is being revoked.
    Delegate

    A flag indicating whether delegation was turned on for the certificate authority that issued the certificate at the time revocation was requested (True) or not (False). For more information, see Delegation Section.

    Effective Date

    The date and time when the certificate will be revoked.

    Initiating User Name

    		 The name of the user who initiated the workflow in DOMAIN\\username format.

    Operation Start

    The time at which the revocation workflow was initiated.
    RevokeCode

    The specific reason that the certificate is being revoked. Possible values are:

    • -1: Remove from Hold
    • 0: Unspecified

    • 1: Key Compromised

    • 2: CA Compromised

    • 3: Affiliation Changed

    • 4: Superseded

    • 5: Cessation of Operation

    • 6: Certificate Hold

    • 7: Remove from CRL. Only valid in the case that a cert is already on a CRL in a manner that it can be removed, such as Certificate Hold.

    Serial Number

    The serial number of the certificate being revoked.
    Thumbprint

    The thumbprint of the certificate being revoked.

    For a revocation monitoring alert that uses workflow, this section can include:

    Name Description

    (Custom)

    Optional user-generated custom fields returning response data from PowerShell scripts or REST requests. These will be sorted alphabetically in among the other fields on the page.

    Alert Id

    The Keyfactor Command reference ID of the revocation monitoring alert.
    Status

    The current state of the revocation monitoring endpoint. For example:

    Expired
    Subject

    A description of the current state of the revocation monitoring endpoint. For example:

    CRL Distribution Point at Location 'http://www.keyexample.com/CorpIssuing1.crl' has Expired

    URL

    The URL for the CRL or OCSP location.

    Figure 261: View Details for the Workflow Instance

  3. Click Close to close the viewer.