Certificate Details

The optional certificate owner is a security role defined in Keyfactor Command (see Security Roles and Claims).

Click Change Owner at the top of the Certificate Details dialog for the certificate to change or set the certificate owner.

The Change Certificate Owner dialog uses a search select dropdown. To narrow the list of results in a search select dropdown, begin typing in the input field. Matching results will appear as you type. The roles shown are filtered based on the acting user’s security configuration (see Certificates for more details).

The following permissions determine which roles appear in the list and which the user can assign as certificate owner:

• Expanded Change Owner Permission: A user with the Certificates > Expanded Change Owner permission can the certificate owner to any role within the permission sets they belong to—even if they do not currently hold the role assigned as the certificate owner. This permission overrides the Certificates > Collections > Change Owner permission (both Global and Collection level) if both are set.

  Note:  To set the certificate owner using the Expanded Change Owner permission, the user must also have Security > Read permission in the permission set that contains the role being assigned as the new certificate owner.

• Collections > Change Owner Permission:

  This permission allows a user to set or change the certificate owner to a role they personally hold—but only under the following conditions:

  • Global Level: The user can set or change the certificate owner for any certificate to a role they hold.
  • Granular Level: The user can set or change the certificate owner only for certificates in certificate collections or certificate store applications they have access to—and only to a role they hold.
• Search Select Disabled: The certificate owner search select dropdown is disabled if the acting user does not hold the current certificate owner role, either globally or at the collection level, or lacks Security > Read permission in the permission set that contains that role.

The Content tab shows the certificate attributes from the CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. (Active Directory in the case of a Microsoft CA). These fields are not editable. Some things to note for this tab:

• The list of Subject Alternative Names (SANs) and SAN The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common. count are also included on this tab.

• The Extended Key Usage (EKU) field will show an OID Object identifiers or OIDs are a standardized system for identifying any object, concept, or "thing" with a globally unambiguous persistent name. if a display name is not available for the value.

• For an ECC Elliptical curve cryptography (ECC) is a public key encryption technique based on elliptic curve theory that can be used to create faster, smaller, and more efficient cryptographic keys. ECC generates keys through the properties of the elliptic curve equation instead of the traditional method of generation as the product of very large prime numbers. certificate, the Curve field appears on this tab containing the elliptic curve algorithm.

• Hybrid certificates A certificate that uses a non-PQC (Post-Quantum Cryptography) primary key paired with an alternative key algorithm such as ML-DSA-44, ML-DSA-65, or ML-DSA-87 for enhanced security and quantum resistance. include the following additional fields on this tab:

  • Alternative Private Key Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure. Is Accessible

    This field will show Yes if the private key for the certificate is stored in the Keyfactor Command database or No if it is not.

  • Alternative Key Algorithm

    A string representing the alternative key type The key type identifies the type of key to create when creating a symmetric or asymmetric key. It references the signing algorithm and often key size (e.g. AES-256, RSA-2048, Ed25519). (e.g., ML-DSA-87 An even stronger variant of ML-DSA, offering a larger key size and enhanced security features for demanding cryptographic operations. Like the others in the ML-DSA family, it is designed for specific use cases that require high-performance cryptography.).

  • Alternative Signing Usage

    A string indicating the signing algorithm used by the CA to generate the alternative signature.

• Is CA Certificate

  True/false value depending on if it is a CA certificate.

• Lifespan

  The number of days of the beginning to end lifespan of a certificate, not to be confused with remaining validity.

• Maximum Number of Intermediate Certificates

  The value is only displayed if the certificate is a CA certificate and has a PathLenConstraint basic constraint defined.

Figure 34: Certificate Details: Content Tab

Double-click a row on the Content tab to open a details dialog showing just the information for that row.

The Metadata Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. tab displays all metadata fields created for your Keyfactor Command implementation and shows any data in fields that have been populated with values specific to the certificate. Depending on the metadata type, these fields appear as text boxes, radio buttons, drop-downs, date fields, tables, or large text fields.

For users with edit permissions, on date fields a small popup calendar will appear that allows selection of a date and will properly format it. You may edit values for any metadata fields to update the data at any time. You may also update multiple certificates' metadata with the same data by selecting multiple certificates from the certificates grid. Required fields will be marked with *Required next to the field label. See Certificate Metadata for information on this functionality.

The status tab displays some additional information about the certificate (see Table 9: Status Tab Descriptions).

The fields on this tab cannot be edited, though the certificate owner can be changed using the Change Owner button at the top of the dialog by users with appropriate permissions.

The Validation tab has been removed as of Keyfactor Command version 25.4. It has been replaced for hosted customers, with proper licensing, with the Risk Intelligence Dashboard. Data from the former Validation tab has been consolidated on the Certificate Details Status Tab tab.

If you have added the certificate to any certificate store location(s), a number will appear in the Count column on the corresponding Location Type row. Users with limited permissions will only see locations for certificate stores to which they have been granted permissions either globally or via certificate store applications (see Application Permissions). Click the count number for more details regarding this certificate's location. See Add to Certificate Store for more information. The Total Cert Store Locations appears at the end of the list. Clicking on the total will open a dialog with the list of locations with the columns: Store Path, Store Machine, Alias, IPAddress, Port, and Agent Pool which will be populated depending on the details of the individual stores.

Note:  The SSL TLS (Transport Layer Security) and its predecessor SSL (Secure Sockets Layer) are protocols for establishing authenticated and encrypted links between networked computers. network name is searchable with certificate search and also appears in the location details grid of the certificate details, if the certificate was found during an SSL scan.

History about a certificate is recorded in the Keyfactor Command database for the following types of activities (see also Audit Log):

• Initial Import—A history entry is made on import via CA synchronization, SSL synchronization, certificate store synchronization or manual import.
• Certificate Enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA).—A history entry is made when a PFX A PFX file (personal information exchange format), also known as a PKCS#12 archive, is a single, password-protected certificate archive that contains both the public and matching private key and, optionally, the certificate chain. It is a common format for Windows servers. or CSR A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA. enrollment is completed through the Keyfactor Command Management Portal. The source of the request (PFX or CSR) is indicated.
• Revocation—A history entry is made each time a certificate is revoked, so if a certificate is revoked multiple times, there will be multiple history entries.
• Key Recovery—A history entry is made each time the key for a certificate is recovered, so if the key for a given certificate is recovered multiple times, there will be multiple history entries. This type of record is generated when the private key for a certificate is downloaded from the Keyfactor Command database or when a private key is recovered from a CA using the CA's key recovery mechanism.
• Certificate Store Additions and Removals—A history entry is made each time a certificate is added to a certificate store or removed from a certificate store. These entries reference the specific certificate store type and whether the operation was an addition or removal—Add ([store type]) and Remove ([store type])—and include details in the certificate history comments.
• Certificate Renewals—A history entry is made each time a certificate is renewed or reissued. The certificate renewal history record appears on both the old certificate (renewed from) and the new renewed certificate.
• Certificate Store Inventory Discoveries—A history entry is made each time an inventory of a certificate store notices that a certificate that was in a certificate store no longer is or that a new certificate has appeared in the certificate store. These entries are referenced as Certificate Appeared ([store type]) and Certificate Disappeared ([store type]) with details in the certificate history comments.
• SSL Endpoint An endpoint is a URL that enables the API to gain access to resources on a server. Inventory Discoveries—A history entry is made each time an inventory of an SSL endpoint notices that a certificate that was at an endpoint no longer is or that a new certificate has appeared at an endpoint during a monitoring task. These entries are referenced as Certificate Appeared (SSL Sync) and Certificate Disappeared (SSL Sync) with details in the certificate history comments.
• Metadata Updated—A history entry is made each time a metadata field is updated for the certificate. The changed data will be recorded in the Comment field.

• Change Certificate Owner—When updating, adding or removing the certificate owner, we also include whether or not the user has the Expanded Change Owner permission.