Saving Search Criteria as a Collection

To save your search criteria as a certificate collectionClosed The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be availble in other places in the Management Portal (e.g. expiration alerts and certain reports).:

  1. Click the Save button.

    Figure 32: Save Certificate Collection

  2. In the Save Certificate Search dialog, enter a name for the certificate collection. This name appears at the top of the page for this collection and can be configured to appear on the Management Portal menu under Certificates. It will also appear in other places within the Management Portal where you can reference certificate collections (e.g. workflows, alerts, and certain reports and dashboards). Because it can appear on the menu and in selection dropdowns, the name should be fairly short.
  3. Enter a description for the collection. This description appears as a subtitle below the collection name on the page for this collection and can be more detailed than the collection name.

  4. Select a setting in the Ignore Renewed Cert[ificate] Results by dropdown.

    Important:  The Ignore option applies to processing reports, expiration alerts, and expiration workflows. De-duplication is available as an option on reports that use collections and is enabled by default on expiration reports. It does not apply to the certificates displayed in certificate search. All certificates display on the certificate search grid.

    The Ignore options are:

    Do not eliminate duplicate certificates for this certificate collection.

    Eliminate duplicate certificates based on the common nameClosed A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (e.g. CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (e.g. servername.keyexample.com or www.keyexample.com). in the certificate. Certificates will be excluded from reports, alerts, and workflows if they share the same common name and enhanced key usage (EKU—e.g. Client Authentication). The certificate with the most recent issued date and the given common name and EKU will be included.

    Eliminate duplicate certificates based on the distinguished name in the certificate. Certificates will be excluded from reports, alerts, and workflows if they share the same distinguished name and EKU. The certificate with the most recent issued date and the given distinguished name and EKU will be included.

    Eliminate duplicate certificates based on the principal name in the certificate status data stored in the Keyfactor Command database for the certificate. The principal name is added to the certificate status data for the certificate during certificate synchronization if the certificate SANClosed The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common. contains a user principal name or NT principal name. Certificates will be excluded from reports, alerts, and workflows if they share the same principal name and EKU. The certificate with the most recent issued date and the given principal name and EKU will be included.

    Eliminate duplicate certificates based on certificates that have been renewed through Keyfactor Command. Only certificates that have not been renewed will be included reports, alerts, and workflows.

    Note:  When processing reports, expiration alerts, or expiration workflows based on this certificate collection, only certificates that share all the EKUs (e.g. Client Authentication and Server Authentication) as well as the same CNClosed A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (e.g. CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (e.g. servername.keyexample.com or www.keyexample.com)., DNClosed A distinguished name (DN) is the name that uniquely identifies an object in a directory. In the context of Keyfactor Command, this directory is generally Active Directory. A DN is made up of attribute=value pairs, separated by commas. Any of the attributes defined in the directory schema can be used to make up a DN. or UPN will be eliminated as duplicates. If a certificate has more than one EKU and at least one EKU does not match an otherwise similar certificate with matching CN, DN or UPN, it will not be eliminated.

  5. Check the Show on Dashboard box to include the results from this collection on the Collection dashboard (see Dashboard: Collections). To change this setting later, see Certificate Collection Management.

    Note:  The collections dashboard widget will only display the first 25 collections, displayed in the order in which they were created by default. The order may be customized if desired (see Dashboard: Collections). The save dialog includes a brief message explaining the display limit when the Show on Dashboard box is checked.

  6. Check the Show on Navigator box to include the collection on the certificates dropdown on the NavigatorClosed The Navigator is the Keyfactor Command top-level dropdown menu. Certificate collections and reports can be configured to be added to these dropdowns using user-defined Show in Navigator settings.. To change this setting later, see Viewing an Existing Certificate Collection.

    Note:  The menu will only display the first 25 collections, displayed in the order in which they were created by default. The order may be customized if desired (see Certificate Collection Management). The save dialog includes a brief message explaining the display limit.
  7. Click Save to save the collection.

The search results will display immediately. If you didn't select the Show on Navigator option, you can find the collection again on the Certificate Collection Management page, accessed by navigating to Certificates > Collection Manager from the Management Portal.

Tip:  If you Save a new certificate collection, or Save a change to an existing certificate collection, that change will be immediately reflected in the collection data used to display certificate collections on dashboards and reports. The data used by the dashboards and reports is stored in an intermediate table that is updated immediately. It will also continue to be updated periodically (approximately every 20 minutes by default as configured by the Dashboard Collection Caching Interval application setting) by the Keyfactor Command Service (see Application Settings: Console Tab).