The Certificate Collection
The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be availble in other places in the Management Portal (e.g. expiration alerts and certain reports). Manager is used to:
- View a list of certificate collections.
- Change whether or not the collections show in Navigator (the top menu, where they appear under Certificates).
- View whether or not the collections show in the dashboard widget (see Dashboard: Collections).
- Delete a certificate collection.
- Search for specific certificate collections from the list (see Using the Collection Manager Search Feature).
-
View all the certificates in a collection.
Highlight the collection from the Certificate Collection Manager grid and click the View action button. This will open a new window with the name of the collection in a certificate search grid (see Viewing an Existing Certificate Collection).
Tip:
An automated timer service runs against these collections (except My Certificates) to monitor certificates entering and leaving the collections so they can be used to trigger a custom workflow A workflow is a series of steps necessary to complete a process. In the context of Keyfactor Command, it refers to the workflow builder, which allows you automate event-driven tasks when a certificate is requested or revoked. to manage your PKI A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. health (see Workflow Definitions).
A workflow is a series of steps necessary to complete a process. In the context of Keyfactor Command, it refers to the workflow builder, which allows you automate event-driven tasks when a certificate is requested or revoked. to manage your PKI A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. health (see Workflow Definitions).
To open the Certificate Collection Management grid, browse to Certificates > Collection Manager in the Management Portal. The Certificate Collection Management page includes the following collection action buttons from the grid header:
- Set Show in Navigator on the collection to determine whether or not the collection appears in Navigator (the top menu under Certificates). To change this setting, highlight the row in the collection management grid and click Show in Navigator at the top of the grid, or right-click the collection in the grid and choose Show in Navigator from the right-click menu. This will toggle the Yes/No in the Show in Navigator grid column.
- To delete a collection, highlight the row (or rows) in the collection management grid and click Delete at the top of the grid or right-click the collection in the grid and choose Delete from the right-click menu.
- Highlight a row in the collection management grid and click View at the top of the grid, or right-click the collection in the grid and choose View from the right-click menu to be taken to the list of certificates in that collection. Choosing this option will open the certificate search page in a new window filtered with the specific collection.
Figure 62: Certificate Collection Manager
Keyfactor Command Auto-Created Collections
Several collections are created automatically when Keyfactor Command is installed.
- Certificates Expiring in 7 Days
This collection uses the special %TODAY% value in place of the current date to create a collection that can be used on any day to find the certificates that will expire within the next week. Only active certificates are included in this collection. The query for this collection is:ExpirationDate -ge "%TODAY%" AND ExpirationDate -le "%TODAY+7%" AND CertState -eq "1" - Certificates with Weak Encryption
This collection uses a variety of key type The key type identifies the type of key to create when creating a symmetric or asymmetric key. It references the signing algorithm and often key size (e.g. AES-256, RSA-2048, Ed25519)., key size The key size or key length is the number of bits in a key used by a cryptographic algorithm., and signing algorithm queries to produce a collection that returns active certificates that have weak encryption. The query for this collection is:((SigningAlgorithm -contains "SHA 1" OR SigningAlgorithm -contains "SHA1" OR SigningAlgorithm -contains "SHA-1") OR (SigningAlgorithm -contains "MD") OR (KeyType -eq 3 AND KeySize -lt 224) OR (KeyType -eq 1 AND KeySize -lt 2048)) AND CertState -eq "1" - My Certificates
This collection uses the special %ME% value in place of a specific user name to create a collection that any user can use to find the certificates on which they were the requester. The query for this collection is:NetBIOSRequester -eq "%ME%"Note: Certificate collections saved using the %ME% value are not supported for use in reports or on the dashboard. - Revoked Certificates
This collection returns revoked certificates by querying for certificates that have a non-null revocation date. The Include Revoked box is automatically checked for this collection when run. The query for this collection is:RevocationDate -ne NULL - Self-Signed Certificates
This collection returns all certificates that are self-signed. In environments with no certificates imported from external sources (e.g. SSL TLS (Transport Layer Security) and its predecessor SSL (Secure Sockets Layer) are protocols for establishing authenticated and encrypted links between networked computers. scanning), this would typically just be CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. certificates. The query for this collection is:SelfSigned -eq true
Important: The special query options of %TODAY%, %ME%, and %ME-AN% are only supported in uppercase. Lowercase equivalents (e.g. %me%) cannot be substituted.
Important: All automatically created collections are included on the menu by default, and all are included in the Certificate Collections Management grid by default. They are created for fresh installations of Keyfactor Command only, not upgrades, so as not to overwrite any user-defined collection for existing installations.
Tip: Click the help icon (
) next to the Certificate Collection Manager page title to open the Keyfactor Command Documentation Suite to this section. You can also find the help icon at the top of the page next to the Log Out button. From here you can choose to open either the Keyfactor Command Documentation Suite at the home page or the Keyfactor API Endpoint Utility.
) next to the