Home Orlando IT Operations Management IT Operations Management ITOM Visibility Discovery Certificate Inventory and Management Certificate Inventory and Management workflow

Certificate Inventory and Management workflow

Certificate requests and incidents are automatically created when expiring and expired certificates are discovered.

A scheduled job looks into the Unique Certificates [cmdb_ci_certificate] table daily and initiates renewal certificate tasks when the certificate is expired or about to expire.

Tasks for certificate renewals are automatically generated 60 days prior to expiration. To change the number of days, update the Discovery property: glide.discovery.certs.days_before_expiration_to_create_renewal_task.
Certificate tasks are automatically flagged with Priority 3 - Moderate. Open the task and change the priority if desired.
If there is already a certificate task existing for the current certificate, no additional tasks are created.
For renewal certificate tasks and incidents, various fields are pre-populated automatically based on the certificate CI.
If a certificate is expired, a new incident is created if the expired certificate is not replaced.
If a certificate is expired, only one incident is created for that certificate.
To see the certificate incidents list, navigate to Service Desk > Incidents.

Create new certificate requests

You can also manually request new certificates through the Service Catalog.

Before you begin

Make sure that the Certificate Management catalog is enabled.

Role required: pki_user or pki_admin

Procedure

Navigate to Service Catalog > Certificate Management.
Click Request New Certificate.
Enter appropriate information for mandatory fields: Certificate Signing Request, Certificate Authority, Certificate Type, Validity period, and Approver.
Enter or select any other details on the form and then click Submit to place the order.

Result

This creates a Certificate task which is then submitted for approval. The approval field is read only for pki_user and update for pki_admin.

Create a renewal certificate request

You can also manually request to renew certificates through the Service Catalog.

Before you begin

Make sure that the Certificate Management catalog is enabled.

Role required: pki_user or pki_admin

Procedure

Navigate to Service Catalog > Certificate Management.
Click Renew Certificate.
Select a Certificate CI.
Enter appropriate information for mandatory fields: Certificate Signing Request, Requested for, and Approver.
Enter or select any other details on the form and then click Submit to place the order.

Result

This creates a Certificate task which is then submitted for approval. The approval field is read only for pki_user and update for pki_admin.

Certificate Inventory and Management users and roles

There are special users and roles that support tracking requests for new certificates and renewing certificates.

Users

Certificate Administrator: This is a headless user (an account not bound to a particular user frequently used to allow automation of certain tasks) shipped with the base system which has sn_disco_certmgmt.pki_admin role and is used as the caller for the auto-generated renewal certificate tasks and incidents. Use the Discovery property: glide.discovery.certs.cert_admin_user_id to modify the user instead of leaving as headless user.

Roles

The Certificate Management dashboard and certificate configuration settings are enabled or disabled based on these roles:

sn_disco_certmgmt.pki_admin: This role can change non-standard attributes that are not present in the original certificate record such as state, status, assigned to, assignment group, renewal tracking, and service type. Attributes present in certificate are not editable. The default state is installed for discovered certificates, but this role can manually change the state to other options for example, issued, installed, revoked, and retired. This role can also view various dashboards, and has read/write access to certificates and certificate tasks related to certificate Discovery. The sn_disco_certmgmt.pki_admin role contains the sn_disco_certmgmt.pki_user role.
sn_disco_certmgmt.pki_user: This role can view various dashboards, and has read access to certificates and certificate tasks related to certificate discovery.

Note: Any user with the pki_admin role can be added to the approver field in the certificate request form.

Note: Users with pki_admin role should be assigned with the approval_admin role manually to approve or reject requests from the certificate task form. This approver does not need to login to approve the task. In a certificate task form or related list, system admin or a user with approval_admin role or pki_admin role can add multiple approvers or edit the existing one.

The approver_user role is required if the user wants to approve a request by logging in. Without the approver_user role, a user doesn't have the option to navigate to My Approvals where the requests can be approved.

Archive certificate tasks

In Version 1.1.7 Certificate Inventory and Management, the Data Archiver [com.glide.auxdb] plugin moves data that is no longer needed from primary tables to a set of archive tables daily. It checks for and archives certificate tasks that are more than one year old. This plugin must be enabled and made active for the scheduled archival tasks to run. The Certificate Task Archive rule comes with the Certificate Inventory and Management application but is inactive by default.

Before you begin

See Activate data archiving for more information.

Make sure the Data Archiver [com.glide.auxdb] plugin is installed.

Role required: pki_user or pki_admin

Procedure

Activate the Certificate Task Rule.
Navigate to Archive Rules > Certificate Task Archive.
Click the Active checkbox.

Result

Once activated, this rule archives data from the Certificate Task table [sn_disco_certmgmt_certificate_task] when the following two conditions are met:

State is Closed Complete
Update before Last12 months

Certificate Discovery reference information link

Previous topic

Next topic

Release version

Certificate Inventory and Management workflow

Certificate requests and incidents are automatically created when expiring and expired certificates are discovered.

A scheduled job looks into the Unique Certificates [cmdb_ci_certificate] table daily and initiates renewal certificate tasks when the certificate is expired or about to expire.

Tasks for certificate renewals are automatically generated 60 days prior to expiration. To change the number of days, update the Discovery property: glide.discovery.certs.days_before_expiration_to_create_renewal_task.
Certificate tasks are automatically flagged with Priority 3 - Moderate. Open the task and change the priority if desired.
If there is already a certificate task existing for the current certificate, no additional tasks are created.
For renewal certificate tasks and incidents, various fields are pre-populated automatically based on the certificate CI.
If a certificate is expired, a new incident is created if the expired certificate is not replaced.
If a certificate is expired, only one incident is created for that certificate.
To see the certificate incidents list, navigate to Service Desk > Incidents.

Create new certificate requests

You can also manually request new certificates through the Service Catalog.

Before you begin

Make sure that the Certificate Management catalog is enabled.

Role required: pki_user or pki_admin

Procedure

Navigate to Service Catalog > Certificate Management.
Click Request New Certificate.
Enter appropriate information for mandatory fields: Certificate Signing Request, Certificate Authority, Certificate Type, Validity period, and Approver.
Enter or select any other details on the form and then click Submit to place the order.

Result

This creates a Certificate task which is then submitted for approval. The approval field is read only for pki_user and update for pki_admin.

Create a renewal certificate request

You can also manually request to renew certificates through the Service Catalog.

Before you begin

Make sure that the Certificate Management catalog is enabled.

Role required: pki_user or pki_admin

Procedure

Navigate to Service Catalog > Certificate Management.
Click Renew Certificate.
Select a Certificate CI.
Enter appropriate information for mandatory fields: Certificate Signing Request, Requested for, and Approver.
Enter or select any other details on the form and then click Submit to place the order.

Result

This creates a Certificate task which is then submitted for approval. The approval field is read only for pki_user and update for pki_admin.

Certificate Inventory and Management users and roles

There are special users and roles that support tracking requests for new certificates and renewing certificates.

Users

Roles

The Certificate Management dashboard and certificate configuration settings are enabled or disabled based on these roles:

sn_disco_certmgmt.pki_admin: This role can change non-standard attributes that are not present in the original certificate record such as state, status, assigned to, assignment group, renewal tracking, and service type. Attributes present in certificate are not editable. The default state is installed for discovered certificates, but this role can manually change the state to other options for example, issued, installed, revoked, and retired. This role can also view various dashboards, and has read/write access to certificates and certificate tasks related to certificate Discovery. The sn_disco_certmgmt.pki_admin role contains the sn_disco_certmgmt.pki_user role.
sn_disco_certmgmt.pki_user: This role can view various dashboards, and has read access to certificates and certificate tasks related to certificate discovery.

Note: Any user with the pki_admin role can be added to the approver field in the certificate request form.

Archive certificate tasks

Before you begin

See Activate data archiving for more information.

Make sure the Data Archiver [com.glide.auxdb] plugin is installed.

Role required: pki_user or pki_admin

Procedure

Activate the Certificate Task Rule.
Navigate to Archive Rules > Certificate Task Archive.
Click the Active checkbox.

Result

Once activated, this rule archives data from the Certificate Task table [sn_disco_certmgmt_certificate_task] when the following two conditions are met:

State is Closed Complete
Update before Last12 months

How search works:

Topics are ranked in search results by how closely they match your search terms

Certificate Inventory and Management workflow

Certificate Inventory and Management workflow

Create new certificate requests

Create a renewal certificate request

Certificate Inventory and Management users and roles

Users

Roles

Archive certificate tasks

On this page

Certificate Inventory and Management workflow

Certificate Inventory and Management workflow

Create new certificate requests

Create a renewal certificate request

Certificate Inventory and Management users and roles

Users

Roles

Archive certificate tasks

Log in to personalize your search results and subscribe to topics