Certificates
The Certificates page (/admin/certificates) shows the internal PKI of the agents and of the service TLS. It
needs pki:manage or cluster:read; rotating needs pki:manage.
What the screen shows
Every certificate issued by the internal CA: kind (agent or service), host, service, serial, expiry, Revoked.
Actions
| Button | Effect | Permission |
|---|---|---|
| Download CA | downloads the CA certificate (the one the agents pin) | signed in |
| Rotate certificates | issues new certificates for the instances of a service and restarts them (operation pki.rotate) | pki:manage |
Typical tasks
- Trust the service TLS on a client. Download CA, install it in the trust store of the client.
- Renew before expiry. Rotate certificates of the service, then follow the operation.