Administration
Everything under System, plus the automation features operators lean on. Admin role required for most of this.
Die Dokumentation ist derzeit auf Englisch verfügbar. Produktoberfläche und integrierte Hilfe sind auf Deutsch verfügbar.
Sign-in and RBAC
- ▸System → Logins — the break-glass local admin, LDAPS directory bind, and OIDC SSO providers (generic + a Microsoft Entra ID preset).
- ▸System → Users — local accounts (username, password, role).
- ▸System → RBAC — map LDAP/SSO groups or usernames to
viewer/operator/admin, optionally scoped to a single collection (a team sees only its own certificates), plus the default role. Enforced server-side, on the API.
Workflows and notifications
Automation → Workflows binds a trigger to an ordered list of steps, each with an optional condition:
- ▸Triggers — enrollment (a certificate was issued) and expiration (a certificate entered the 30-day window, fired once per certificate).
- ▸Steps — approval (pauses until a person decides), notify (webhook or e-mail; can address
{owner_email}or any{meta.*}field), and set_metadata. - ▸Instances — every run with its step-by-step trail; approvals land here as waiting.
Automation → Notifications configures SMTP: a daily expiry digest and issue/revoke event mails. Slack-compatible webhooks run in parallel. Send a test first.
Reports
Built-in reports (expiring within a window, full inventory, key strength, per issuer, expired/revoked) preview on screen, export as CSV or HTML, and can be e-mailed immediately or on a schedule.
Backup and restore
System → Backup: define named repositories (local disk, SFTP, SCP, TFTP), run backups manually or on a schedule, optionally AES-256-GCM-encrypted. Restore replaces the database transactionally — all or nothing, from inside the app.
Audit log and SIEM
Every mutation and login attempt is recorded with the actor — System → Activity is the queryable audit log. System → SIEM forwards the same event stream to your SIEM over syslog (UDP, TCP or TLS) in RFC 5424, CEF or JSON format — one stream, nothing to reconcile.
License
System → License shows the state: a fresh install runs a trial of 30 days or 10 issued certificates, whichever comes first (the trial clock is rollback-proof). Activation is a signed .lic file, verified fully offline. When a license lapses, read-only inventory and monitoring keep working; issuance, renewal and deployment pause until renewal.