Certificate profiles
Reuse issuance settings and preserve the choices required for reliable renewal.
Documentation for 1.0.38. Screenshots show example data.
Available since 1.0.37. Open PKI → Certificate profiles to create, edit, copy or disable a profile as an administrator. The platform provides general TLS and RSA Catalyst 9800 WebAdmin starters.
Defaults and enforced settings
Profiles distinguish suggested defaults from enforced requirements. Existing CA policies remain authoritative. Select the appropriate CA, key algorithm/size and ADCS template, then review certificate identity and intended usage.
On Issue certificate, select a profile or save suitable settings as a profile. ADCS published-template discovery can refresh available templates; manual entry remains available. Failed discovery preserves the last known list with a warning.
Issuance and renewal
The server validates the selected profile before approval and issuance. The certificate, encrypted key and issuance snapshot are stored together. Renewal retains the snapshot, effective ADCS template, identity and key settings while current CA policies still apply.
Disabling a profile prevents new selection; it does not disable existing renewals. Existing certificates without recorded issuance settings keep their previous CA-default template fallback.
Check the issued result
The platform checks required usages and WLC signing requirements on the issued result. If a result fails those checks, it remains in Inventory with its key and a validation warning. Issuance is counted, but automatic deployment does not start.
Scope
Profiles apply to server-generated enrollment. EST/SCEP client CSR enrollment is separate. A profile does not create a Windows CA template, change a CA signing key, bind an appliance service or enable scheduled agentless renewal.
See ADCS configuration, Catalyst 9800 deployment and the upgrade guide.
ens0key 1.0.38-preview · Example data