Administration
Everything under System, plus the automation features operators lean on. Admin role required for most of this.
Dokumentacija je trenutno dostupna na engleskom. Sučelje proizvoda i ugrađena pomoć dostupni su na hrvatskom.
Sign-in and RBAC
- ▸System → Logins — the break-glass local admin, LDAPS directory bind, and OIDC SSO providers (generic + a Microsoft Entra ID preset).
- ▸System → Users — local accounts (username, password, role).
- ▸System → RBAC — map LDAP/SSO groups or usernames to
viewer/operator/admin, optionally scoped to a single collection (a team sees only its own certificates), plus the default role. Enforced server-side, on the API.
Workflows and notifications
Automation → Workflows binds a trigger to an ordered list of steps, each with an optional condition:
- ▸Triggers — enrollment (a certificate was issued) and expiration (a certificate entered the 30-day window, fired once per certificate).
- ▸Steps — approval (pauses until a person decides), notify (webhook or e-mail; can address
{owner_email}or any{meta.*}field), and set_metadata. - ▸Instances — every run with its step-by-step trail; approvals land here as waiting.
Automation → Notifications configures SMTP: a daily expiry digest and issue/revoke event mails. Slack-compatible webhooks run in parallel. Send a test first.
Reports
Built-in reports (expiring within a window, full inventory, key strength, per issuer, expired/revoked) preview on screen, export as CSV or HTML, and can be e-mailed immediately or on a schedule.
Backup and restore
System → Backup: define named repositories (local disk, SFTP, SCP, TFTP), run backups manually or on a schedule, optionally AES-256-GCM-encrypted. Restore replaces the database transactionally — all or nothing, from inside the app.
Audit log and SIEM
Every mutation and login attempt is recorded with the actor — System → Activity is the queryable audit log. System → SIEM forwards the same event stream to your SIEM over syslog (UDP, TCP or TLS) in RFC 5424, CEF or JSON format — one stream, nothing to reconcile.
License
System → License shows the state: a fresh install runs a trial of 30 days or 10 issued certificates, whichever comes first (the trial clock is rollback-proof). Activation is a signed .lic file, verified fully offline. When a license lapses, read-only inventory and monitoring keep working; issuance, renewal and deployment pause until renewal.