Relution Signet Customer Hub

Certificate Management

In addition to the Built-In CA → for automatically issued certificates, Relution offers two further views for certificate management: Certificates for uploaded certificates and certificates stored by Relution, and Issued Certificates for an overview of the certificates issued or assigned to devices by a certificate policy.

Certificates

Under Settings → Certificates, existing certificate files can be uploaded and managed (e.g. crt, cer, der, pem, p12/pfx).

Required fields when uploading

  • Name: Name of the certificate.
  • Certificate file: The certificate file to upload.

Optional

  • Password: Password for the certificate file, if encrypted.

An uploaded certificate can then be selected in many policy configurations as a generic certificate — similar to a Built-In CA certificate template, but without automatic per-device issuance. Typical use cases include VPN, Wi-Fi (EAP-TLS), and Exchange/email configurations, as well as Windows and Android Enterprise certificate configurations.

In addition to uploaded certificates (usage Generic), the list shows certificates stored by Relution by default, such as the Built-in PKI root certificate, Built-in pool certificates from a certificate pool →, and push and signing certificates. The view can be narrowed down using the Usage, Type (PKCS1/PKCS12) and State filters. The certificate file of an entry can be downloaded using the download button in the list.

A deleted certificate is not removed permanently but receives the state Deleted. Since the State filter only shows Created by default, deleted certificates only become visible after adjusting the filter; they can be brought back via Restore certificate.

Issued Certificates (Device Certificates)

Under Settings → Issued Certificates, an overview is available of all certificates automatically issued or assigned to a device by a certificate policy (Built-In CA, SCEP/Microsoft ADCS or certificate pool →) — including the certificate, device, certificate template used, certificate authority, and issuance, expiry, and (if applicable) revocation dates. Revoked certificates are hidden by default and are shown via the Revoked certificates filter; the list can also be filtered by Certificate template. For revoked certificates, the Revoked by and Reason of revocation columns show who revoked the certificate and why.

Manual issuance is not possible from this view — certificates are only created as the result of an enrollment or policy process. Two actions are available:

  • Delete: Removes the entry from Relution. If a device requests the certificate again, a new certificate is issued. Certificates that have not yet expired and are assigned to a revocation list (CRL) managed by Relution cannot be deleted, only revoked. This also applies after revocation, until the certificate has expired.
  • Revoke: Revokes the certificate via the certificate revocation list (CRL) of the associated certificate authority. A reason must be selected in the mandatory field Reason of revocation: unspecified, key compromise, CA compromise, affiliation changed, superseded, cessation of operation, privilege withdrawn or AA compromise.

Revocation is only possible for certificates issued by a Built-In CA, as Relution only maintains a revocation list for these. Certificates from a SCEP or Microsoft ADCS certificate authority and certificates from a certificate pool cannot be revoked in Relution, only deleted; they are revoked at the issuing certificate authority. Certificates that have already been revoked or have expired cannot be revoked either.