Active Administrator 8.5

Managing certificates

The Certificate Management window displays the certificates for the selected computer. The heading at the top of the display enumerates the total valid, soon to expire, expired, deleted, and broken certificates. The state of each certificate is indicated by an icon.

If someone deleted a certificate using system-provided tools, the certificate displays in a pane at the bottom of the screen. You can restore the deleted certificate from the Active Administrator database or install the certificate on another computer.

Broken certificates also display in a pane at the bottom of the screen. You can attempt to repair the broken certificate or override the broken certificate notification, which replaces the certificate stored in Active Administrator with the broken certificate. See Managing broken certificates.

To manage certificates

Select Certificate | Certificate Management.

Select the computer to view the certificates.

Select the certificate to be managed.

- OR -

Select multiple certificates to be managed by holding the Shift or Ctrl keys during selection.

Use the tool bar to manage the selected certificates. You also can right-click a certificate and select an option from the shortcut menu.

Table 5. Certificate Management tool bar
Option	Description
Computers	Manage the computers on which certificates are monitored. See Managing computers.
Sync	Refresh the Active Administrator database and the display with the certificates on a selected computer. See Updating the list of certificates. NOTE: If Certificate Protection is enabled (see Configuring certificate protection), the database and display are not refreshed, but instead the certificates on the computer are checked against the Active Administrator database for differences. If broken certificates are found, email notifications are sent. If auto-repair is enabled, an attempt to repair the broken certificates automatically (see Managing broken certificates).
Add	Add a certificate to a selected computer. See Installing certificates.
Delete	Delete a certificate from a selected computer. Deleting certificates.
Install on	Install selected certificates on one or more computers. See Installing certificates.
Refresh	Refresh the display by pulling the contents of the Active Administrator database. See Updating the list of certificates.
More \| Export	Export a selected certificate to a selected location, either from the list of certificates or a selected computer. See Exporting certificates.
More \| Details	View the details of the selected certificate. You also can install the certificate on a computer, export the certificate, and view the validation chain. See Viewing certificate details.
More \| Add to Repository	Add a selected certificate to the Certificate Repository. See Adding a certificate to the repository.
More \| Validation Chain	View the validation chain of the selected certificate. See Viewing the validation chain.
More \| Report	Create a certificates report to display in a report editor, to send in an email, or to save to a file. See Sending a report.
More \| Report schedules	Edit, disable, or remove report certificate report schedules. See Managing report schedules.
More \| Notifications	Exclude a selected certificate from being included in the certificates that support cryptography notification email. See Excluding certificates that support cryptography.
More \| Revoke Notifications	Exclude a selected certificate from being included in the revoked certificate notification email. See Excluding revoked certificates
More \| Broken Certificate History	View the list of the certificates that are broken, were repaired, failed repair, or were overridden. See Managing broken certificates.
More \| Monitored Objects	View the list of objects that are being monitored for computers that are added or removed. See Managing monitored objects.
Group by	Group the list of certificates by stores or by the state of the certificate. See Grouping the list of certificates.

Managing computers

To view certificates on a computer, you must add the computer. When you first add a computer, it is synced when you choose to display the certificates. Only those computers that are managed by the Certificate module are monitored for certificates. Managed computers are monitored based on the schedule set on the Certificate Configuration page (see Setting certificate configuration). You can turn off the dynamic monitoring of managed computers and sync them manually.

Topics:

•

Adding computers

•

Excluding stores

•

Removing computers

•

Disabling certificate management

To manage computers

Select Certificate | Certificate Management.

Click Computers.

Use the buttons to manage the list of computers.

Table 6. Computers to Manage Certificates options
Button	Description
Add	Add a computer to the list of managed computers. See Adding computers.
Remove	Remove the selected computers from the list of managed computers. See Removing computers.
Edit	Enable/disable the selected computer or edit the credentials on the selected computer. See Disabling certificate management and Adding computers.
Stores	Exclude selected stores on a specified computer from monitoring. See Excluding stores.
Test	Validate the connection to the selected computer.
Enable	Enable certificate management on the selected computers.
Disable	Disable certificate management on the selected computers. See Disabling certificate management.

Adding computers

To manage certificates on a computer, you must first add the computer. Only the computers listed in the Available computers list are monitored for certificate management.

To add computers to view certificates

Select Certificate | Certificate Management.

Click Computers.

Click Add to add new computers to the list.

To populate the Available computers list, choose between adding selected computers, loading computers from selected OUs or loading computers from selected groups. You can use a combination of these options to populate the list of computers.

To add selected computers

Select Select Computers.

Type the fully qualified domain name (FQDN) of each computer you want to add, separated by semi colons.

-OR-

Browse and select one or more computers.

Click Add to add the computers to the list of Available computers.

Repeat as necessary to add the computers you need.

To add computers in OUs

Select Select Organizational Units.

Type the name of each OU, separated by semicolons.

-OR-

Browse and select one or more OUs.


	NOTE: The OUs you select are added to the list of monitored OUs. You can add or remove OUs from the list of Monitored Objects once you complete this task. See Managing monitored objects. NOTE: To reload the list of objects, click Refresh. All selections are cleared and any newly added OUs appear in the list.

By default, nested OUs are included. To exclude nested OUs, clear the check box.

By default, the OUs you selected are monitored for computers that are added or removed. To disable monitoring, clear the check box.


	NOTE: By default, OUs are monitored every 30 minutes to check for computers that are added or removed. To change the monitoring time, to add or remove OUs from monitoring, or to disable/enable monitoring, see Managing monitored objects.

Click Add to add the computers from the selected OUs to the list of Available Computers.

Repeat as necessary to add the computers you need.

To add computers in Groups

Select Select Groups.

Type the name of each group, separated by semicolons.

-OR-

Browse and select one or more groups.


	NOTE: The groups you select are added to the list of Monitored Objects. You can add or remove groups from the list of Monitored Objects once you complete this task. See Managing monitored objects. NOTE: To reload the list of objects, click Refresh. All selections are cleared and any newly added groups appear in the list.

By default, nested groups are included. To exclude nested groups, clear the check box.

By default, the groups you selected are monitored for computers that are added or removed. To disable monitoring, clear the check box.


	NOTE: By default, groups are monitored every 30 minutes to check for computers that are added or removed. To change the monitoring time, to add or remove groups from monitoring, or to disable/enable monitoring, see Managing monitored objects.

Click Add to add the computers from the selected groups to the list of Available Computers.

Repeat as necessary to add the computers you need.

To manage the Available computers list, you can filter the list and remove computers you no longer need to monitor.

•

To filter the list, start typing in the Filter Computers box. The list filters as you type.

•

To remove selected computers from the list, click Remove.

By default, all stores in a selected computer are included. You can exclude selected stores from monitoring.

To exclude selected stores

Select a computer.

Click Stores.

You can filter the list of stores or use Select all/Clear all to manage the list.

Clear the check boxes of the stores to exclude.

Click OK.

Click Yes to confirm the excluded stores.

By default, the Active Administrator® Foundation Service Credentials are used to retrieve certificates from the selected computers. If you want to specify a different account, clear the check box, and enter the username, or browse to select an account, and enter the password.

Click OK.


	NOTE: Active Administrator validates each computer, in the order they appear in the Available computers list. If you selected several computers and the process is taking too long or you are getting errors, you can cancel the process. Click Cancel in the progress bar, and click Yes to confirm. If you want to repeat the test, click Test.