Certificate🔗
Introduction to Certificate
This section provides information about Object certificates, which are digital certificates managed by the NACVIEW system and assigned to objects such as Identities and Endpoint devices. Object certificates are used primarily for certificate-based network authentication (e.g. EAP-TLS), where a user or device presents a certificate instead of, or in addition to, a password. In addition to the certificate itself, this information includes: name, type of assigned object, PKI (issuing Certificate Authority), validity period, status, and the object to which the certificate is assigned. This information can be used in the process of deciding whether to grant access to the enterprise network.
System context: Object certificates are issued by the NACVIEW internal Certificate Authority (PKI), for example the Default CA. A certificate can be assigned to an Identity or to an Endpoint device, and can be managed either from that object’s details panel using the Certificates button, or centrally from Objects > Object certificates. Each certificate has a defined validity period (Valid from, Valid to) and a status showing whether it has been created (Is created), is enabled (Is enabled), or has been revoked (Revoked). A revoked or disabled certificate can no longer be used to authenticate on the network. Certificates can then be used in the certificate-based authentication policies defined in the system.
Operational Example: When a corporate laptop connects to the network using EAP-TLS, it presents its certificate. NACVIEW verifies that the certificate is valid, enabled, and not revoked, matches it to the assigned Endpoint device or Identity, and grants access according to the applicable access policy.
Toolbar🔗
Add button is used to issue a new object certificate from the NACVIEW internal Certificate Authority (PKI) and assign it to a selected Identity or Endpoint device.
Group actions button is used to perform an action on multiple selected
certificates at once. Certificates can be selected by holding the Ctrl or
Shift key while clicking. The available actions are: Edit selected, Activate,
Deactivate, and Delete.
The object certificate details panel🔗
The object certificate details panel opens when a specific certificate is selected from the list. It displays all information about the selected certificate in one place, in read-only mode. The top of the panel contains action buttons for the selected certificate (Edit, Download PKI certificate, Archive), while below them the full set of the certificate’s attributes is shown, including creation data (Created by), the Name, the Type of assigned object (Identity or Endpoint device), the validity period (Valid from, Valid to), the status (Is enabled), the description, the assigned Endpoint device or Identity, whether the certificate has been generated (Is created), whether it has been revoked (Revoked), and the issuing PKI (e.g. Default CA).
Edit button is used to edit the attributes of the selected certificate.
Download PKI certificate button is used to download the selected certificate issued by the PKI to a file.
Archive button is used to display the archive records related to the selected certificate, showing when each record was created, by whom, from which IP address, and the object name and type.
Panels🔗
The following expandable panels are available at the bottom of the right-hand side of the details view:
Access groups - shows the access groups associated with this certificate (used for policy configuration).
See also
For instructions on how to configure object certificates step by step, see Configuration Guides → Object certificate configuration.