SSL Certificate Operations

The various operations performed using SSL certificates are:

1. Import and Export Certificates
2. Edit and Delete Certificates
3. Certificate Requests
4. Control Expiry Notification Schedules
5. Domain Expiration
6. SSL Certificate Group

1. Import and Export Certificates

1.1 Allowed Certificate Types

Key Manager Plus allows you to import and export the following certificate types:

• .cer
• .crt
• .pem
• .der
• .p7b
• .pfx
• .p12
• .pkcs12
• .jks
• .keystore

1.2 Steps to Import Certificates into Key Manager Plus

In addition to Certificate Discovery, Key Manager Plus offers multiple ways to manually add SSL certificates to its repository. These steps are listed below:

1. Navigate to the SSL >> Certificates tab and click the Add button.
2. In the Add Certificate window that appears, you can import certificates using any of the following methods:
   1. Certificates – Click Browse, select the desired certificate file from your computer, and click Open.
   2. Certificate Content – Copy the certificate content and paste it into the designated textbox within the Key Manager Plus window.
   3. Keystore Based – Click Browse and select the desired Keystore file. If the Keystore file is password-protected, enter the password in the designated field. Tick the checkbox Add Keystore digital certificates in a Certificate Group if you want to add the digital certificates from the Keystore file to a new certificate group. Enter a name for the certificate group in the given field.
   4. Certificate Details – Click Browse, select the .csv file with the required certificate details and click Open.
3. Click Add to import the certificate(s) to the Key Manager Plus repository.

1.3 Steps to Import Issuer Certificates

Key Manager Plus allows you to import issuer certificates into the repository and build a complete certificate chain in the product.

1. Navigate to SSL >> Certificates. Select the required end certificate.
2. Under the More dropdown, select Import Issuer.
3. In the pop-up that appears, browse and add the issuer certificate.
4. The additional issuer certificates you add will be appended to the existing SSL certificate in the repository based on the issuer name. To download the complete chain with the private key, export the certificate in JKS, PKCS, or PEM formats.
   
   

1.4 Steps to Export Certificates from Key Manager Plus

2. Edit and Delete Certificates

2.1 Steps to Edit a Certificate from Key Manager Plus Repository

To edit a certificate from the Key Manager Plus repository:

1. Navigate to SSL >> Certificates tab.
2. Select the certificate to be edited, click More, and select Edit from the drop-down.
3. In the Edit Certificate pop-up that appears, edit the DNS Name, Port, Description, Expiry Notification Email, Type, and Provisioning Type as required.
4. You can enable 'Deploy Certificate on Auto Renewal' to deploy the new certificate to all servers on auto-renewal.

   Note: You will be able to deploy certificate to all servers on auto renewal only if the user credentials are available.

5. From the available additional fields, you can modify the text and dropdown fields with respect to the certificate details as added in the additional fields section.

   Note: Click on the respective certificate from the Certificates tab to view the certificate details from the 'Certificate Details' window that opens.

6. Click Save.

2.2 Steps to Delete a Certificate from Key Manager Plus Repository

You can delete the certificates that are currently not in use. To delete a certificate from Key Manager Plus repository:

1. Navigate to the SSL >> Certificates tab.
2. Select the certificates to be deleted. 
3. Click More and select Delete from the drop-down.
4. Click Ok in the pop-up that appears. 

3. Certificate Requests

The certificate request workflow is as follows:

1. Add certificate request
2. Close certificate request

3.1 Add Certificate Request

To add requests for new certificates or addition of sub-domains to existing certificates, in Key Manager Plus:

1. Navigate to the SSL >> CSR >> Certificate Request and click the Add Request button.
2. Select the type of request – Certificate or domain addition.
   1. New Certificate – Attach a CSR to your request (optional) and a domain name for the new certificate.
   2. Add domain – Enter the name of the new domain and select a parent domain from the certificates added to the Key Manager Plus repository.
3. Enter the Email-Id to which you would like to send the request and specify the certificate validity period. These mail addresses can be that of an administrator, an intermediary who handles certificate requests, or even your help desk software to raise the certificate request as a ticket.
   1. For eg., admin@keymanagerplus.com, help-desk@manageengine.com.
4. The Operators can directly Select the administrators to notify them about the certificate request via email. 
5. Select Additional fields to add additional information such as device name and IP address
6. Click Add Request to add it to the list of request in the Certificate Request tab and to send the same to the specified email addresses.

3.2 Certificate Request Status

A certificate request is in either of the following statuses.

1. Open
2. Closed

When a certificate request is raised, it is automatically elevated to the Open State. The request details can be viewed from the SSL >> Certificate request tab, on clicking the domain name of the request.

3.3 Close Certificate Request

To terminate the certificate request life-cycle:

1. Navigate to the SSL >> CSR >> Certificate Request window in the GUI.
2. Click the Open status link in the right corner of the table against the required open request process.
3. In the Close Request window, add an optional Annotation, and attach the Certificate issued (optional), specify the Email-ids of users to whom the certificate is to be sent and click the Save & Close button. Once you click the button, the request is automatically moved to the Closed state.
4. If a SSL certificate is attached while closing the request, the certificate is automatically imported to the Key Manager Plus repository.
5. Also, the issued certificate is e-mailed to the user who raises the request, the user who closes the request and also to those e-mail ids specified at the time of closing the request.

 

4. Control Expiry Notification Schedule

You can customize the periodicity of notifications you receive when a certificate is about to expire. To customize the notifications:

1. Navigate to Settings >> Notifications >> Expiry in the GUI.
2. Select the Notify about SSL certificates expiring within checkbox and select the number of days before the expiry of certificate within which you should start receiving notifications.
3. Select the Email or Syslog checkbox from the respective pane and enter the appropriate details.
4. Click the Save button.

5. Domain Expiration

Key Manager Plus has an in-built WHOIS look up tool that helps administrators query and obtain information about any registered domain name such as ownership details, date of registration & expiration, IP address history and more.

To access the WHOIS look up tool,

1. Navigate to Settings >> Other Settings >> Domain Expiration.
2. In the window that opens, enter the domain name for which you want to obtain the details (in terms of a top-level domain or sub domain of a top-level domain).
3. Click Get Details. The details about the domain are displayed in the dialog box that opens below.

5.1 Track Domain Expiration through WHOIS Lookup

Apart from tracking certificate expiration, Key Manager Plus also helps administrators keep a tab on their expiring domain names through an automated WHOIS look up. The domain expiration details fetched through the lookup are displayed in SSL >> Certificates tab against its corresponding SSL certificate. Also, administrators can choose to receive timely email notifications of their expiring domains by configuring it in Settings >> Notification >> Expiry window.

How does the WHOIS lookup work?

Fetching domain expiration details requires a two-stage lookup to WHOIS servers from Key Manager Plus. The first lookup provides the details of the WHOIS server with which the domain was registered by its domain registrar. The second lookup provides information about the domain such as owner details, expiration date etc., All these operations are automated the from Key Manager Plus' interface.

6. SSL Certificate Group

Key Manager Plus allows you to organize SSL certificates into various logical groups, execute actions in bulk, and export these certificate groups as Truststore.

6.1 Create Certificate Groups

To create a certificate group,

1. Click the Certificate group icon in the top-right corner of the SSL >> Certificates tab.
2. Click Add Group. You will be directed to the Add certificate group window. 
3. Provide a name for the certificate group and an optional description. Exercise caution while providing the name since it cannot be changed later.
4. You can choose certificates to be added to a group in 2 ways:
   1. By specific certificate - Select the certificates to be added to the group individually and click Save.
   2. By criteria - This serves as a dynamic method of grouping certificates. You will specify various criteria based on which the group will be created. Here, you can choose certificates based on various criteria such as issuer, common name, key algorithm, key size, key length etc. The additional fields that are added will also be displayed in the list. You can filter the search in a fine-grained manner based on conditions such as "equals" or "does not equal", "contains" or "does not contain", "starts with" or "ends with". Click the Matching certificates button at the bottom-right corner to see the corresponding certificates. 
5. Mention the Group Email address to send expiry notifications and click Save. 
6. The certificate group is created. To know more about additional fields, click here. 

6.2 Edit Certificate Groups

To make changes to existing certificate groups,

1. Click the certificate group icon on the top-right corner of the SSL >> Certificates tab.
2. Click the edit icon present in the right corner of the table view.
3. You can change the certificate selection type, edit the certificates present in a group or add, modify or delete the filters applied to a group and Group Email.
4. Once you update the changes and save them, a pop up message will be displayed confirming the updates.

6.3 Export Certificate Groups

To export certificate groups as Truststore,

1. Navigate to SSL >> Certificate Group.
2. Click the Export icon beside the respective certificate group you wish to export.
   
3. In the pop-up window that appears, enter a password in the designated field and click Export.
   

The certificate group will be exported as Truststore and encrypted with the specified password.

6.4 Delete Certificate Groups

To delete a certificate group,

1. Click the Certificate group icon on the top-right corner of the SSL >> Certificates tab.
2. Select the groups that you want to delete and click Delete.
3. A pop-up window will appear asking you to confirm the action. 
4. Click Ok and the selected certificate groups will be deleted.

©2025, Zoho Corporation Pvt. Ltd. All Rights Reserved.