Certificates is the operational home of TigerTrust. Every certificate the platform knows about — discovered by an agent, issued by an internal CA, pulled from a cloud provider, or manually uploaded — shows up here with a consistent set of columns, filters, and bulk actions.
Certificate Inventory

​
What it is

The inventory is a single list covering your entire workspace. Certificates arrive from multiple sources (discovery scans, issuance, cloud sync, manual import) but you manage them all from one place: filter by status, search by name, bulk-renew expiring certs, or click a row to open the full detail panel.

​
When to use it

  • Scan for expiring certificates and kick off renewals before they burn.
  • Filter by CA to understand your exposure to a vendor you’re moving away from.
  • Assign auto-renewal and a deployment target to newly-discovered certificates.
  • Bulk-export certificates for an auditor.

​
Set it up

Nothing to configure — Certificates is populated automatically as you run discovery scans or issue certificates. On first login to a new workspace, run a discovery scan to seed the inventory.
Sort by Expires ascending on first login — the certificates closest to expiry are the ones that need your attention first.

​
What you’ll see

Each row shows:
ColumnDescription
Common NamePrimary subject
SANsSubject alternative names (truncated)
IssuerIssuing CA name
TypeTLS, S/MIME, Code Signing, Client Auth
KeyAlgorithm and size (for example, RSA-2048, ECDSA-P256)
Statusactive, expiring, expired, revoked
ExpiresDate with relative countdown (“in 27 days”)
Sourcemanual, kubernetes, aws, azure, network, acme, agent
The status strip above the table shows totals: all certificates, active, expiring within 30 days, expired, revoked, and auto-renewal enabled. The filter bar supports status, source, issuing CA, and identity/owner. Full-text search matches common name, SANs, serial number, and fingerprint. Filters persist in the URL so you can bookmark “all payments-* expiring in 30 days.”

​
Row actions

Click any row to open the detail panel. Common actions:
  • Renew now — triggers an immediate renewal attempt.
  • Deploy — opens the deployment console scoped to this certificate.
  • Revoke — opens the reason picker and immediately marks the certificate revoked.
  • Download — download in PEM or DER format. PKCS#12 is available when the platform holds the private key.
  • Toggle auto-renewal — enable or disable the automatic renewal schedule.
  • Assign identity — link the certificate to a machine identity or user.

​
Bulk operations

Select multiple rows to unlock:
  • Bulk renew (one renewal record per selected certificate)
  • Bulk revoke with a shared reason
  • Bulk export as CSV or JSON for auditors
  • Bulk tag assignment
  • Bulk identity reassignment
Bulk actions respect your role — the button is hidden if you lack the required permission on any selected row.

​
Inspect (without importing)

Go to Certificates > Inspect to paste a PEM or point at a hostname and see the parsed certificate — issuer, SANs, key details, chain trust — without adding it to your inventory. Useful for troubleshooting and for exploring third-party services you are integrating with. The API surface for the certificate inventory is documented at API Reference.

Issue a certificate

Add a new certificate straight from the inventory.

Renewal workflow

Automate what happens 30 days before expiry.

Certificate deployment

Push discovered or renewed certificates to their endpoints.