> For the complete documentation index, see [llms.txt](https://docs.caf.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.caf.io/caf-api/connect/authentication/certificates/managing-certificate.md).

# Managing Certificates

{% hint style="info" %}
Access [Creating a Certificate](/caf-api/connect/authentication/certificates/creating-certificate.md) to learn how to set up certificates first. This guide explains how to manage your certificates in the Trust portal.
{% endhint %}

After creating certificates for `mTLS` authentication, you'll need to manage them throughout their lifecycle. This includes viewing, renewing, and revoking certificates as needed.

## Viewing your certificates

To view your existing certificates:

1. **Navigate to API Configurations**:
   * Log in to the Trust portal.
   * From the dashboard, locate the navigation menu.
   * Click on **Settings** (gear icon) in the menu.
   * Select **API Configurations** from the menu.
   * Click on the **Certificates** tab.
2. **Certificate List**:
   * All your certificates will be displayed with their status (Active/Revoked), expiration date, and distinguished name.
   * You can filter certificates by status as needed.

{% hint style="info" %}
**Certificate Limit**: Each tenant can have a maximum of three active certificates at any time, unless they are renewal certificates as described below.
{% endhint %}

![Certificates List](/files/kiho0kW61n1ODKzMxrqa)

## Certificate lifecycle management

### Checking certificate details

1. Click on a certificate name in the list to view its details:
   * Issuance date and expiration date (certificates are valid for 365 days)
   * Certificate fingerprint
   * Usage statistics
2. You can download the certificate again if needed (private key will not be available for download again if Certta generated it).

### Renewing a certificate

Certificates have a validity period of 365 days and should be renewed before they expire. You can only renew a certificate when it's within 120 days of its expiration date.

1. **Locate the Certificate**:

   * Find the certificate you want to renew in your certificates list.
   * Certificates eligible for renewal will display a renewal status indicator.
   * Click the **three-dot menu** (⋮) next to the certificate.

   ![Certificate List with Renewal Option](/files/DqQjILkMDVwedyDVTxhA)
2. **Renew the Certificate**:

   * Select "Renew certificate" from the dropdown menu.
   * In the confirmation dialog, review the information about the renewal.
   * Click "Renew" to confirm and create a new certificate based on the current one.

   ![Renew Certificate Dialog](/files/hS9e1m5X7oqmVQbRJndL)
3. **Download the New Certificate**:

   * When the renewal process completes, you'll see a success modal with a "Download certificate" button.
   * Download your new certificate immediately.
   * The new certificate will have a validity period of 365 days from the renewal date.

   ![Certificate Renewed](/files/tGpNdJQ56TCjigtUmoMB)

{% hint style="info" %}
**Certificate Limit Exception**: When you renew certificates, both the original and renewed certificates remain active. This creates an exception to the three-certificate limit, allowing you to have up to 6 certificates (3 original and 3 renewed). This grace period lets you smoothly transition your applications to the new certificates.
{% endhint %}

4. **Update Your Applications**:
   * Implement the new certificate in your applications while keeping the old one active.
   * Test thoroughly before fully switching to the new certificate.

### Revoking a certificate

If a certificate is compromised or no longer needed, you should revoke it immediately:

1. **Locate the Certificate**:
   * Find the certificate in your certificates list.
   * Click the **three-dot menu** (⋮) next to the certificate.
2. **Revoke the Certificate**:
   * Select "Revoke certificate" from the dropdown.
   * In the confirmation dialog, provide a reason for revocation.
   * Click "Revoke" to confirm.

![Revoke Certificate Dialog](/files/biTRCy2QBkDhOkPC2Ons)

{% hint style="warning" %}
Once a certificate is revoked, it cannot be reinstated. You'll need to create a new certificate if needed.
{% endhint %}

## Best practices for certificate management

* **Maintain an inventory** of all your certificates with their expiration dates.
* **Set up reminders** for certificate renewals at least 30 days in advance.
* **Implement certificate rotation procedures** in your applications to smoothly transition between certificates.
* **Limit access** to certificate management to authorized personnel only.
* **Regularly audit** certificate usage and revoke unused certificates.
* **Have a documented process** for handling certificate compromise incidents.

## Next steps

Once your certificates are properly managed, learn how to [use them with mTLS](/caf-api/connect/authentication/using-mtls.md) to secure your API communications with Certta.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.caf.io/caf-api/connect/authentication/certificates/managing-certificate.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.