Certificates in Secryn are immutable cryptographic artifacts used to secure services, infrastructure, and communication channels. They can be generated directly within Secryn or uploaded as existing certificate bundles. Once created, certificates cannot be edited, ensuring integrity, traceability, and audit consistency.
Every certificate belongs to a vault, and access is governed by project membership, vault permissions, and user roles.
Certificates are commonly used for:
Secryn stores, distributes, and tracks certificates—it does not mutate them after creation.
Certificates cannot be edited. To renew or replace a certificate, create a new one. Existing certificates can be disabled or allowed to expire, but the original data remains unchanged for audit purposes. This enforces explicit rotation workflows.
Each certificate includes metadata such as:
When uploading a certificate, Secryn populates these fields based on the certificate contents.
Certificates support lifecycle controls:
Times are stored in UTC and displayed relative to the viewer’s timezone.
Certificates can be marked as publicly accessible. Public visibility creates a shareable download URL that does not require vault authentication. This setting controls access, not trust or cryptographic authority, and should only be used when unauthenticated access is required.
Tag certificates to help with service identification, environment grouping, or compliance tracking. Tags improve searchability but do not affect access control.
Access depends on project membership, vault permissions (including restricted vaults), and user roles. Depending on role, users may:
When uploading a certificate:
This lifecycle-driven approach keeps certificate management predictable, auditable, and secure.