Certificates¶
The Certificates page lists every certificate Watchtower has issued. Use it to check expiry dates and to revoke a certificate. Open Certificates in the sidebar.
You need a role that covers the whole organization to open this page. Owners and admins also see the Revoke column.
Note
Edge and App certificates renew on their own. You do not need to renew them by hand.
Read the list¶
| Column | Shows |
|---|---|
| Purpose | What the certificate is for. See the table below. |
| Device | The id of the Edge or App that holds it. Empty for server certificates. |
| Not after | The last moment the certificate is valid, in your local time. |
| Status | Live, or "Revoked |
| Serial | The certificate's serial number. |
| Revoke | The revoke action. |
| Purpose | Meaning |
|---|---|
device |
The certificate of one Edge or App. |
service |
A certificate Watchtower uses for its own services. |
broker_server |
A server certificate Edges and Apps check when they connect. |
device_api_server |
A server certificate Edges and Apps check when they call Watchtower. |
If nothing matches, the page shows "No certificates match."
Filter the list¶
| Filter | Values |
|---|---|
| Device | An Edge or App id. |
| Purpose | Any, device, service, broker_server, device_api_server. |
| Expiring within days | A number from 1 to 3650. |
| Revoked | Any, Live, Revoked. |
Select Apply after you set filters.
Revoke a certificate¶
- Find the certificate. Select Revoke.
- Enter a Reason. It is required, up to 200 characters, and appears in Status.
- Select Confirm. Select Cancel to stop.
Warning
Revoking a device certificate deactivates that Edge or App. It disconnects and cannot reconnect. To bring an Edge back, enrol it again with Add Edge. See Edges list and Add Edge.
Revoking a server or service certificate needs the owner role. An admin who tries sees forbidden.
A revoke is recorded in Audit as certificate.revoke. Revoke is refused while the subscription is restricted. See Billing and usage.
Force service renewal¶
Owners see Force service renewal next to Apply. Select it to ask Watchtower to issue a new service certificate. The page then shows "Service renewal is queued. The enroll loop writes the new certificate."
Use it when Privitty support asks you to. It does not change broker_server or device_api_server certificates.
When a certificate is about to expire¶
Filter with Expiring within days and a value such as 14. If a broker_server or device_api_server certificate is close to its Not after date, or the Certificates check on Health is not green, contact Privitty support through the channel listed in your Privitty agreement.