Certificates

1. 01

   Certificates tab — digital certificates

   Tracks TLS certificates (single-domain, wildcard and multi-domain — worked out from the domains, you never pick), code-signing, client/S-MIME and CA certificates. The list shows the type, main domain and issuer (e.g. DigiCert, Let's Encrypt) under each name, then status, expiry with the days left, and who owns it and where it's deployed. Search matches any domain a certificate covers, and the Status filter shows what's in service by default.

2. 02

   Certifications tab — compliance certifications

   Tracks audit-based certifications like ISO 27001, ISO 9001, SOC 2 Type II, or Cyber Essentials Plus: certificate number, auditor, scope, status and expiry.

3. 03

   App Credentials tab — Microsoft 365 app secrets

   Read-only. Client secrets, X.509 key credentials and SAML token-signing certificates found on your tenant's app registrations and enterprise apps, so an expiring integration credential or SSO signing cert surfaces the same way a software renewal does. These appear only once Microsoft 365 is connected, and can't be created, edited or deleted by hand. To renew one, renew it in Microsoft Entra (its page links there with Manage in Azure) and the sync picks up the new date.

4. 04

   Add a certificate or certification

   Add Certificate on the Certificates tab starts with "What are you tracking?" — Website or server (TLS), Code signing, Client / S-MIME, CA certificate, Compliance certification or Something else, plus any custom certificate types your organisation has added — and the form then asks only for what that kind has. Add Certification on the Certifications tab goes straight to a certification. A website certificate takes one list of the domains it covers — the first is its main domain (its common name) — and each must be a host name like www.example.com or *.example.com, not a web address. The expiry date is the one required date, and the issued date must come before it. You don't set a status — AssetSort derives it from the expiry date: Valid, Expiring once the date falls inside its warning time (see Warning time below), and Expired once it's passed (the form warns you if the date you pick already has). You start as the Owner when your People record matches your sign-in e-mail; what it cost goes under Purchase & renewal.

5. 05

   Fill it in from the certificate

   When adding a certificate, instead of typing, paste it (the BEGIN CERTIFICATE block), upload the file (.cer, .crt, .pem, .der, or a .p7b/.p7c chain) or enter a public website — with a port if it isn't 443, like vpn.example.com:4443 — to read the certificate it serves. Its domains, issuer, dates, serial, fingerprint and key are filled in, and an uploaded file is kept as a document. If the organisation already tracks that certificate, the form says which record has it — open that one instead. AssetSort never takes private keys: .pfx, .p12 and .key files — or a PEM with a key inside — are refused. Internal servers can't be read from AssetSort's side; paste or upload their certificate instead. Import is for new records; to bring an existing one up to date, use Record renewal.

6. 06

   Record a renewal

   When a certificate is renewed, open it and choose Record renewal (also in the list's row menu). Import the new certificate or enter its new expiry date, plus what it cost. The record moves to the new dates in place — owner, devices, tags and documents stay — and the certificate it replaced, with its serial, fingerprint and other details, is kept in its renewal history on the History tab, along with what the renewal cost (the Overview's Last renewed row links to it). The expiry alert clears straight away.

7. 07

   Warning time

   Each certificate turns Expiring — and raises its expiry alert — a set number of days before it expires. By default that depends on its type: code signing 45 days, CA certificates 90, compliance certifications 90, and everything else your organisation's lead time (14 days unless you've changed it). Admins change these defaults under Settings → Alerts → Organisation rules; a managed client uses its MSP's. To change it for one certificate, enter the days in Warn before expiry on its form — its page shows which applies. The Home and My queue "due soon" counts stay on the lead time.

8. 08

   Replaced, revoked or retired

   A certificate you no longer track goes out of service from its menu: Mark as replaced… (optionally naming the certificate that took over), Mark as revoked… or Retire…. It stops raising alerts, drops out of renewal calendars and counts, and moves under Status → Ended in the list — its details and history stay. Reactivate brings it back. Deleting is for mistakes; ending keeps the record.

Questions people ask