Certificates

The Certificates module tracks SSL/TLS certificates per client, records their validity dates and details, and flags certificates that are expiring soon or already expired so you can renew them before they cause outages.

Overview

Certificates let you:

• Record SSL/TLS certificates for each client, with an optional link to a tracked domain
• Capture certificate details: type, issuer, serial number, Subject Alternative Names (SANs), and validity dates
• See at-a-glance status badges (Active, Expiring Soon, Expired)
• Search certificates and filter by the active client
• Receive automatic in-app reminders for certificates nearing expiration

Navigate to Assets → Certificates

Open Assets → Certificates (/certificates) in the left sidebar to see all certificates in your organization.

Certificate list

The list shows the following columns:

Column	Description
Certificate	The certificate name, with the primary domain shown beneath it
Client	The client that owns the certificate (links to the client)
Type	Certificate type badge, or - if not set
Issuer	Issuing certificate authority, or - if not set
Expiration	The expiration date
Status	Status badge (see below)

Use the Search certificates... box to filter by name or domain. If you have a client selected in the global client filter, the list is scoped to that client. The list is paginated (25 per page).

Status badges

The status badge is derived from the expiration date:

Badge	Meaning
Expired	The expiration date has passed
Expiring Soon	The certificate expires within the next 30 days
Active	The certificate is valid and more than 30 days from expiry

Internally, a certificate also has a stored status of ACTIVE, EXPIRED, REVOKED, or PENDING. The status badge on the list and detail pages is computed from the expiration date, so a stored status only shows directly in the detail page's Status field.

Adding a certificate

1. Click Add Certificate to open the new certificate form.
2. Under Certificate Information, fill in:
   • Certificate Name (required) — an identifier for the certificate
   • Client (required) — the owning client
   • Associated Domain (optional) — a domain you already track for that client; the picker is enabled once a client is selected
   • Domain (required) — the primary domain on the certificate (for example example.com or *.example.com)
   • Certificate Type — see the type list below
   • Issuer — the certificate authority (for example, Let's Encrypt or DigiCert)
3. Under Validity Period, set:
   • Issue Date (optional)
   • Expiration Date (required)
4. Under Technical Details, optionally add:
   • Serial Number
   • Subject Alternative Names (SANs) — one domain per line
5. Add any free-text Notes in the sidebar.
6. Click Create Certificate.

You are taken to the new certificate's detail page after saving.

The form also shows Common Name, Algorithm, and Key Size inputs. These are not stored — only the fields listed above are saved with the certificate.

Certificate types

Type	Description
DV	Domain Validated
OV	Organization Validated
EV	Extended Validation
WILDCARD	Wildcard certificate (for example *.example.com)
SELF_SIGNED	Self-signed certificate
OTHER	Any other type

Certificate detail page

The detail page header shows the certificate name, the owning client, and a status badge. When a certificate is expiring soon, the badge shows the number of days remaining.

A row of summary cards displays Days Until Expiry, Certificate Type, Key Size, and the number of SANs. Because Key Size is not stored, that card shows Unknown for manually entered certificates.

The Certificate Details card lists the domain, common name, issuer, algorithm, issue date, and expiration date. Common Name and Algorithm are not stored, so Common Name falls back to the domain and Algorithm shows Unknown unless the value was populated by the automatic certificate lookup (see below). If a serial number is recorded, it appears with a copy-to-clipboard button. A Subject Alternative Names (SANs) card lists every covered domain when SANs are present, and a Notes card shows any notes.

The sidebar shows the Client, the Associated Domain (when linked), the stored Status, and the Created and Last Updated timestamps. A Quick Actions card links to add another certificate for the same client.

Use Edit in the header to update the certificate, or Back to return to the list.

Automatic certificate discovery

When you track a domain (see Domains), Ascent connects to that host over HTTPS, reads the live certificate it presents, and records it here automatically. It checks the domain plus common subdomains (www, mail, api, app, portal) and captures the issuer, serial number, Subject Alternative Names, validity dates, and whether the certificate was issued by Let's Encrypt.

• Discovery runs automatically when you add a domain, and a weekly background job refreshes certificate data for domains that have not been checked recently.
• Discovered certificates are created or updated in place; changes (such as a new issuer or updated SANs) are recorded in the certificate's history.
• This live lookup only applies to certificates discovered from tracked domains. Certificates you enter manually are not validated against the live host.

Renewing and revoking

The certificate API supports two lifecycle actions in addition to standard create, edit, and delete:

• Renew — record a new expiration date (and optionally a new serial number, public key, and issue date) for a certificate.
• Revoke — mark a certificate as revoked, with an optional reason.

These actions are available through the API; the certificate detail page itself surfaces only Edit. All certificate creates, updates, deletes, renewals, and revocations are written to the audit log, and certificate changes are tracked in a per-certificate history.

Expiration reminders

Ascent runs a daily background check for expiring items (domains, certificates, contracts, warranties, and software licenses). For certificates, it looks ahead 45 days: any certificate expiring within that window generates an in-app notification (type Certificate Expiring) sent to the organization's Owner and Admin members. The notification states how many days remain until expiry.

These reminders are driven by the expiration date on record. For manually entered certificates, keep that date accurate so reminders fire at the right time, and update the certificate in Ascent after you renew it with your CA.

Best practices

• Record every certificate — include internal, self-signed, and wildcard certificates, not just public-facing ones.
• Keep expiration dates current — the daily reminder relies on the stored expiration date.
• Link the domain — associate the certificate with a tracked domain so it appears in context on the related records, and so automatic discovery can keep its details current.
• List your SANs — record every covered domain so you know the full scope of each certificate.