Skip to content

Certificates: identity and observation

Cyphers separates two questions that "the certificate" usually smears together:

  • What the certificate IS — its fingerprint, serial, subject, issuer, validity window, SANs, key type. One certificate has exactly one identity, no matter where it turns up.
  • Where it was SEEN — served by which endpoint, found at which file path, observed by which Scout, first sighted when. Each sighting context is its own observation.

The same certificate served by three hosts is one identity, three observations — and that is not bookkeeping pedantry. Each observation carries facts that belong to that host, most importantly the on-disk file path where renewal delivery must write. Fold the observations together and one host's path would silently overwrite another's; keep them apart and each host renews into its own layout.

How Manage groups rows

The Manage page renders one group per certificate: a certificate covering several names (a multi-SAN certificate, or a wildcard absorbing the hosts it matches) shows as one group header with one endpoint row per covered name. One group ≈ one renewal, because renewing the certificate renews every name it covers in a single order and a single deployment.

State stays where it belongs:

  • Endpoint rows carry endpoint facts — each row shows its own state (managed, untracked, covered, stale…) and its own state-appropriate action. Names under one certificate can be in different states, and the page shows that instead of averaging it away.
  • The group header carries certificate facts — a worst-of summary of its members, and the actions that belong to the certificate itself.

What belongs to the certificate

Three things are certificate-level. The first two sit on the group header exactly once; the third is certificate-level in effect even though its button lives on a row:

Renewal. A renewal inherits the certificate's whole SAN set — one order covers every name, one delivery writes one file. So Renew Now appears once per group, never per member: per-member renew buttons would just be N ways to order the identical certificate.

Autopilot. For the same reason, automated renewal is a property of the certificate. The group header shows one automation state; enabling or disabling it applies to the certificate's managed members together. A per-endpoint autopilot flag described nothing physically true — the SAN siblings already renew in lockstep — and only created ways to double-order the same name set.

The renewal profile. Assigning a profile is certificate-level too: adopt any member with a profile and that profile is written across the whole group, so a certificate can never renew under two disagreeing configurations. The Adopt button itself sits on the untracked endpoint's own row — when the group already has a profile it is a one-click Promote (the profile is inherited, you are not asked again); only a certificate with no profile anywhere shows the picker. Once a renewal of the certificate verifies, eligible untracked siblings — those with served proof, on the same Scout — are brought under management automatically, so a group converges on managed rather than staying half-adopted. See Endpoints, proof, and management.

A standalone endpoint is simply its own certificate: its row and its group are the same thing, so it keeps its actions inline.

Supersession: when a certificate's story ends

A successful renewal never edits the old certificate — the predecessor keeps its identity and its original expiry, and a new identity appears. The Hub treats the old one as superseded when the successor demonstrably covers the same estate: every predecessor name appears in the successor, and every successor name was covered by the predecessor. Same estate, spelled at least as explicitly.

The "at least as explicitly" clause is load-bearing: a wildcard certificate does not supersede an explicit per-host certificate merely by matching its name — an operator who issued one.example.com explicitly keeps it renewing even after *.example.com exists. And a certificate that merely shares a name with another supersedes nothing. Supersession is how the renewal sweep knows a not-yet-expired old certificate needs no renewal of its own: its replacement already exists.