Role Based Access Control
Roles in CertiNext define what actions a user is allowed to perform across the platform. They are the primary mechanism for enforcing least-privilege access, separation of duties, and operational governance in certificate and key lifecycle management.
CertiNext provides both predefined system roles and the ability to create custom roles with fine-grained permissions, allowing organizations to align access controls precisely with real-world responsibilities.
Role-Based Access Control (RBAC)
CertiNext uses a role-based access control (RBAC) model where permissions are grouped into logical functional areas such as:
Certificate lifecycle operations
Certificate Authorities and CA connectors
Discovery and inventory
Keys and key stores
Automation, bots, and provisioning
Orders, renewals, and revocations
Financial and billing operations
User, group, and policy administration
Reporting, audit logs, and compliance views
Each role represents a curated set of permissions across these areas, ensuring users only see and act on what is relevant to their job function.
Predefined Roles
CertiNext includes predefined roles to support common enterprise use cases, such as:
Administrator – Full platform access, including configuration, CA management, policies, users, and billing
Manager – Oversight of certificate operations, approvals, and reporting without full administrative control
Standard / Basic Users – Limited certificate request and operational capabilities
Discovery Users – Restricted access focused on certificate discovery and inventory management
These roles accelerate onboarding while enforcing strong governance by default.
Custom Roles
For more advanced or regulated environments, CertiNext supports custom role creation, allowing administrators to define roles tailored to specific operational needs.
When creating a custom role, administrators can:
Enable or disable permissions at a granular level
Control access to individual modules and actions (e.g., renew certificates, revoke certificates, manage discovery bots)
Combine read-only and action-based permissions
Activate or deactivate roles as needed
This allows organizations to model roles such as PKI Operator, Security Reviewer, DevOps Automation User, or Compliance Auditor with precision. Create Custom Role _ CERTInext
Scope of Permissions
Role permissions in CertiNext can span across:
APIs and automation (API credentials, bots, provisioning)
Public and private CAs (creation, management, suspension, revocation)
Certificate lifecycle actions (issue, renew, reissue, revoke, suspend)
Discovery and CT log monitoring
Keys and key profiles
Orders and approvals
Users, groups, and access controls
Reports and audit logs
This ensures that even highly sensitive operations can be delegated safely without granting unnecessary access elsewhere.
Roles, Groups, and Tags Together
Roles define what a user can do, while groups and tags define where they can do it. CertiNext evaluates access using all three dimensions:
Role – permitted actions
Group access – permitted organizational scope
Tag restrictions – permitted environments or assets
This layered model enables strong isolation between teams, applications, and environments while maintaining centralized governance.
Auditability and Governance
All role assignments, modifications, and permission changes are:
Logged in audit logs
Traceable to the administrator who made the change
Available for compliance and security reviews
This ensures accountability and supports internal and external audits.
Why Roles Matter
In certificate and trust operations, overly broad access is a major source of risk. Well-designed roles help organizations:
Prevent unauthorized certificate issuance or revocation
Enforce separation of duties
Reduce human error
Meet compliance and audit expectations
Scale operations safely across teams
Roles as a Governance Control
In CertiNext, roles are not just a convenience feature—they are a core governance control. By combining fine-grained permissions with auditability and scoped access, CertiNext enables organizations to operate complex public and private trust environments securely, responsibly, and at enterprise scale.
Session Enforcement on Role Changes
Important: When a user’s role is modified in CertiNext, the user is automatically logged out of the application. This enforced logout ensures that updated permissions take effect immediately and prevents users from continuing an active session with outdated or elevated access rights. The user must sign in again to resume access under the newly assigned role, supporting strong security, least-privilege enforcement, and audit integrity.
Last updated