Certificates

Every certificate NoCert has seen appears here once, identified by its SHA-256 fingerprint, however many endpoints, files or Kubernetes secrets expose it.

Four tabs sit above the list. Active is the default, and it hides anything not observed in the last six days. Retired holds those, Excluded holds what you took out of the inventory, and All holds everything. The list is sorted soonest-expiring first.

Whichever tab you are on, the list shows leaf certificates only, and nothing on screen says so. If an intermediate or a root you expected is missing, open Filters → Certificate type and switch to CAs or All.

The columns

Column	What it holds
Certificate	The subject common name, or the first DNS SAN, or the first IP SAN, or the short fingerprint. A chip marks the source whenever it is not the common name.
Issuer	The issuing CA’s common name.
Key	Algorithm and size, for example RSA 2048.
Last seen	How long ago NoCert observed this certificate anywhere. Turns amber past six days.
Expires	The expiry date.
Status	Expired, Today, or the number of days left.
Compliance	The verdict against your active policies, and a count of actionable findings.
SANs	How many subject alternative names it carries.

Chips beside the name mark what is worth knowing at a glance: CA, Self-signed, Muted, a count of warnings, and Unexpected issuer when the issuer is not authorized by the domain’s CAA policy. A retired certificate carries a · Retired caption instead of a chip.

Searching

The search box matches a substring, case-insensitively, against the subject, the issuer, the SANs, the serial number and the fingerprint.

Two of those will disappoint you if you paste from elsewhere:

• Serial numbers are displayed and matched in decimal. Your CA’s portal, a browser and openssl all show hex. Converting is the only way to search by serial.
• Fingerprints are matched with their colons. Case does not matter, but the unseparated hash sha256sum gives you will not match.

Searching by a name carried in the certificate’s common name or SANs is the reliable path. The hostname an endpoint was observed serving is not part of this box: search for that from Endpoints, where a certificate serving a name absent from its own SANs is still findable.

Filters

Behind the Filters button: certificate type, expiry status, alert status, and a list of certificate warnings you can combine. Compliance filters appear on Business.

Some filters are only reachable by following a link from elsewhere, such as the certificates covered by one notification rule, or those seen on one endpoint. They show as removable chips when active, and you cannot re-apply them by hand once removed.

Warnings

A warning is something about the certificate itself: a weak key, a deprecated signature algorithm, an invalid validity window, an extension NoCert will not silently ignore.

The numeric chip counts the ones worth acting on. Self-signed is deliberately left out of that count, since it is a fact about the certificate rather than a defect, and it stays available as a filter.

There is no warning for using RSA or elliptic-curve keys. That is true of essentially every certificate in existence today and is not actionable. See Post-quantum readiness for the part of that problem you can act on.

A certificate’s detail page

The endpoints it was seen on, with the last observation for each. Any file paths a Sentinel found it at, and any Kubernetes secrets holding it. The chain as observed, which is also where you download the certificate in PEM or DER form and where you can read the full openssl x509 -text output.

Very large deployments are truncated: the endpoint list stops counting past a hundred observations.

Muting

Muting silences expiry alerts for one certificate, indefinitely, and changes nothing else: it stays in your lists, your counts and your compliance results. Open the actions menu on the row, or use the bell icon in the detail header. Operators and owners only.

Notification rules covers the other reasons a certificate may never alert.

Excluding a certificate

Excluding goes further than muting, and it is the one action here that changes your bill. An excluded certificate leaves your lists, your counts, your compliance score, your alerting and the billable active count. You pick a reason when you exclude: not ours, decommissioned, test system, or other.

It is reversible from the Excluded tab, and it is operators and owners only.

Uploading a certificate

Operators can upload a certificate to inspect it, with Add Certificate. The dialog takes .pem, .crt, .cer, .der, .p7b and .p7c, several files at a time.

An uploaded certificate is parsed and stored, and that is all. It is not scanned, no endpoint is created for it, and it never counts toward your billable active certificates unless NoCert later observes it deployed somewhere.