Ternary Administration: Self-Service PEM Certificate Management

Self-Service PEM Certificate Management allows Ternary administrators to renew expiring certificates directly within the platform. This removes dependency on support or engineering teams while improving security, operational control, and integration reliability. Certificate lifecycle status, expiry warnings, and regeneration actions are handled entirely through the Ternary UI.

What does self-service PEM certificate management enable?

This feature allows administrators to manage certificate lifecycles without external intervention. Capabilities include:

Regenerating PEM certificates directly from the platform with a single action
Viewing certificate health using clear status indicators: Active, Expiring Soon, or Expired
Securely downloading regenerated certificates after renewal
Receiving in-app expiry warnings to prevent integration failures

For MSP environments, Partner Admins review the certificate for the active child tenant in Admin → Tenant.

Why is this feature important?

Previously, certificate management introduced operational risk due to limited visibility and manual renewal processes. Self-service management resolves these issues by making certificate status and actions explicit and auditable.

Key improvements include visibility into the active tenant’s certificate expiry, one-click regeneration, proactive expiry reminders, secure distribution of renewed certificates, and full traceability of regeneration events.

Challenge (Before)	Improvement (Now)
Certificates expired every ~3 years with no visibility	Active tenant certificate expiry tracking
Regeneration was not self-serve	One-click regeneration in Ternary
Past incidents caused downtime	Informative reminders at 90/60/30 days
Certificate distribution was manual and error-prone	Download the stored PEM from Admin → Tenant
No traceability of regeneration actions	Audit log entries with user, timestamp, IP

What certificate information is available in Admin?

In Admin → Tenant, download the tenant's stored client certificate as a PEM file. When expiry metadata is available, an expiry badge shows whether the certificate is valid, expiring soon or expired. This is the active tenant's certificate, rather than a list of integration-specific certificates.

Certificates enter the Expiring soon state when at most 90 days remain before expiry. Warning severity increases at 60 and 30 days; expired certificates have a separate status.

How does self-service certificate regeneration work?

Certificate renewal follows a controlled, explicit workflow:

In Admin → Tenant, select the certificate expiry badge to open renewal confirmation. Renewal is available when the certificate is expired or has at most 90 days remaining.
Review the confirmation message indicating the current certificate will be revoked and replaced.
Confirm the action to generate a new certificate.
Download the regenerated PEM and update dependent integrations as required.

If renewal reports an error, do not assume that the previous certificate still works. A failed renewal can leave credential changes in place. Recheck the tenant's current certificate state and the integrations that use it before retrying or treating the integration as operational.

All regeneration actions are logged for audit purposes.

How are certificate expiry reminders handled?

Ternary surfaces certificate expiry status directly within the UI for certificate owners and Tenant Admins. Notifications follow a fixed schedule:

90 days before expiry: Informational reminder
60 days before expiry: Renewal reminder
30 days before expiry: Critical warning; the certificate is already in the Expiring soon state.
After expiry: Certificate marked Expired; regeneration strongly recommended

Expiry notifications are displayed in-app only.