Platform credentials¶

A platform credential is an appliance login - a username and password, or an API token - that you store once in CertIntel and name in a dashboard assignment of an appliance template (F5 BIG-IP, FortiGate, PAN-OS, NetScaler ADC, SonicWall). The Agent fetches it when that workflow deploys a renewed certificate, sealed to a key only that Agent holds, and uses it for one deployment step. It needs Agent 1.5.0 or later and a platform build that offers the feature.

The alternative is a local credential, which never leaves the device: a local administrator sets it on the Agent with certintel secret set remote WORKFLOW-ID:credential. A workflow created on the device always uses a local credential; only a workflow that a dashboard assignment created can use a platform credential.

The Platform Credentials page¶

Open Settings → Platform Credentials (/platform-credentials). Add a platform credential takes:

Field	Meaning
Organization	The organization whose Agents may receive it.
Name	Up to 120 characters, one line, unique in the organization (The organization already has a credential with that name.), for example `FortiGate fw01 API token`.
Kind	Username and password or API token. Must match the template's credential field: F5 BIG-IP, NetScaler ADC and SonicWall log in with a username and password, FortiGate and PAN-OS with an API token.
Description (optional)	Up to 500 characters, one line.
Username / Password	For a username and password: up to 256 and 1024 characters.
API token	For an API token: up to 4096 characters.

Add credential saves it. An organization can hold at most 200 platform credentials. The table lists each credential's Organization, Credential (its name, with the reference platform:<id> below it), Kind, the number of Assignments that name it, Last delivered, Secret replaced and Created.

Secrets are write-only

Secrets are write-only: they are never shown again, not even to administrators. Replacing a secret takes effect at the next run. Every delivery and refusal is in the Activity Log. The tenant export leaves them out, and no API response, log or activity entry contains them.

Edit changes the Name and Description, and replaces the secret with New username / New password or New API token. Leave the secret fields empty to keep the stored secret. A replaced secret is used from the next remote run on.

Delete asks Delete the platform credential ? assignment(s) name it; their remote runs fail until they name another credential. Deleted credentials are never delivered again.

Permissions¶

Permission	Lets you	Built-in roles
`platform_credentials.read`	See the page and the credentials' names and metadata; name a credential in an assignment (in that organization)	Operator, Auditor, Administrator
`platform_credentials.create`	Add credentials	Administrator
`platform_credentials.update`	Rename credentials, replace their secret, and approve an Agent's new sealing key	Administrator
`platform_credentials.delete`	Remove credentials	Administrator

Tenant administrators hold all four. Custom roles can grant Platform credentials action by action (see permissions). Without read in the Agent's organization, an assignment that names a platform credential is refused (Your role cannot use the organization's platform credentials.).

Using one in an assignment¶

When you assign an appliance template, its credential field offers Local secret on the device and Platform credential: for each credential of the matching kind in the Agent's organization. The assignment stores only the reference (local or platform:<id>), never the secret. The card shows (platform credential).

If the Agent does not take platform credentials, the field says This agent does not take platform credentials: set it on the device with certintel secret set remote :. With Local, the run fails with credential not set: certintel secret set remote : until a local administrator sets the value.

When the Agent receives it¶

CertIntel delivers a platform credential only when all of these hold:

The Agent reports platform credential support (Agent 1.5.0 and later) and its local opt-in is on. A local administrator turns it on on the device (see remote deployment); CertIntel cannot turn it on. The host detail page shows it.
The Agent's configuration lock is off. A locked Agent never asks for one.
The workflow was created by an assignment, and that assignment - of the same Agent key - is applying or applied and names this credential.
The Agent asks with its approved sealing key (below).

Each delivery is sealed (HPKE, X25519) to the Agent's sealing key and bound to the organization, assignment, credential and delivery, and it is valid for 5 minutes. The Agent opens it in memory for one deployment step, never writes it to disk, logs, reports or its state, and clears it from its own buffers afterwards. An Agent can ask for at most 30 deliveries a minute.

Sealing keys¶

The Agent creates its sealing key when its local opt-in is turned on. CertIntel trusts the first key it reports, and pins it. Open the Agent's host detail page (Agents → Details) to see the Platform credentials section:

Local opt-in: accepts platform credentials or off (set only on the device).
Sealing key , pinned (first seen ).

When the Agent reports a different key - it re-enrolled, or a local administrator rotated the key with certintel secret rotate-sealing-key - the section shows New sealing key waiting for approval: The agent reported a different key (it re-enrolled, or a local administrator rotated the key). Platform credentials are not delivered until it is approved. Approve only if you expect the change: anyone holding this agent's API key could report a key of their own. Approve new key (platform_credentials.update) approves it; deliveries then use the new key.

Approve only key changes you expect

The first key an Agent reports is trusted on first use. Approving an unexpected key change could send credentials to whoever holds that Agent's API key. Someone who has both the Agent's API key and its protected secret store can also open deliveries, so treat both as secrets.

Refusals¶

Answer	Meaning
`403` `remote-credentials-off`	This agent does not accept platform credentials: it does not report platform-credentials, or its local remote_credentials opt-in is off.
`409` `sealing-key-unapproved`	This agent's sealing key is not approved: an administrator approves a new key on the agent's page first.
`409` `sealing-key-mismatch`	The request names a sealing key other than the pinned one.
`404`	The key is unregistered, the credential is unknown or deleted, or no applying or applied assignment of this Agent names it.
`429`	Too many credential deliveries for this agent; try again in a minute.

The Agent records each fetch and refusal in its own activity log (remote-credential-fetched, remote-credential-refused), and the deployment step fails with the reason.

Activity Log¶

Action	Message
`platform_credential.create`, `.update`, `.delete`	A platform credential was created, updated or deleted.
`platform_credential.rotate`	replaced the secret of the platform credential .
`platform_credential.delivered`	The platform credential was sealed to the agent for assignment and delivered.
`platform_credential.delivery_refused`	A delivery of the platform credential to the agent was refused ().
`agent.sealing_key_pinned`	The agent reported its sealing key ; it is pinned for platform credentials.
`agent.sealing_key_changed`	The agent reported a different sealing key ; platform credentials wait until it is approved.
`agent.sealing_key_approved`	approved the new sealing key of the agent .

API¶

Route	Permission
`GET /api/v1/platform-credentials`, `GET /api/v1/platform-credentials/{id}`	`platform_credentials.read` - metadata only, never a secret
`POST /api/v1/platform-credentials` (`organization`, `name`, `kind`, `description`, `username`, `password` or `token`) → `201`	`platform_credentials.create`
`PATCH /api/v1/platform-credentials/{id}` (a new secret sets `rotated_at`)	`platform_credentials.update`
`DELETE /api/v1/platform-credentials/{id}` → `204`	`platform_credentials.delete`
`POST /api/v1/agents/{api_key_id}/sealing-key/approve` → `204`	`platform_credentials.update`