Organization Certificates
A certificate resource has a scope. A Workspace resource is available only in the workspace that owns it. An Organization resource is available in every workspace in your organization, so you manage one copy instead of one per workspace.
Resources that existed before this feature stay in their workspace. Promote one to the organization when you need it in more than one workspace.
Where organization and workspace certificates appear
Both kinds appear in one list on the same page. Select Settings > Workspace > Keys & Certs. The list shows the organization's resources plus the resources of the workspace you have selected. Switching workspace changes which workspace resources you see; the organization resources stay.
The Scope column marks each row Workspace or Organization. The page header reads "Manage resources and attached certificates. Organization resources are shared by every workspace."
Who can do what
| Action | Workspace resource | Organization resource |
|---|---|---|
| See it in the list | Any member | Any member |
| View key details (algorithm, fingerprint, expiry) | Any member | Admins only. Other members see the name, type and description. |
| Create, edit, add or delete a certificate, activate or deactivate | Same as before this release | Admins only |
| Promote | Admins only | Not applicable |
Here, an admin is a user whose role is Admin or Owner. If you are not an admin, Organization is greyed out in the Scope field, and the field shows "Only organization admins can create organization-level resources." Organization rows you cannot change show no edit, delete or promote actions.
Create an organization resource
- Select Settings > Workspace > Keys & Certs.
- Select Create Certificate Resource.
- Enter a Name.
- In Scope, select Organization.
- Enter a Description, and in Select Certificate Type choose PGP, SSL or SSH. For SSL, choose a Certificate subtype as well.
- Select Create Resource.
- Select Add Certificate and complete the certificate details, as for a workspace resource.
The scope is fixed once the resource is created. A name must be unique within its scope, ignoring case. A workspace resource and an organization resource may share a name.
Promote a workspace resource to the organization
Before you begin, you need the Admin or Owner role.
- Select Settings > Workspace > Keys & Certs.
- In the Action column of the resource, select the up-arrow icon (labelled "Promote resource name to organization"). The Promote to organization dialog opens. It says the resource "will become available to every workspace in the organization. This cannot be undone. Existing references keep working."
- Wait for the usage check to finish. The dialog lists every workspace, application and workflow that references the resource, or says "No workflows reference this certificate resource."
- Select Promote.
How you know it worked
A message reads resource name is now an organization resource, and the Scope column shows Organization. When you open the resource, the Scope field notes that it was promoted from the original workspace.
What promotion changes
- The resource and its certificates become visible in every workspace. It is no longer tied to the workspace it came from.
- The resource keeps its identity, so workflows that already use it keep working.
- Only admins can edit or delete it from then on.
Promotion cannot be undone from Studio. There is no demote action. The only way back is to create a new workspace resource and re-point the workflows that should use it.
When it does not work
If the promotion is refused, Studio shows the reason from the server and refreshes the list. Typical causes are a name already used by an organization resource, or a resource that is already organization-level. Rename one of the two resources and try again.
Use a certificate in a workflow
Certificate fields in an activity offer both scopes in one drop-down. Organization resources are labelled with "(Organization)". A workspace resource whose name matches another resource is labelled "(Workspace)", so no two entries look alike.
The field stores the specific resource you pick, not just its name. If a workspace resource and an organization resource share a name, the workflow keeps using the one you selected. Saving a name you typed by hand only resolves when exactly one resource has that name; otherwise pick from the list.
If the resource a workflow points to is later deleted, the field is flagged as invalid.
Delete or deactivate a shared certificate
Before you delete an organization resource or certificate, or deactivate one, admins see where it is used. The notice lists the workspace, application and workflow of each reference, or "Used by n references". If the check fails, the notice warns "Could not check where this certificate is used. Workflows in any workspace may still reference it." and the delete is not forced.
Deleting a certificate that workflows still use can break them, in any workspace.