The Certificate Operations dashboard treats each X.509 certificate as an operational asset. It combines algorithm-readiness analysis with certificate hygiene and lifecycle management so teams can plan PQC migration while addressing immediate renewal and key-strength risks.
The dashboard combines certificates discovered on disk with certificates presented during live TLS handshakes. This helps distinguish installed certificate material from certificates known to be actively used.
Operational guidance: The detailed inventory is sorted by earliest expiration. Review the first records as the immediate renewal queue, then apply source, issuer, algorithm, or tier filters to segment the broader certificate population.
Panels
| Panel | Type | What It Shows |
|---|---|---|
| Navigation Links Bar | Links | Provides access to related Quantum Command application, inventory, and key-material views. |
| Inventory Header | Vega banner | Summarizes the total certificate population and key inventory metrics. |
| Certificate Quantum Tier | Vega chart | Groups certificate-signature algorithms into PQC READY, MODERN, CLASSICAL, and LEGACY tiers. |
| Certificate Hygiene | Vega scorecard | Shows expired and expiring certificates, undersized keys, and self-signed certificate counts. |
| Top Issuing CAs | Vega chart | Ranks certificate authorities by certificate count to expose issuer dependencies. |
| Key Algorithm Distribution | Vega chart | Shows RSA, ECDSA, Ed25519, ML-DSA, and other public-key algorithm usage. |
| Key Size Distribution | Vega histogram | Shows key sizes and makes undersized RSA or other keys visible. |
| Signature Algorithm Distribution | Vega chart | Shows the algorithms used to sign certificates, including legacy MD5 or SHA-1 signatures. |
| Certificate Longevity | Vega chart | Groups lifetimes into automated, short-term, medium-term, long-term, and legacy duration buckets. |
| Certificate Source Type | Vega chart | Compares FILE discoveries from disk scans with PORT discoveries from live TLS captures. |
| Certificate Inventory Detail | Paginated Discover panel | Lists per-certificate records sorted by earliest expiration for operational follow-up. |
Key Data Fields
| Field | Description |
|---|---|
| x509.not_after / x509.validity.not_after | Certificate expiration used for lifecycle analysis and default sort order. |
| x509.public_key_algorithm / x509.public_key_size | Public-key algorithm and size used to assess strength and PQC migration needs. |
| x509.sig_algorithm | Algorithm used to sign the certificate. |
| x509.subject.* / x509.issuer.* | Certificate identity and issuing authority information. |
| omb.sig_tier | Certificate-signature readiness tier. |
| Source type | FILE identifies disk discovery; PORT identifies a certificate captured from a live TLS service. |
Reading the Dashboard
Address hygiene first
Expired, soon-to-expire, self-signed, and undersized-key findings may require action before longer-term PQC migration work.
Assess issuer concentration
A dominant issuing CA can simplify migration planning, but it also represents a dependency with broad operational impact.
Compare algorithm and size
An adequate key size does not make a classical algorithm quantum-resistant; use the key and signature panels together.
Compare FILE and PORT coverage
A FILE-only certificate may be installed but inactive, while a PORT record confirms that a certificate was presented by a live service.
Filtering and Performance
The dashboard opens with a default time range of Last 1 year. Global Elasticsearch dashboard filters apply to the panels unless a panel description states otherwise. Preserve relevant filters when navigating between related dashboards so the investigation remains scoped to the same application, host, tier, or certificate population.