How to Configure Certificate Management

Overview:

Why certificates need a policy, not a manual fix

An expired root certificate, a revoked authority, or a certificate that never got installed can quietly break authentication, encryption, or trust chains across endpoints. Fixing it by hand on one machine is easy; proving the same certificate was removed or installed consistently across every affected endpoint, and confirming it actually worked, is not.

Certificate Management covers that path: a Certificate Policy defines an install or delete action against a chosen certificate store, and a Policy Deployment pushes that policy to a scope of endpoints. Like other automation modules, defining a policy changes nothing by itself; nothing happens until it's deployed, and every deployment breaks down into a per-endpoint task with its own status and execution log.

This guide walks the full workflow end to end: opening Certificate Management, reviewing an endpoint's existing certificate inventory, creating a Delete policy for a specific certificate, publishing a deployment, and confirming from the task output that the certificate was actually removed.

• Install or Delete, your choice: Operation supports Install (upload a certificate file) or Delete (remove matching certificates), so both directions of certificate management fit the same policy type.
• Delete Specific targets one certificate: within a Delete policy, the Action field can target a Common Name and, optionally, an exact Serial Number, so only the intended certificate is affected rather than everything in the store.
• Certificate Store is multi-select: a policy can target one or more stores, such as Trusted Root Certificate Authorities, Personal, or Trusted Publisher, in a single definition.
• Per-endpoint certificate inventory: each endpoint's Certificates tab lists every certificate found on it, filterable by All, Not Expired, or Expired, with issuer, validity window, and signing details.
• Full execution log per task: the task output reports exactly how many certificates were found and deleted (or installed) and the final status, not just a single pass or fail flag.

Prerequisites

Confirm these before deploying a certificate policy. An unconfirmed Common Name or Certificate Store is the most common reason a deployment reports success while the wrong certificate, or no certificate, actually changes.

1. Administrator access: your account holds a role permitted to manage the Device Control -> Certificate Management module.
2. Agent installed and reporting: the endpoint agent is installed, registered, and reporting healthy on every target device.
3. Certificate identified: for a Delete policy, confirm the exact Common Name (and Serial Number, if targeting one specific certificate) before saving the policy. For an Install policy, have the certificate file (cer, crt, p12, or pfx) and its password, if any, ready.
4. Endpoint scope identified: know which specific endpoints this policy should be deployed to before publishing the deployment.

Architecture: how a certificate policy reaches an endpoint

A Certificate Policy defines the change itself. A Policy Deployment binds that policy to a scope of endpoints. The endpoint agent applies the install or delete action and reports back a per-task status and log.

Step 1: Open Certificate Management

Get oriented before creating a policy, so you know where policies, deployments, and per-endpoint certificate data each live.

Instructions

1. From the main console, go to Device Control in the left sidebar.
2. Under Data Protection, select Certificate Management.
3. Note the two sections in the left panel: Certificate Policies and Policy Deployments.

Path: Console / Device Control / Certificate Management

Result: You're in the Certificate Management module with visibility into existing policies and deployments before creating anything new.

Step 2: Review the endpoint's current certificate inventory

Confirm the certificate you plan to target actually exists on the endpoint, and note its current status, before writing a policy against it.

Instructions

1. From Inventory -> Endpoints, open the target endpoint.
2. Select the Certificates tab.
3. Use the All, Not Expired, or Expired filters to narrow the list.
4. Review the Common Name, Status, Issuer, Not Valid Before/After, Signing Algorithm, Key Algorithm, CA, and Self Signed columns for the certificate in question.

Path: Console / Inventory / Endpoints / <ENDPOINT-HOSTNAME> / Certificates

Console: certificate inventory (example)

Result: You've confirmed the certificate exists on the endpoint and captured its exact Common Name, ready to reference when building the policy.

Step 3: Create a Certificate Policy

Define the install or delete action once, so it can be applied consistently to any number of endpoints.

Instructions

1. Go to Certificate Policies -> Create.
2. Enter a Policy Name describing the action, e.g. Delete Microsoft Root Certificate Authority.
3. Optionally enter a Description.
4. Set Configuration Level to Computer or User.
5. Optionally toggle Apply On Startup.
6. Under Certificate Settings, set Operation to Install or Delete.
7. Select one or more entries in Certificate Store, e.g. Trusted Root Certificate Authorities.
8. For Install: select Certificate File (cer, crt, p12, or pfx, max 1) and enter a Password if the file requires one.
9. For Delete: set Action to Delete Specific, then enter the Common Name and, optionally, the Serial Number of the exact certificate to remove.
10. Select Create.

Path: Console / Device Control / Certificate Management / Certificate Policies / Create

Console: policy definition (example)

Result: The policy appears in the Certificate Policies list with its Configuration Level, Operation, and Certificate Store(s) visible. Like other catalog-based modules, a policy has no effect until targeted by a deployment.

Step 4: Publish a Policy Deployment to endpoints

Bind the certificate policy to a scope of endpoints so the change is actually applied, rather than just defined.

Instructions

1. Go to Policy Deployments -> Create.
2. Confirm or edit the Deployment Name (it defaults to the policy name).
3. Add an optional Description.
4. Set Scope to Specific Endpoints (or another available scope) and select the target Endpoints.
5. Under Select Certificate Policy, choose the policy created in Step 3.
6. Set Deployment Policy, e.g. OOB Instant deployment policy (type Instant).
7. Optionally set Notify to for completion alerts.
8. Select Publish (or Save As Draft to finish later).

Path: Console / Device Control / Certificate Management / Policy Deployments / Create

Console: deployment definition

Result: A deployment task is created (e.g. ADR-280: Delete Microsoft Root Certificate Authority) with stage Initiated, moving through to Completed with progress 1/1, visible in the Policy Deployments list alongside prior deployments.

Step 5: Confirm the deployment with per-endpoint task status and output

Verify the certificate was actually installed or removed, rather than assuming from the deployment stage alone.

Instructions

1. Go to Policy Deployments to see every deployment with its Stage (Initiated, Completed), Progress, and Policy.
2. Select the view icon on a deployment row to open its Tasks panel, showing Endpoint, Name, Status, and Last Updated.
3. Confirm the Status shows Success for the target endpoint.
4. Select the task row to open its Output view and review the execution log.
5. Return to the endpoint's Certificates tab and confirm the certificate no longer appears (for a delete) or now appears (for an install), and that the All/Expired counts changed accordingly.

Path: Console / Device Control / Certificate Management / Policy Deployments / Tasks / Output

Console: task status

Result: Evidence-backed confirmation of exactly how many certificates were matched and removed, plus a drop in the endpoint's total and Expired certificate counts on the Certificates tab, not just a single Success flag for the whole deployment.

Best practices for certificate management

Troubleshooting: common issues and resolutions

Frequently asked questions