Skip to content

PKI Change Requests

PKI Change Requests provide a controlled way to add and modify CA product operations, and to modify, delete, or change the state of certificate profiles. All changes require approval before they take effect.

Why Change Requests?

Certificate profiles may be shared across multiple products. Direct modifications could have unintended side effects. The change request workflow ensures:

  • Changes are reviewed before being applied
  • An audit trail of all modifications
  • Protection against accidental changes

Change Types

Add Operation

Adds a new operation to an existing CA product. The operation creates the key material it needs. When creating an add-operation request:

  1. Select the target CA product
  2. Enter a name and description for the new operation
  3. Select the profile the operation issues certificates against
  4. Define the approval rule (allowed groups, approval groups, blanket groups)
  5. Submit for approval

Only IssueCertificate can be added

IssueCertificate is the only operation type that can be added through a PKI change request, so the operation type is not shown as a choice in the GUI. A profile is mandatory. Unlike product operations, PKI operations do not carry a token.

Modify Operation

Modifies an existing operation on a CA product. When creating a modify-operation request:

  1. Select the target CA product
  2. Select the operation to modify
  3. Update the name, description, profile, and approval rule
  4. Submit for approval

Operation type and token are fixed

The operation type and token of an existing operation cannot be changed. They are carried over unchanged and are therefore not shown in the GUI.

Modify Profile

Allows modifying the fields of an existing profile. When creating a modify request:

  1. Select the target profile from the list
  2. The current profile fields are loaded for editing
  3. Modify the desired fields (DN, algorithms, validity, key usage, etc.)
  4. Submit for approval

Note

Only profiles in Ready state are available for modification. Profiles in other states are filtered out.

Set Profile to Be Deleted

Marks a profile for deletion. This changes the profile state to ToBeDeleted.

  • Only profiles in Ready state that are not used by any product are shown
  • The profile is not immediately deleted; it is marked for deletion
  • A separate delete action can permanently remove profiles in ToBeDeleted state

Warning

Deleting a profile is irreversible. Ensure the profile is no longer needed before proceeding.

Set Profile to Ready

Restores a profile to Ready state from ToBeDeleted state.

  • Only profiles currently in ToBeDeleted state are shown
  • This effectively cancels a pending deletion

Approval Flow

  1. Create - User creates a change request and submits it for approval
  2. Review - An approver reviews the requested changes
  3. Approve/Reject - The approver can approve or reject the request
  4. Applied - Approved changes are automatically applied to the profile

Fields

Field Description
Name A descriptive name for the change request
Description Optional details about why the change is needed
Change Type The type of change (Add Operation, Modify Operation, Modify Profile, Set Profile To Be Deleted, Set Profile To Ready)
Profile The target profile to be changed (profile change types)
CA Product The target CA product (Add Operation and Modify Operation)
Operation The target operation (Modify Operation only)

For the full PKI documentation, see the Certificate Management Guide.