Certificate Cleaning

[AlbanUCA63]

Hello everyone,

We are setting up "child" certificates to restrict access to certain websites for our colleagues.
In my certificate list (ACL -> "View"), I see certificates that I no longer need.
So I go to /var/www/wapt/ssl to delete these certificates.
For now, it seems to be all correct (to be confirmed).

However, I still have quite a few unnecessary certificates visible in my list that I can't find in /var/www/wapt/ssl. I
can't figure out where they are to make the list look clean with only my new certificates (and those already in use).

Does the console retrieve this list only from the server?
Or does it get information from elsewhere?

Thank you for your answers.

Alban

PS: We are using Wapt 2.1 Enterprise on Ubuntu, console under Windows Server 2019.

[htouvet]

Hello,
The certificates displayed in the certificate grid of the ACL window are
: - all those present in the packages of the repository
- plus those present in the directory designated by the 'known_certificates_folder' key of the waptserver.ini file (by default /var/www/ssl)
- plus those possibly associated with console users by the "Associate a certificate with the user" function

[AlbanUCA63]

Hi Hubert,

Thanks for your reply, however, I do have certificates displayed that are:
- neither present in the repository (these certificates weren't deployed via a package back then)
- nor in /var/www/ssl (the default directory is)
- nor associated with a user.

Could it be, for the repository, a package signed by an "old" certificate?

PS: And could an "old" certificate lingering on an agent appear in this list?

Alban

[htouvet]

Yes, that's the purpose of
all the certificates present in the repository packages

. In each package, there's the certificate of the user who signed the package.
During the "scanpackages" operation, these certificates are extracted and collected in the index "/var/www/wapt/Packages".
This index is a Zip file.
If you download it (https://myserver/wapt/Packages) and open it with 7-Zip, you'll see a /ssl directory inside with all the found certificates named with their SHA256 fingerprints.