Certificate management-Agent Trust Service-阿里云帮助中心

ATS manages a dual-certificate system for each Agent: an identity certificate and a server certificate. The certificate management page provides features to manage the entire certificate lifecycle, such as viewing, downloading, and renewing certificates, and configuring alerts.

View and download certificate

Log on to the ATS console.
In the left navigation pane, choose Certificate > Certificate Management.
On the Certificate Management page, view the followng types of certificates:
- Identity Certificate (Private CA): An agent identity certificate issued by the CNNIC Private Certificate Authority (CA), used for identity authentication.
- Server Certificate (Public CA / BYOC): A server certificate issued by a Public Certificate Authority (CA) or provided by the user (BYOC), used for server-side identity verification and encrypted communication.
Find the target certificate and click Details in the Actions column.

In the pop-up Identity Certificate Details or Server Certificate Details panel, view the comprehensive information of the certificate and download the PEM file.

Identity certificate

Field	Description
Agent ID	The agent identity generated by the ATS system.
Host	The FQDN to which the agent is bound.
Serial number	The serial number of the certificate.
Issuer	The issuing authority of the certificate (Aliyun ATI PCA G1).
Algorithm	The encryption algorithm used by the certificate.
Validity period	The validity period of the certificate (start date - end date).
Status	The current status of the certificate. Possible values include the following: Valid, Expiring soon, Expired, and Revoked. For details, see "Status description".
Subject	The subject information of the certificate.
SAN (URI)	The Subject Alternative Name (SAN) of the certificate.
PEM	The PEM file of the certificate. The following operations are available: ClickCopy Certificate to copy the PEM content to the clipboard. ClickDownload .pem to save the PEM content of the certificate as a PEM file to your local machine. The downloaded file is named: `identity-cert-{AgentId}.pem`.

Server certificate

Field	Description
Agent ID	The agent ID generated by the ATS system.
Host	The FQDN to which the agent is bound.
Serial number	The serial number of the certificate.
Issuer	The issuing authority of the certificate.
Algorithm	The encryption algorithm used by the certificate.
Validity period	The validity period of the certificate (start date - end date).
Source	The source of the certificate. `CA` indicates a certificate issued by a public CA. `BYOC` indicates a user-provided certificate.
Status	The current status of the certificate. Possible values include the following: Valid, Expiring soon, Expired, and Revoked. For more information, see "Status description".
Subject	The subject information of the certificate.
SAN (dNSName)	The Subject Alternative Name (SAN) of the certificate.
TLSA fingerprint	The TLSA record fingerprint of the certificate, used for DNS-based Authentication of Named Entities (DANE) validation.
PEM	The PEM file of the certificate. Perform the following operations: Click Copy Certificate to copy the PEM content to the clipboard. Click Download .pem to save the certificate's PEM content as a local PEM file. The downloaded file is named: `server-cert-{AgentId}.pem`.

You can also find the certificate on the list, and click Download in the Actions column to download its PEM file.

Certificate status and alerts

Status descriptions

Status	Description	Impact
Active	The certificate is valid and can be used.	Agent authentication works correctly.
Expiring soon	The certificate expires in 30 days or less. Prepare to renew it.	Authentication is not affected, but it will fail after the certificate expires.
Expired	The certificate has expired and cannot be used.	An expired identity certificate causes mTLS authentication to fail. An expired server certificate causes HTTPS authentication to fail.
Revoked	The certificate is revoked and no longer trusted.	The certificate cannot be recovered. You must re-register the Agent.

Expiration alerts

You can configure expiration alerts to receive notifications when a certificate is about to expire, has expired, or is revoked. This helps you stay aware of status changes and take action promptly.

Alert frequency: Alerts are sent 30, 14, 7, 3, and 1 day before a certificate expires. This is based on the default system rule and cannot be customized. For expired certificates, an alert is sent once a day for seven consecutive days.

Log on to the ATS console.
In the navigation pane on the left, choose Certificate > Certificate Management.
On the Certificate Management page, click Alerting Settings in the upper-right corner.
In the Certificate Expiration Alert Settings panel, configure the following settings:
a. Alert Group: Select the contact groups to receive alert notifications. You can select up to five groups.
Note
The available options are from the alert contact groups in Cloud Monitor. If no contact groups are available, go to the Cloud Monitor console to create an alert contact group.
b. Notification Methods: Select the notification channels for each event type as needed.
- Event type:
  The available event types are Identity certificate expiring soon, Server certificate expiring soon, Certificate expired, and Certificate revoked.
- Notification channel:
  - Email: Sends alert notifications by email.
  - Robot: Sends alert notifications through DingTalk, WeCom, Lark, or a custom webhook.
  - Text message: Sends alert notifications by text message.
Click OK to save the alert configuration.