Skip to main content

Hub Settings Overview

Target Instance​

At the top of the Settings UI, the Hub shows a Target Instance selector.

Many settings apply to the selected instance, not globally.

Before making changes, confirm whether you mean to edit:

  • the Hub's own integrated instance
  • a specific joined CCM instance
  • a specific joined Agent instance

Settings Areas​

The Hub UI exposes these main settings tabs:

  • Certificate Authorities
  • Stored Credentials
  • Maintenance Windows
  • Import & Export
  • General
  • Security
  • Licensing
  • Tags
  • Hub
  • System

Certificate Authorities​

Purpose:

  • add ACME accounts
  • review account registration details
  • prepare staging or production accounts on the selected instance
  • support CA failover and normal certificate ordering

See Certificate Authorities and stored credentials.

Stored Credentials​

Purpose:

  • create reusable credentials for DNS or other integrations
  • avoid repeating the same secret in many certificate definitions
  • centralize credential rotation per target instance

See Certificate Authorities and stored credentials.

Maintenance Windows​

Use this tab when certificate renewals must only run during approved time windows.

The live UI supports:

  • named maintenance windows
  • a default maintenance window
  • unrestricted renewals when no window is enforced

Use maintenance windows only where required. Narrow windows reduce renewal flexibility.

Import & Export​

Use this area when:

  • migrating certificate definitions from Certify Certificate Manager
  • importing an exported archive into a chosen target instance
  • previewing what will be imported before committing it

See Import, export, and migration.

General​

The General area groups settings such as:

  • preferences
  • external certificate managers
  • service config
  • certificate renewal settings
  • default private key type
  • automatic CA failover
  • preferred CA
  • ACME ARI behavior
  • strict ACME order identifiers (see Names in the CSR)
  • status reporting and telemetry
  • whether the instance can be changed locally (see Restricting local changes)

This tab controls default behavior for the selected instance.

Security​

Use Security to manage:

  • users
  • roles
  • API access
  • OIDC providers

This is the main Hub-wide access control area.

See Security and access.

Licensing​

Use Licensing to:

  • review license state
  • apply a new license key
  • manage product license activations
  • plan license use across managed instances

Tags​

Use Tags to define categories that help organize certificates, instances, and other resources.

The tag system supports category definitions and dynamic values, which makes tags useful for filtering and reporting.

Values in a category are created when an item is first tagged with them. To set up values in advance, expand the category and select Add Value, so the value can then be picked when tagging items.

Use tags for:

  • environment
  • application or service name
  • team ownership
  • customer or tenant grouping

Hub​

Use Hub for settings which apply to the hub as a whole. Its General tab covers:

  • whether tag-scoped principals may use untagged managed challenges
  • whether managed challenges enforce strict CNAME delegation (see Enforce strict CNAME delegation)
  • whether the hub may subscribe to its own managed certificates, so one certificate can have several subscriptions on the hub with deployment tasks split between them (see Certificate subscriptions)
  • whether joined instances must sign their joining checks (see Enforce signed joining checks)
  • how long activity and request history is kept

Enforce signed joining checks​

Every instance joins the hub with the same joining credentials, and an instance's ID is not secret. From 7.3.0, each instance also signs its joining check with its own key, so the hub can confirm which instance is connecting.

When Enforce Signed Joining Checks is enabled, the hub refuses a joining check from an instance that is not signed with its key. Instances before 7.3.0 do not sign it, so they cannot connect.

The setting is enabled on new hub installs. On a hub upgraded from an earlier version it is off, so existing instances keep connecting. Upgrade all instances to 7.3.0 or later, then enable it.

Enforce strict CNAME delegation​

When Enforce Strict CNAME Delegation is enabled, a managed challenge only writes the _acme-challenge TXT record for the identifier being validated, or the record that the managed challenge's own CNAME Delegation Rule points it to. This stops an instance or API client authorized for one name from writing TXT records for other names, including other delegated records in a shared delegation zone. See Managed Challenges: CNAME Delegation.

Disable it to allow CNAME delegation rules configured on instances, as before 7.3.0. The hub then writes whatever TXT record name the client sends, so any authorized client can write any TXT record that the managed challenge's DNS credentials can reach.

The setting is enabled by default, including on upgraded hubs.

The Managed ACME tab manages the hub's Managed ACME accounts.

System​

Use System for runtime and platform checks.

This tab shows:

  • Features: what major Hub features are enabled
  • Data Stores: the database the selected instance stores its configuration in
  • Status: Hub API, service config, platform, plugin, and datastore health information
  • Logs: service logs for the selected instance

Use this tab for checks such as:

  • is the Hub API healthy
  • what URLs are allocated
  • is the service in development mode
  • did plugins and datastore initialization complete correctly

See Data stores for configuring an external database, applying schema migrations, and migrating data between stores.

Administration Map​

Use this split when deciding where to make a change:

  • certificate issuance inputs: Certificate Authorities, Stored Credentials, General
  • scheduling and organization: Maintenance Windows, Tags
  • migration and bootstrap: Import & Export
  • access control: Security
  • licensing and runtime state: Licensing, System
  • activity history retention: Hub