Skip to main content

Account user permissions

The purpose of an account user is generally to perform cryptographic actions and sign.

There are two categories of account users. Below is a comparison between the users and service users:

User

Service user

Can access DigiCert​​®​​ Software Trust Manager UI?

Yes

No

Can use DigiCert​​®​​ Software Trust Manager clients?

Yes

Yes

Can perform cryptographic actions?

Yes

Yes

Can manage own credentials?

Yes

No

Who is this user?

A person

An alias and associated email for alerts. Generally used for automation of workflows on a machine such as a build server.

Nota

Only System users can onboard or provision accounts.

The following article outlines account user permissions which may be useful if you are creating a custom user role. Alternatively, refer to user roles for a list of preconfigured user roles that allow you to assign permission sets to new and existing users.

Sugerencia

The permission descriptions below assume that the Teams feature is not enabled on your account. If teams are enabled on your account, refer to Teams permissions for more information.

General permissions

Permission

Description

Manage account settings

User can update DigiCert​​®​​ Software Trust Manager > Accounts > Account settings.

Manage CertCentral API key

User can delete, disable, enable, setup, update and validate a CertCentral API key.

Manage all teams

User can:

  • Create new teams.

  • View, update, deactivate, delete, and map resources to all teams within the account, provided that they have relevant resource permissions.

Manage my teams

User can view, update, deactivate, and map resources to existing teams that they are part of, provided that they have relevant resource permissions.

View audit log

User can view audit and signature logs in the account.

Export audit logs

User can export audit and signature logs in the account.

Nota

View audit log is required as an additional permission to be able to export audit logs.

Certificate permissions

Permission

Description

View certificate

User can view certificate details for all certificates assigned to them.

Nota

Users with Manage keypair permission can view all certificates within the account.

Generate certificate

User can create a new certificate using keypairs that they are assigned to.

Nota

Users with Manage keypair permission can create a new certificate using any keypair within the account.

Import certificate

User can import certificates for keypairs that they are assigned to.

Nota

Users with Manage keypair permission can import a certificate to any keypair within the account.

Revoke certificate

User can revoke certificates associated with keypairs that they are assigned to.

Nota

Users with Manage keypair permission can revoke certificates associated to any keypair within the account.

Manage certificate hierarchy

User can view and create hierarchies. They can also activate and deactivate restricted hierarchies.

View certificate profile

User can view certificate profiles created by the user.

Manage certificate profiles

User can:

  • View, create, update, clone, enable, and disable certificate profiles that are created by the user.

  • View, update, and delete all certificates associated with a certificate profile that the user created.

View certificate template

User can view certificate template details in the account.

Keypair permissions

Permission

Description

View keypair

User can view keypairs and key rotations relying on keypairs assigned to them.

Nota

Users with Manage keypair permission can view all keypairs and key rotations within the account.

Generate keypair

User can create a new keypair.

Import keypair

User can import keypairs into the account.

Nota

To import a GPG secring, Manage master key is also required.

Request keypair export

User can request to export keypairs that they are assigned to.

Nota

Users with Manage keypair permission can request to export any keypair within the account.

Approve keypair export

User can approve requests to export keypairs that they are assigned to.

Nota

Users with Manage keypair permission can approve keypair exports for any keypair within the account.

Approve keypair delete

User can approve requests to delete keypairs that they are assigned to.

Nota

Users with Manage keypair permission can approve keypair delete for any keypair within the account.

Manage keypair

User can:

  • Update, suspend or unsuspend keypairs.

  • Create, update, enable, and disable keypair profiles.

  • Create and update user groups.

  • Create, update, and refresh key rotation.

  • Generate a CSR.

Sign

User can sign with keypairs assigned to them.

Manage master GPG key

User can:

  • Create GPG master key, provided that the user also has Generate keypair permission.

  • Import a GPG secring, provided that the user also has Import keypair permission.

  • Update, suspend, unsuspend master keys that they are assigned to.

    Nota

    Users with Manage keypair permission can update, suspend, unsuspend any master keys within the account.

  • Delete master keys assigned to them, provided that the user also has Approve keypair delete permission.

    Nota

    Users with Manage keypair permission can delete any master key within the account.

  • Revoke master keys assigned to them, provided that the user also has Revoke certificate permission.

    Nota

    Users with Manage keypair permission can revoke any master key within the account.

Release permissions

Permission

Description

View release

User can view all releases in the account.

Request release

User can create a release.

Approve release

User can create a release and approve and reject requests to create offline releases.

Threat detection

Permission

Description

View Threat detection

User can view all threat detection scans in the account.

Run Threat detection scans

User can run scans using Threat detection.

Manage threat detection

User can download threat detection reports and assign threat detection scans to projects.