Configure the self-service portal
Self-service portal settings are available from the Account > Settings > Self-service portal page in DigiCert® Trust Lifecycle Manager.
Enable self-service portal access
Follow these steps to enable the open portal, authenticated portal, or both.
Before you begin
The Trust Lifecycle Manager Self-service portal feature must be enabled for your account. For help verifying or enabling this feature, contact your DigiCert account representative.
To configure the self-service portal settings, you need the SSP Manager user role for Trust Lifecycle Manager or a custom user role that includes the
SSP Portal configpermission. To learn more, see Users and access.
From the Trust Lifecycle Manager main menu, select Account > Settings > Self-service portal.
If the self-service portal has not previously been enabled for your account, you see a basic overview page about this feature. Select the Start configuring button to proceed with configuring the self-service portal.
If one of the portals was previously enabled, you see the details page instead. Select the edit (pencil) icon to update the configuration.
In the Open portal tab, make sure the Enable open portal option is selected.
Under Discovery/Imported certificates, select whether to include visibility of certificates that were discovered or imported into Trust Lifecycle Manager. If you enable this option, also select whether to allow end users to request revocation of these certificates from the open portal.
Under Portal-enabled certificate profiles, select View and edit certificate profiles to access the Portal-enabled certificate profiles side panel.
The side panel lists certificate profiles whose certificates are available in the authenticated portal and allows you to update the allowed operations for each profile.
You can use the Filter option to narrow down the list of certificate profiles based on specific criteria.
The Allowed operations column shows which operations are allowed for each certificate profile from the open portal. You can manage the allowed operations from either the self-service portal settings or the profile configuration wizard.
Use the edit (pencil) icon to update the allowed operations for certificates issued from a particular profile. To allow end users to request revocation of certificates from the open portal, enable the Revocation operation for that certificate profile.
You can use the Filter option to narrow down the list of certificate profiles based on specific criteria.
To close the side panel, select the close (X) icon or click outside the panel.
Select the Save button at the bottom of the screen to save your changes.
On the details page, copy the Portal URL or QR code, or both, for the open portal. Share them with end users so they can access the open portal with the options you configured.
From the Trust Lifecycle Manager main menu, select Account > Settings > Self-service portal.
If the self-service portal has not previously been enabled for your account, you see a basic overview page about this feature. Select the Start configuring button to proceed with configuring the self-service portal.
If one of the portals was previously enabled, you see the details page instead. Select the edit (pencil) icon to update the configuration.
In the Authenticated portal tab, make sure the Enable authenticated portal option is selected.
Under the Authentication method section, select the method used to authenticate access to the portal:
Trust Lifecycle Manager SSO (SAML): Select this option to authenticate through the SAML IdP configured for the authenticated portal in Trust Lifecycle Manager.
Platform SSO (SAML/OIDC): Select this option to authenticate through the SAML or OIDC IdP configured in DigiCert account or Account Manager. If SAML or OIDC is already configured for authentication, you can use the same configuration to authenticate access to the portal. If both SAML and OIDC are configured, OIDC is used for authentication.
Nota
Profiles using the
DigiCert ONE Login (OIDC/SAML)authentication method support attribute-based access control. Access is limited to requesters whose OIDC claims or SAML attributes meet the configured key-value conditions. Administrators may also require manual approval before issuing certificates for authenticated requests. For more information, see Configure a profile to authenticate requests via OIDC or SAML using DigiCert ONE login.
If you selected Trust Lifecycle Manager SSO (SAML) as the authentication method, configure your SAML IdP under SAML authentication. This allows end users to authenticate when accessing the self-service portal.
Select View Identity provider (IdP) configuration to access the Identity provider (IdP) configuration side panel. Select one of the following configuration methods:
Dynamic configuration (recommended): Download the XML metadata file from your SAML IdP and use it to dynamically configure the self-service portal by uploading the XML file into the designated area, verifying the parsed values, and making changes if needed.
Manual configuration: Manually enter the IdP parameters including the single sign-on authentication URL,
Issuerfield identifier, and IdP certificate.
Signing options: Select the types of SAML messages Trust Lifecycle Manager should sign its own certificate when communicating with the SAML IdP.
Aviso
Trust Lifecycle Manager acts as the SAML service provider (SP) when authenticating Self-service portal users. Refer to your IdP's documentation to determine which signing options your IdP supports and expects from the SP.
After entering the IdP configuration details, select Save to save the configuration and close the side panel.
Discovery/Imported certificates: Select whether to include visibility of certificates that were discovered or imported into Trust Lifecycle Manager. If you enable this option, also select which self-service operations users are allowed to perform on these certificates from the authenticated portal.
Manage tab visibility: Select which of the following tabs or sections to display in the authenticated portal:
Certificate requests: Allows end users to enroll new certificates from profiles enabled for self-service access.
Manage requests: Allows end users to manage enrollments and download new certificates requested through the Self-service portal.
Aviso
You can safely disable these tabs if none of your certificate profiles have the Enable self-service portal option enabled, or if you want to prevent users from enrolling new certificates from the self-service portal.
Under Portal-enabled certificate profiles, select View and edit certificate profiles to access the side panel.
The side panel lists certificate profiles whose certificates are available in the authenticated portal and allows you to update the allowed operations for each profile.
You can use the Filter option to narrow down the list of certificate profiles based on specific criteria.
The Allowed operations column shows which operations are allowed for each certificate profile from the authenticated portal. You can manage the allowed operations from either the self-service portal settings or the profile configuration wizard.
Use the edit (pencil) icon to update the allowed operations for certificates issued from a particular profile.
The Attributes column allows you to define one or more SAML attributes for profiles that use
Manual ApprovalorSAML IdPauthentication. These attributes determine which profiles users can view when initiating the certificate enrollment process on the Certificate requests page of the Self-Service Portal. If multiple attribute values are defined, they are evaluated using OR conditions. The key–value pairs defined in the Self-service portal against a profile must match the corresponding attribute key–value pairs received in the SAML response from the Identity Provider (IdP). This mapping ensures that users can access only those profiles that correspond to their SAML attributes.
To close the side panel, select the close (X) icon or click outside the panel.
Select the Save button at the bottom of the screen to save your changes.
On the details page, copy the Portal URL or QR code, or both, for the authenticated portal. Share them with end users so they can access the portal with the options you configured.
Configure a customizable landing page for the open and authenticated self-service portals. Add information panels with custom content and resources. You can preview the landing page before making it available to end users.
The landing page inherits the branding configured under Account > Settings > Branding, including custom logos, themes, fonts, and background images. For more information, see Branding.
To enable the customizable landing page:
From the Trust Lifecycle Manager menu, go to Account > Settings > Self-service portal.
Select the Landing page tab.
Select Enable customizable landing page to configure the landing page for the self-service portal.
If the Enable customizable landing page checkbox is unselected, the landing page configuration options are hidden, and the custom information panels are no longer displayed in the self-service portals. End users see the regular self-service portal interface without the custom information panels. To preview the default self-service portal interface, unselect the checkbox and select Save. Then, select Preview to view how the open and authenticated self-service portals appear to end users.
Under Page presentation, select how you want the configured information panels to appear in the self-service portal:
Landing page as first page: Select this option to show the configured information panels on the landing page when end users access the self-service portal. The panels appear below the Search certificate section in the open portal or the Ready to manage your certificates? section in the authenticated portal.
Landing page as a tab: Select this option to show the configured information panels in a separate tab when users access the self-service portal.
In the Tab label field, enter the name to appear for the tab in the Self-service portal.
Under Portal availability, select the portals where you want the configured landing page to appear:
Open portal
Authenticated portal
The configured information panels appear in the selected portals. You must select at least one portal.
Under Landing page content, select Configure landing page to configure the information panels to show in the selected portals.
In the Configure landing page panel, under Select panels, select the types of information panels you want to include on the landing page.
Nota
You can select multiple panels.
Select Next to proceed to Customize.
Under Selected panels, select each panel and configure its content.
Select the content elements you want to include in the panel, such as Icon, Title, Content, FAQ, Files, or Links.
Enter the required information in the fields displayed for the selected content elements.
To add more panels, select Add panel.
To change the order of the panels, drag and drop them to the required positions under Selected panels. The order in which the panels are arranged determines how they appear on the landing page in the self-service portal. Any changes to the panel order are reflected in the end user portal after saving the configuration.
To hide a panel from users, select the three-dot menu next to the panel and select Hide from users.
To delete a panel, select the three-dot menu next to the panel and select Delete. Alternatively, select the delete icon in the upper-right corner of the panel configuration area.
To remove a content element from a panel, select Remove element next to the corresponding element.
After configuring all the selected panels, select Next to proceed to Preview.
Review the landing page to verify that the configured panels and their content appear as expected.
Select Save landing page to save the configured panels.
The Landing page content section displays the number and names of the configured panels.
Select Save.
Select Preview to open the Landing page preview side panel. Select Open portal or Authenticated portal to review how the configured landing page appears to end users.
Disable or re-enable portal access
Edit the Self-service portal settings to disable or re-enable access to either the open or authenticated portal:
From the Trust Lifecycle Manager main menu, select Account > Settings > Self-service portal.
Select the edit (pencil) icon on the right.
Deselect the Enable open portal or Enable authenticated portal option to disable it, or select this option to re-enable access.
Select the Save button to apply the changes.
Verify the self-service portal configuration
To verify the portal details, select Account > Settings > Self-service portal from the Trust Lifecycle Manager main menu.
Use the Open portal and Authentication portal tabs to check the current settings for the two portal types:
The Enabled field shows whether each portal type is enabled or not.
If enabled, the display shows the Portal URL and QR code used to access that portal, along with the current configuration options for it.
The profiles table at bottom lists applicable certificate profiles with the self-service portal enabled. For the authenticated portal, the Enrollment URL column shows the URL for enrolling new certificates from the profile (if the enrollment operation is allowed). The enrollment URL is also shown on the profile details page.
Add branding to the self-service portal
Go to Account > Settings > Branding to configure custom branding for the self-service portal.
To learn more, see Branding.
What's next
To learn more about how the self-service portal works from the end user's perspective, see Web self-service options.