Key Management (KMS)

Entry: /kms, then Keys & secrets or Certificates. KMS stores Group-scoped credentials, private keys and certificates. You need an enabled, licensed Module and the appropriate Group access. Reading metadata, managing records and revealing secret material are separate permissions.

Store a credential or certificate#

1. Select the correct Group and open the appropriate inventory. Choose Add secret.
2. Select Secret type and enter Name, optional Target / device, Username and expiry. Names, targets, usernames and notes are readable metadata: never put a password in these fields.
3. Enter the value in Secret value, or use the dedicated private-key/certificate fields. For a certificate chain, place the leaf certificate first. A supplied private key must match it; expiry comes from the certificate.
4. Choose Add secret and confirm the new metadata row. The stored credential does not change the target system.

Reveal and replace a value#

1. Open the record's Settings → Reveal secret. Confirm the reveal action only when you need the current material.
2. Read the value in the reveal dialog. Access is recorded; the displayed material clears after 30 seconds, or when the dialog closes or the page is hidden.
3. To replace stored material, choose Settings → Replace secret and provide the complete new value or bundle. Review the target and submit.
4. Update or rotate the credential on the actual target through your approved operational process, and verify that the stored value matches the intended target state.

Retire a secret deliberately#

1. Use Edit metadata for descriptive changes; it does not replace secret material.
2. Choose Archive secret when the record should no longer be revealed or replaced. Revoke target access separately if required.
3. An archived record can be deleted using Delete secret and its exact name. Review this carefully: live material is removed, while backup and audit retention follow their separate policies.

Blockers and limits: missing reveal permission, an archived record, a stale version or unavailable installation encryption custody can block the action. Ask the responsible administrator to investigate without sending them the secret in a support message. KMS permits 1,000 retained records and 8 MiB of material across the installation, including archives, with 64 KiB per record; over-limit writes are rejected. KMS does not provide automatic target rotation, certificate renewal, secret-history recovery or secret export.

Require check-out and track rotation#

1. Open a secret's policy and choose whether reveal requires check-out, whether check-out needs approval, and whether the secret must be rotated after check-out. Optionally set a maximum age of 1 to 3,650 days. Each Group can set defaults per kind of secret.
2. To use a secret that requires check-out, check it out and enter a reason and duration of up to 480 minutes. Where approval is required, a different User holding the approval permission decides, and a pending request lapses after 24 hours.
3. While the secret is checked out, only the holder can reveal it. Check it in when finished, or let the check-out expire.
4. When Rotation due appears (the maximum age has passed, or the secret was checked in under rotate-after-check-out), replace the credential on the target and in KMS. Replacing the secret clears the indication. Managers are notified once per due period.

Boundaries: in read-only license mode, check-out counts as a change, so a secret that requires check-out cannot be revealed by anyone except its current holder. After a restore, KMS refuses to reveal older material than it has already served rather than show a stale value. The installation's master key can come from the local key (default), an HTTPS envelope service over mutual TLS or a PKCS#11 hardware security module; the administrator chooses it, see the Administer and install guide, including the HSM requirements.