Use a Certificate Connection Property v2

A Node can define a Connection Property for either a public certificate or a certificate containing both public and private key material. The Connection screen applies different upload and storage rules to each type.

Public certificate

Use a public certificate Property when the Node needs a certificate to identify or trust another party but does not need to prove possession of a private key.

  1. Open the Connection and select the target Environment.
  2. Find the certificate Property.
  3. Upload a binary DER .crt or .cer file containing the public key only.
  4. Click Save changes.
  5. Run the Connection's Test action when available.

Do not upload PEM content or a .pfx containing a private key into this field.

Public and private certificate

Use a public/private certificate Property when the Node must authenticate with the certificate's private key.

  1. Open the Connection and select the target Environment.
  2. Upload the .pfx file.
  3. Enter its password in Certificate password. Leave the value empty if the file is not password-protected.
  4. Click Save changes.
  5. Test the Connection in that Environment.

The upload password is used to read the file and is not stored. Flowgear exports the private certificate material without that password and stores it through protected credential storage.

Review or replace a certificate

After saving, the screen displays the certificate thumbprint and subject. It does not return the certificate file or private key to the browser.

To rotate the certificate:

  1. Select the Environment.
  2. Click the certificate's remove action.
  3. Upload the replacement file and provide its password when required.
  4. Click Save changes.
  5. Confirm the displayed thumbprint changed.
  6. Test a safe operation that requires certificate authentication.

Repeat the rotation in every Environment that uses its own certificate. The Connection key is shared, but certificate material is Environment-specific.

Security guidance

  • Keep .pfx files and their passwords out of Workflow YAML, App packages, source control, and logs.
  • Give Connection write and Environment access only to people responsible for certificate rotation.
  • Verify certificate expiry, subject, issuer, and target-system registration outside Flowgear before the cutover.
  • Keep the previous certificate active at the provider until the replacement has been tested when the provider supports overlapping credentials.
  • Remove temporary local copies according to your organization's credential-handling policy.

See also

See Connection for the storage model and Manage Connection Values by Environment for the release checklist.

For self-signed certificate creation or a live TLS endpoint check, see the Certificate Node.