Certificate Concepts

Digital certificates prove the identity of servers, organizations, and applications through cryptography. In Unqork, they're used to sign and encrypt SAML authentication requests and to authenticate outbound service connections through Mutual TLS.

What Is a Digital Certificate?

A digital certificate is a file that proves the identity of a server, organization, or application. It contains a public key and information about who the certificate was issued to, who issued it, and when it expires. Certificates are issued and signed by a trusted third party called a Certificate Authority.

In Unqork, certificates are used in two contexts:

• SAML SSO: To sign authentication requests sent to an identity provider, or to decrypt assertions returned by one.

• Services: To authenticate outbound connections to external systems using Mutual TLS.

Certificate Authority (CA)

A Certificate Authority is an organization that issues and signs digital certificates. When a CA signs a certificate, it's vouching that the entity named in the certificate is who it claims to be. Well-known CAs include DigiCert, Let's Encrypt, and Sectigo. A certificate chain links the certificate back to the CA that issued it. Systems receiving a certificate follow this chain to verify the issuing CA is trusted. Self-signed certificates, where the issuer and subject are the same entity, can be used in development and testing environments but are generally not trusted in production.

Subject and Issuer

Every certificate includes two primary fields:

• Subject Name: The entity the certificate was issued to and represents.

• Issuer Name: The Certificate Authority that signed the certificate and vouches for the subject.

In Unqork, both fields are extracted automatically when a certificate is uploaded and displayed in the certificate detail view.

PFX/PKCS#12 Format

PFX (also known as PKCS#12) is a binary file format that bundles a certificate, its private key, and optionally the full certificate chain into a single file. PFX files typically have a .pfx or .p12 extension. Because PFX files contain a private key, they're often protected with a passphrase. If the certificate was exported with a passphrase, that passphrase must be provided when uploading to Unqork.

Unqork accepts certificates in PFX format and stores the certificate content encrypted at rest. The raw certificate and passphrase are never returned through the API.

Mutual TLS (mTLS)

Standard TLS, the protocol that secures HTTPS connections, authenticates only the server. The client verifies that the server's certificate is valid and trusted, but the server has no way to verify the client's identity. Mutual TLS extends standard TLS by requiring both sides to present a certificate. The server verifies the client's certificate, and the client verifies the server's. Mutual TLS creates a two-way trust that's useful when connecting to external APIs or services that require verified client identity, not just an API key or password.

In Unqork, Mutual TLS is configured on services. When a service is configured with a Services-type certificate, Unqork presents that certificate to the external system on every outbound request. The external system must be configured to trust the certificate. Not all service authentication types support Mutual TLS. See Service Types for compatibility details.

For a complete explanation of how TLS and mTLS work and how to configure mTLS in Unqork, see Mutual TLS Concepts.

SAML Certificates

In SAML SSO, certificates serve two specific roles:

• Signed AuthnRequests: When Unqork sends an authentication request to an identity provider, it can optionally sign that request with a certificate. The identity provider uses the certificate to verify the request came from Unqork. Doing so requires configuring the same certificate in both Unqork and the identity provider.

• Encrypted Assertions: When an identity provider is configured to encrypt the SAML assertion it sends back, Unqork needs a certificate to decrypt it. The identity provider encrypts using Unqork's public key; Unqork decrypts using the private key stored in the certificate.

SAML certificates are managed separately from Services certificates and cannot be associated with services.

Certificate Expiration

Certificates are valid for a fixed period defined by their Issue Date and Expiration Date. When a certificate expires, any system relying on it will begin rejecting connections or authentication attempts, whether for SAML signing or Mutual TLS. Unqork displays the expiration date in the certificate list. Monitor expiration dates proactively and upload replacement certificates before they expire to avoid authentication disruptions.