# SpectraDetect Certificate Management — Root CA Trust Store

> Add, trust, and distrust Root CA certificates in SpectraDetect's trust store to control TLS validation for Manager, Hub, Worker, and Spectra Analyze appliances.

*Administration > Certificates*

The **Root CA Trust Store Management** page enables administrators to manage Root CA certificates for Spectra Detect and [Spectra Analyze](/SpectraAnalyze/) appliances.

Users can add, remove, trust, and distrust Root CA certificates through the web interface to customize the appliance's certificate validation behavior for secure communications.

## Certificate Scope

Certificates managed through the Spectra Detect interface apply to:

- **Spectra Detect Manager**
- **Spectra Detect Hub**
- **Spectra Detect Worker**
- **Spectra Analyze**

## Accessing Certificate Management

To access the certificate management interface:

1. Log into the appliance web interface as an administrator.
2. Navigate to **Administration > Certificates**.
3. The certificate management page displays all Root CA certificates currently in the Trust Store.

## Certificate List Overview

The certificate management page displays a table with the following information for each certificate:

| Column         | Description                                |
| -------------- | ------------------------------------------ |
| **ID**         | Number of certificate.                     |
| **Subject**    | Name of certificate.                       |
| **Issuer**     | Certificate issuer.                        |
| **Valid From** | Certificate validity start date.           |
| **Valid To**   | Certificate validity end date.             |
| **Filename**   | Name of .pem file.                         |
| **Trusted**    | Whether the certificate is currently trusted.  |
| **Actions**    | Available operations for the certificate.  |

## Adding Root CA Certificates

To add a new Root CA certificate to the Trust Store:

1. Under **Administration > Certificates**, click **Add Certificate**.
2. Click **Browse Files**, and select a valid certificate file in `.pem` format.
3. Click **Upload** to add the certificate to the Trust Store.
4. The certificate appears in the list with the **Trusted** status set to *Yes*.

## Managing Certificates

To distrust or blocklist a certificate:

1. Locate the certificate in the list.
2. Under **Actions**, click **Distrust**.
3. Confirm the change in the modal dialog.
4. The **Trusted** status changes to *No*.

To re-trust a certificate:

1. Locate the certificate in the list.
2. Under **Actions**, click **Trust**.
3. Confirm the change in the modal dialog.
4. The **Trusted** status changes to *Yes*.

To remove a certificate:

1. Locate the certificate in the list.
2. Under **Actions**, click **Remove**.
3. Confirm the change in the modal dialog.
4. The certificate is deleted from the Trust Store.

**Info: Some certificates may be greyed out because you don't have the necessary permissions to modify them.**


To reset the Trust Store:

1. Click **Remove All Added Certificates**.
2. Confirm the action in the modal dialog.
3. All user-added certificates are removed from the Trust Store.

**Warning: Removal of certificates works for both trusted and distrusted certificates and completely deletes them from the system. **
Clicking **Remove All Added Certificates** removes all certificates added by users and cannot be undone.
