Background
webMethods.io currently supports mutual TLS (mTLS) authentication using client certificates. While the current implementation enables certificate-based authentication, there are some limitations regarding certificate lifecycle management that may introduce operational and security challenges.
This proposal aims to improve the platform's certificate management capabilities, particularly around certificate revocation and certificate rotation.
1. Explicit certificate revocation capability
Current situation
Currently, there does not appear to be an explicit mechanism in the user interface to revoke a client certificate.
The only available action is removing the certificate from the corresponding user or configuration. However:
- It is unclear whether certificate removal effectively invalidates previously trusted certificates.
- Administrators have no direct visibility into the certificate status (Active, Revoked, Expired, etc.).
- There is no audit trail demonstrating when and by whom a certificate was revoked.
- In security incidents (certificate compromise, private key exposure, employee departure, etc.), customers need an immediate and unambiguous way to disable certificate-based access.
Proposed enhancement
Introduce a dedicated certificate lifecycle management section including:
Certificate states
Administrative actions
- Revoke certificate
- Delete certificate
- View certificate details (already available)
Auditability
Record:
- Revocation timestamp
- Administrator who performed the action
- Optional revocation reason
Examples:
- Key compromise
- Certificate superseded
- User decommissioned
- Security incident
Benefits
Security
Provides immediate and deterministic termination of trust relationships.
Compliance
Supports compliance requirements related to credential management and security auditing.
Operational clarity
Eliminates ambiguity regarding whether deleting a certificate is equivalent to revoking it.
Incident response
Enables rapid response in the event of certificate compromise.
2. Support multiple simultaneously valid certificates per user (and tenant)
Current situation
The platform appears to associate a single client certificate with a given identity.
This creates operational challenges when certificates need to be renewed or rotated.
A typical certificate replacement process becomes:
- Remove old certificate.
- Deploy new certificate.
- Validate connectivity.
This process may require coordinated downtime or introduce service interruption risk.
Proposed enhancement
Allow a single client identity/application/user to have multiple active certificates simultaneously.
Example:
Certificate A => Active
Certificate B => Active
Both certificates would authenticate the same client identity.
Once migration is complete:
Certificate A => Revoked
Certificate B => Active
Typical use cases
Certificate renewal
Enable seamless migration from an expiring certificate to a replacement certificate.
Key rotation
Allow regular key rotation in accordance with security policies without requiring downtime.
Disaster recovery
Provide a backup certificate that can be activated immediately if required.
Distributed deployments
Support phased rollout across multiple nodes, servers, regions or runtime environments.
Additional Related Enhancements
The previous two capabilities naturally lead to several complementary improvements:
Certificate expiry monitoring
- Display expiration date prominently.
- Generate alerts before expiration.
- Configurable notification thresholds (90/60/30/15 days).
Certificate inventory
Provide a centralized view showing:
- Subject
- Issuer
- Thumbprint
- Expiration date
- Status
- Associated applications/users
API support
Expose certificate lifecycle functions through APIs:
- List certificates
- Upload certificate
- Revoke certificate
- Reactivate certificate
- Retrieve audit history
Bulk operations
Useful for large organizations managing many integrations.
Zero-downtime certificate rotation
A guided workflow allowing:
- Upload replacement certificate.
- Run both certificates concurrently.
- Monitor successful usage.
- Retire the old certificate.
This approach is widely used in enterprise PKI environments and significantly reduces operational risk.
Business justification
The proposed enhancements would:
- Improve security posture.
- Simplify regulatory and audit compliance.
- Reduce operational risk during certificate renewal.
- Enable zero-downtime certificate rotation.
- Align webMethods.io with common enterprise PKI lifecycle management practices.
- Improve customer experience for organizations relying on mTLS-based integrations.
In particular, supporting explicit revocation and multiple concurrent certificates for the same client identity would address two important gaps that currently complicate secure and uninterrupted certificate lifecycle management.
