> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/ad-identities/certificate-authorities.md).
# Certificate Authorities
Open **Unified Identities › Resources**, filter **Providers** to **Active Directory › Certificate Authority**, then select a row to open its details.
Certificate Authorities
## Certificate Authority Details
Opening a certificate authority shows the `Risk` and `Exposure Point` in its header, and the `Information` and `Issues` panes.
{% hint style="info" %}
You can analyze the object in the [Graph](/forestall/visualize/visualize.md) by clicking the **Graph »** button next to the `Information` title.
{% endhint %}
Certificate Authority Details
## Information
`Information Pane` can contain different badges to highlight important attributes.
| Badge | Description |
| ------------------- | ------------------------------------------------------ |
| **Admin** | Indicates that the object is Admin. |
| **Tier0**/**Tier2** | Indicates the tier of the object (`Tier0` or `Tier2`). |
`Information Pane` contains `Details`, `Certificate Templates`, `CA Certificates`, `Enrollment Agent Restrictions`, and `Certificate Manager Restrictions` tabs respectively.
## Details
Details tab contains attributes below about certificate authority object.
| Attribute | Description |
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Display Name** | The display name for an object. (**LDAP Display Name**: displayName) |
| **Enterprise CA Name** | Name of the CA server, specified in the ADCS installation. |
| **Distinguished Name** | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName) |
| **CA Certificate DN** | Full distinguished name from the CA certificate. |
| **DNS Host Name** | Fully qualified domain name of computer as registered in DNS. (**Ldap Display Name**: dNSHostName) |
| **Full Name** | Combination of the DNSHostName and the Name of the certificate authority. |
| **Created Time** | The date when this object was created. (**Ldap Display Name**: whenCreated) |
| **Last Changed Time** | The date when this object was last changed. (**Ldap Display Name**: whenChanged) |
| **Computer** | FSName of the computer that contains the certificate authority instance. |
| **Root CA** | Whether the certificate authority is an root certificate authority instance. The root certificate authorities are the first and may be the only certificate authorities configured in a Public Key Infrastructure(PKI) hierarchy. |
| **Enterprise CA** | Whether the certificate authority is an enterprise certificate authority instance. Enterprise certificate authorities are domain members and typically online to issue certificates or certificate policies. |
| **Enrollee Supplies Subject** | Whether specifying a Subject Alternative Name (SAN) during certificate enrollment to any certificate template that is published by this certificate authority server has been allowed. |
| **CA Flags** | The certificate authority flags attribute stores the bitwise combination of the certificate authority server's capabilities. |
| **Allow Web-Based Enrollment Methods** | Whether the certificate authority server supports web-based enrollment for the clients. |
| **CA Web Enrollment URLs** | Certificate authority web enrollment url addresses of the certificate authority. |
| **Certificate Enrollment Web Service URLs** | Certificate enrollment web service url addresses of the certificate authority. |
| **Certificate Enrollment Policy Web Service URLs** | Certificate enrollment policy web service url addresses of the certificate authority. |
| **Network Device Enrollment Service URLs** | Network device enrollment url addresses of the certificate authority. |
## Certificate Templates
Certificate templates tab contains a list of certificate templates that generated on the certificate authority. This list also contains `Allow Domain Authentication`, `Enrollee Supplies Subject` and `Require Manager Approval` columns.
Certificate Templates
## CA Certificates
CA Certificates tab contains a list of certificate authority certificates that belongs to the certificate authority. This list also contains `Root Certificate` and `In NT Auth Store` columns.
CA Certificates
## Enrollment Agent Restrictions
Enrollment Agent Restrictions tab contains a list of enrollment agent restriction definitions on the certificate authority. This list contains `Enrollment Agent`, `Template`, `On Behalf Of` and `Access` columns.
Enrollment Agent Restrictions
## Certificate Manager Restrictions
Certificate Manager Restrictions tab contains a list of certificate manager restriction definitions on the certificate authority. This list contains `Certificate Manager`, `Template`, `Principal` and `Access` columns.
Certificate Manager Restrictions
## Issues
Issues pane contains identified issues on the certificate authority object.
