---
title: User Certificates
slug: access-guide/user-certificates
docTags: 
createdAt: 2026-10-09T06:41:07.659Z
---

The User Certificates page lists the client certificates that are uploaded to the Ivanti Access administrative portal. The **Default Client Certificate** is created by default. The Default Client Certificate can be used as a reference certificate and cannot be deleted.

Figure: default Client certificate

![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/fRrd8CKyLNgeavi83yjRc_clientcertificater20.png)

## Adding a certificate

Adding your own user certificate enables you to easily map fields from the certificate into federation responses generated by Ivanti Access in Certificate based Single Sign-on. You can add a sample certificate used by your Ivanti Tunnel VPN profile that is assigned to mobile applications that use cloud services federated with Ivanti Access.

**Prerequisite**

Verify that you have created a certificate of your choice using the default certificate as a reference.

**Procedure **

1. In Ivanti Access, go to Profile > **User Certificates**, click **Add Certificate** to import a User Certificate.
2. Enter a **Certificate Name**.
3. Under **Upload Certificate**, click **Choose File** and browse to select the appropriate PEM certificate.
4. Click **Add Certificate**.
   The user certificate is added.
   Figure: user certificate

::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/fNbQvS9a_J3364b9Pdi48_usercertificatedisplayr20.png" position="flex-start" size="100" width="1046" height="369" initialPath="../Resources/Images/UserCertificateDisplayR20.png" githubPath="Resources/Images/UserCertificateDisplayR20.png" darkWidth="1046" darkHeight="369" showCaption="false" indent="1"}

## Actions you can take

You can take the following actions on a certificate:

- :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/k8jA06DrttJSmp3-PSA14_viewr81.png" alt caption size="10" width="31" height="40"}: Click to view certificate details.
- :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/Cu_c_S3O_UnSDQr3nNil6_deleter81.png" alt caption size="10" width="27" height="27"}: Click to delete the certificate.

:::hint{type="info"}
You cannot delete a certificate that is configured in a federated pair for single sign-on. In order to remove a certificate, you must first edit and associate the certificate with another certificate (during enabling cert SSO). This disassociates the older certificate. You can then remove the older certificate.
:::

## User Certificate Details

The Client Certificate consists of **Certificate Details** and** Fields available for SSO configuration.** The Certificate Details lists the Issuer, Serial No, Validity and Version of the Certificate.

The **Fields available for SSO configuration **enable you to view and provide friendly names to fields populated in the User Certificate that you uploaded. These friendly names match the MiTra expression for a field used for SSO configuration.

Figure: client certificate

![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/BBJvK01u5mVOfl3pyex_o_clientcertificatefieldsr20.png)