---
title: "Publishing profiles"
slug: "clm-publishing-profiles"
updated: 2026-11-06T18:44:08Z
published: 2026-11-06T18:44:08Z
canonical: "docs.senhasegura.io/clm-publishing-profiles"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Publishing profiles

This document provides information about the **Publishing profiles** report screen, which displays information about all publishing profiles supported by **Segura™ Platform**.

## Path to access

1. On **Segura™ Platform**, in the navigation bar, hover over the **Products menu** and select **Certificate Manager**.
2. In the side menu, select **Publishing > Publishing profiles**.

## Actions menu

| Item | Type | Description |
| --- | --- | --- |
| **Add** | Dropdown menu | Adds a publishing profile. The profiles are: **Apache**, **Nginx**, **IIS**, **Tomcat**, **F5 BigIP**, **IBM Websphere**, **Palo Alto**, **Windows**, **Kubernetes**, **NetScaler**, **Microsoft Azure**, and **CURL**. |
| **Actions** | Dropdown menu | Displays the options: **Print report**, **Export CSV**, and **Schedule report**. |

## Search fields

| Item | Type | Description |
| --- | --- | --- |
| **ID** | Text field | Filters all profiles by the ID. |
| **Profile name** | Text field | Filters all profiles by the profile's name. |
| **Profile type** | Dropdown menu | Filters all profiles by the profile's type. The options are: **Apache**, **Nginx**, **IIS**, **Tomcat**, **F5 BigIP**, **IBM Websphere**, **Palo Alto**, **Windows**, **Kubernetes**, **NetScaler**, **Microsoft Azure**, and **CURL**. |
| **Status** | Dropdown menu | Filters all profiles by the status. The options are: **Disabled** and **Enabled**. |

## Report fields

- **ID**.
- **Profile name**.
- **Profile type**.
- **Server**: displays the number of devices connected to the profile.
- **Status**.
- **Actions**:
  - **Edit**: opens the [Add a publishing profile](/v4-2/docs/clm-publishing-profiles#add-publishing-profile) screen along with the tabs of the respective publishing profile.
  - **Enable/Disable**: displays a pop-up to confirm the activation or deactivation of the profile.

Info

By default, the report displays 30 records per screen. To go to the next screen, click the forward buttons at the end of the report.

## Add publishing profile

This section provides information about the **Settings**, **Devices**, and **Review** tabs that are shared between all publishing profiles.

### Settings tab

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Profile name *** | Text field | Yes | Profile name. |

#### Credential for execution

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Use a registered credential to access all devices** | Checkbox | No | Uses a registered credential to access all devices. |
| **Access credential registered in the system** | Dropdown menu | No | Access credential. This field is only unlocked if the checkbox **Use a registered credential to access all devices** is checked. |
| **Credential username** | Text field | No | Username of the credential that the profile will run. |

### Devices tab

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Add / Remove selected** | Button | No | Add or remove the selected devices. |
| **Devices table** | Table | No | The fields of the table are: ID, Device name, Management, Type, Vendor, Product, Site, Tag, and Network Connector. |
| **ID** | Text field | No | Device’s ID. |
| **Device name** | Text field | No | Device’s name. |
| **Management** | Text field | No | Device’s IP. |
| **Type** | Text field | No | Device’s type. |
| **Vendor** | Text field | No | Device’s vendor. |
| **Product** | Text field | No | Device’s product. |
| **Site** | Text field | No | Device’s site. |
| **Tag** | Text field | No | Device’s tag. |
| **Network Connector** | Text field | No | **Yes** or **No**, depending on whether the device has its own Network Connector agent configured. |

### Review tab

Use the **Review** tab to check all the information entered in the previous tabs, including the **Network Connector** column from the **Devices** tab.

## Publishing profiles

This section provides information about the configuration tab of each publishing profile.

### Apache

#### Apache plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Site** | Text field | No | Name of the site to which the SSL certificate will be applied to. This field is not used to publish: Segura® uses only the **Configuration file path** field. |
| **Configuration file path** | Text field | No | Path to the Apache’s configuration file. For example: `/etc/apache2/sites-available/exemplo.conf` for Linux based systems. If the configuration file is not provided, the certificate will be installed on the default Apache site. |
| **Port** | Text field | No | Port Segura® uses for the post-publication check of the certificate. The default port is 443. |

### Nginx

#### Nginx plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Site** | Text field | No | Name of the website for which the SSL certificate will be applied. |
| **Configuration file path** | Text field | No | Path to the configuration file in Nginx. For example: `/etc/nginx/sites-available/exemplo.conf`. If the configuration file is not provided, the certificate will be installed on the default Nginx website. |
| **Port** | Text field | No | Port Segura® uses for the post-publication check of the certificate. The default port is 443. |
| **Delete password file after publication (if the file exists)** | Dropdown menu | No | Indicates whether the file containing the password used to publish the certificate should be deleted after the process is complete. The options are: **Yes** and **No**. |
| **Use sudo?** | Checkbox | No | Uses the `sudo` command. |

### IIS

#### IIS plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Access port WinRM** | Text field | No | Port number used to connect via Windows Remote Management (WinRM). Port 5985 for WinRM HTTP, and port 5986 for WinRM HTTPS. The default is 5986. This port overrides the port of the device's WinRM connectivity. |
| **Site name** | Text field | No | Name of the website for which the SSL certificate will be applied. Required to publish, even though the form does not mark it as required. |
| **Site port** | Text field | No | Port of the existing HTTPS binding on the site. The default port is 443. |
| **Certstore name** | Text field | No | Name of the Windows certificate store used by your website where the SSL certificate will be stored. The default is `MY`. |

Attention

The automatic certificate publishing feature using the IIS plugin requires Windows Server 2019 or a later version. If you are using a legacy system, you must upgrade to version 2019 or above to ensure compatibility.

### Tomcat

#### Tomcat plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Keystore name** | Text field | No | Full path of the keystore where SSL certificates will be stored. For example: `/opt/tomcat9/keystore.jks`. |
| **Alias certificate** | Text field | No | Unique identifier for the certificate within the keystore. |
| **Password keystore** | Dropdown menu | No | Password required to access and modify the keystore. |
| **Way of the intermediate certificate** | Text field | No | Path to the intermediate certificate file if needed to complete the certification chain. |
| **Configuration file path (server.xml)** | Text field | No | Path to the Tomcat's `server.xml` file where SSL settings are defined. Required if **Keystore name**, **Alias certificate**, or **Password keystore** is empty. If all three are filled in, Segura® publishes directly to the keystore and ignores `server.xml`. |
| **Tomcat version** | Dropdown menu | No | Version of Tomcat that the server is running. |
| **Port** | Text field | No | Port Segura® uses to check the server after publication. If the fingerprints differ, the publication fails. If the server does not respond, the publication still completes and the execution log records a warning. If you leave the field empty, Segura® skips this check. |

### F5 BigIP

#### F5 BigIP plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Certificate Name** | Text field | No | Base name of the certificate on the F5. Required to publish, even though the form does not mark it as required. The certificate is installed as `<name>_<YYYYMMDD>` (expiration date), with a serial-number suffix if that name already exists, and the chain as `<name>_chain`. |
| **Port for access via SOAP (F5 / BigIP)** | Text field | No | Not used to publish. Segura® connects on the port of the device's HTTPS connectivity, or HTTP connectivity if there is no HTTPS. |
| **Synchronization group** | Text field | No | Name of the F5 device group to synchronize the configuration with after publishing. |
| **Force overwrite?** | Checkbox | No | Forces the configuration synchronization to the synchronization group. Has an effect only when **Synchronization group** is filled in. |
| **Delete existing profiles in VIP?** | Checkbox | No | Indicates whether existing SSL profiles on the Virtual IP (VIP) should be removed before applying new ones. |
| **Partitions** | Table | No | Name(s) of the partitions in F5 where the settings will be applied. At least one partition is required to publish. |
| **SSLClient profiles** | Table | No | Client SSL profiles, which secure the traffic between clients and the BIG-IP. Each row takes the **Full name of virtual server (VIP)** and the **Full profile name**. |
| **SSLServer profiles** | Table | No | Server SSL profiles, which secure the traffic between the BIG-IP and the pool members. Each row takes the **Full name of virtual server (VIP)** and the **Full profile name**. |

### IBM Websphere

#### IBM Websphere plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Path of app_server_root websphere** | Text field | No | Path to the WebSphere application server root directory. Required to publish. |
| **Server port** | Text field | No | SSH port used to connect to the IBM WebSphere server. The default is 22. This port overrides the port of the device's SSH connectivity. |
| **Path keystore (KDB)** | Text field | No | Path to the keystore file (KDB) where certificates are stored. Required to publish. |
| **Password keystore** | Dropdown menu | No | Password used to access the keystore. Required if **Stashed password?** is not checked. |
| **Label Certificate** | Text field | No | Unique identifier of the certificate within the keystore. |
| **Standard certificate?** | Checkbox | No | Indicates whether the certificate being configured should be set as the default for the server. |
| **Stashed password?** | Checkbox | No | Indicates whether the keystore password is "stashed" (stored securely), allowing access without manual entry. |
| **Use sudo?** | Checkbox | No | Runs the commands on the server with `sudo`. |
| **Restart services after publication** | Table | No | IBM HTTP Server instances to restart with `apachectl` after publication. Columns: **Service name** (`HTTPServer`), **Installation path** (default `/opt/IBM/HTTPServer`), **Configuration file** (default `conf/this_instance.conf`), and **Service access port** (default `443`). Does not restart the WebSphere Application Server. Segura® validates only the services listed in this table. |

### Palo Alto

#### Palo Alto plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **SSL/TLS profile** | Text field | No | If the SSL/TLS profile name is new, a new profile will be created. Otherwise, the settings may be changed. If empty, Segura® imports the certificate but cannot link it to an SSL/TLS profile, and you must link it manually on the firewall. |
| **Min version** | Dropdown menu | No | Sets the oldest version of the TLS protocol that can be accepted. The options are **TLSv1.0**, **TLSv1.1**, and **TLSv1.2**. |
| **Max version** | Dropdown menu | No | Sets the latest version of the TLS protocol that can be accepted. The options are **TLSv1.0**, **TLSv1.1**, **TLSv1.2**, and **Max**. Must be equal to or later than **Min version**. |

### Windows

#### Windows plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Store location** | Dropdown menu | No | Location of the certificate store in Windows. For example: `CurrentUser` or `LocalMachine`. |
| **Certstore name** | Dropdown menu | No | Name of the repository where the certificate will be stored. The options are `AddressBook`, `AuthRoot`, `CertificateAuthority`, `Disallowed`, `My`, `Root`, `TrustedPeople`, and `TrustedPublisher`. |
| **Port for access for WinRM** | Text field | No | Port number used to connect via Windows Remote Management (WinRM). Port 5985 for WinRM HTTP, and port 5986 for WinRM HTTPS. The default is 5985. |
| **Set password** | Checkbox | No | When checked, enables **Manual input password** and disables **Certificate password**. |
| **Certificate password** | Dropdown menu | No | Certificate password registered in Segura®. Available only when **Set password** is not checked. |
| **Manual input password** | Text field | No | Certificate password entered manually. Available only when **Set password** is checked. |

Attention

The automatic certificate publishing feature using the Windows plugin requires Windows Server 2019 or a later version. If you are using a legacy system, you must upgrade to version 2019 or above to ensure compatibility.

### Kubernetes

#### Kubernetes plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Secrets** | Table | No | Secrets that store the certificate. Columns: **Secret** and **Namespace**. Each secret must already exist and contain the `tls.crt` and `tls.key` keys, as in a secret of type `kubernetes.io/tls`. |
| **Automatic redeploy** | Table | No | Resources to redeploy after the secrets are updated. Columns: **Type** (**Deployment**, **StatefulSet**, or **DaemonSet**), **Name**, and **Namespace**. |

### NetScaler

#### NetScaler plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **File path to save the certificate** | Text field | No | Path on the Netscaler system where the SSL certificate will be saved. Defines the location where the certificate is stored for use in SSL configuration. |
| **Virtual servers** | Table | No | Table to allow certificates to be bound to virtual servers. |
| **Service groups** | Table | No | Table to allow certificates to be bound to service groups. |
| **Services** | Table | No | Table to allow certificates to be bound to services. |

### Microsoft Azure

#### Microsoft Azure plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Enterprise applications** | Table | No | Select Azure’s enterprise applications you want to add. |

### CURL

#### CURL plugin configuration

| Item | Type | Required | Description |
| --- | --- | --- | --- |
| **Execution template** | Dropdown menu | Yes | Execution template that describes the request sent to the destination. Only lists templates whose execution type is **Certificate publication**. |
| **Additional information** | Text field | No | Value that fills the `[#CERT_ADD_INFO#]` tag in the execution template. Accepts letters, numbers, dot, hyphen, and underscore only. |

Info

Authentication and TLS verification for the cURL destination are configured in the execution template's content, not on this tab. See [Publish a certificate through a CURL destination](/v4-2/docs/clm-publish-certificate-curl).