> For the complete documentation index, see [llms.txt](https://docs.itconductor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.itconductor.com/user-guide/monitoring/sap/netweaver/j2ee-system/keystore-views-and-certificates-monitoring.md).
# Keystore Views and Certificates Monitoring
SAP AS Java manages certificates and cryptographic keys through a Key Storage service, organizing them into multiple virtual containers known as Keystore Views. These views serve as the foundation for core security operations, including encryption, digital identification, and signature verification, across AS Java functions. Underlying each view is a distributed database where the actual key and certificate entries are persisted.
IT-Conductor simplifies the oversight of these assets by providing automated discovery and threshold-based monitoring of Keystore Views and their certificates from a single platform.
### Permissions
To enable IT-Conductor to monitor keys and certificates, ensure the required roles and permissions are configured before proceeding.
1. [Sign in to IT-Conductor](https://service.itconductor.com/) and on the main menu navigate to [**Support > Downloads > SAP Security Downloads**](https://service.itconductor.com/objectSavedSearch?OBJECT_Id=5930548857087850\&itconductor.menuItem=5930548857087850) and download the **SAP J2EE Monitoring Role**. This role has high-level monitoring permissions and includes access to the **keystore/keystore-views** action, which governs access to Keystore View discovery.
2. Assign the **SAP J2EE Monitoring Role** to an SAP user designated for monitoring.
{% hint style="info" %}
**Note:** Learn more about the [SAP J2EE Monitoring Role](https://docs.itconductor.com/user-guide/monitoring/sap/netweaver/j2ee-system/monitoring-role) in our documentation.
{% endhint %}
3. Grant access to individual certificates by assigning specific actions as needed. For example: Monitoring the certificates in **SecureLoginServer** keystore view:
4. Assign the required permissions to the designated monitoring user by creating a new role **ITCONDUCTOR\_CERTIFICATES** with the following actions:
1. **keystore-view\.SecureLoginServer / view-actions.all.all**
2. **keystore-view\.SecureLoginServer / entry-actions.all.all**
5. Repeat step #4 for all views that require their certificates to be monitored:
1. **keystore-view.\ / view-actions.all.all**
2. **keystore-view.\ / entry-actions.all.all**
6. Assign the newly created role **ITCONDUCTOR\_CERTIFICATES** to the designated monitoring user.
#### Validation
Confirm the configuration is correct by verifying the following:
* Verify that the monitoring role has been updated with the required actions for the relevant Keystore Views and certificate entries.
* Confirm that the monitoring user can access the relevant monitoring sections in NWA.
* Confirm that the monitoring user can open the respective Keystore Certificate entries without any access-denied or runtime errors.
* Ensure that permissions are granted explicitly for each Keystore View, rather than through wildcard permissions.
After performing all these steps, IT-Conductor will discover and start monitoring individual certificates under the Key Store
{% hint style="info" %}
**Note:** This is the only way SAP allows granting access to individual certificates. Although IT-Conductor only requires READ access, there are no such actions configured out-of-the-box by SAP. If your organization has qualified SAP J2EE developers, they can create custom actions to grant only READ access in SAP Java Studio and install them into the system. These actions can be assigned to the ITCONDUCTOR\_CERTIFICATES role instead of view-actions.all.all/ entry-actions.all.all
{% endhint %}
### Monitoring keys and certificates in IT-Conductor
IT-Conductor automatically discovers all Keystore Views and any certificates within views where the monitoring user has access. From there, you can configure thresholds to track **Keystore View status** as well as **Certificate Expiration** and **Days to Expiration**.
#### Key Monitoring Metrics
* **Keystore View Status** — The overall health state of a Keystore View, calculated by SAP as the "worst of" status across all entries it contains.
* **Certificate Expiration** — The date on which a certificate becomes invalid and can no longer be trusted.
* **Days to Expiration** — The number of days remaining before a certificate reaches its expiration date.
### Related Information
* [SAP PO Application Monitoring](/user-guide/monitoring/sap/netweaver/j2ee-system/po-application-monitoring.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.itconductor.com/user-guide/monitoring/sap/netweaver/j2ee-system/keystore-views-and-certificates-monitoring.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.