# Keystore Views and Certificates Monitoring
In SAP, J2EE stores certificates and keys in multiple virtual key stores called Keystore Views.
The keys and certificates in the Key Storage views can be used for encryption, identification, and verification when using AS Java functions.
The Key Storage entries themselves are stored in a distributed database.
### IT-Conductor Monitoring
IT-Conductor provides a convenient approach to monitoring Keystore Views and Certificates.
* All Keystore Views are discovered automatically.
* Keystore Certificates are discovered if permissions to specific Keystore Views are granted to the IT-Conductor monitoring user.
* Thresholds can be configured for monitoring Keystore View status. (This is calculated by SAP as the "worst of" status for all the entries in the view.)
* Thresholds can be configured for monitoring Certificate Expiration and Days To Expiration.
### Permissions
* Access to Keystore View discovery and high-level monitoring is governed by **keystore/keystore-views** action and is included in the standard **ITCONDUCTOR\_MONITORING** role.
* Access to the individual certificates has to be granted as specific actions and configured by customers as needed.
For example: Monitoring the certificates in **SecureLoginServer** Keystore view.
* The IT-Conductor monitoring user needs to have specific permissions (actions) assigned for this view. Let us create a new role **ITCONDUCTOR\_CERTIFICATES** and assign the following actions:
* **keystore-view\.SecureLoginServer / view-actions.all.all**
* **keystore-view\.SecureLoginServer / entry-actions.all.all**
.png?alt=media\&token=593cf809-6744-4582-92fe-d8fdbb74d0ff)
* Repeat this for all views that require their certificates to be monitored:
* **keystore-view.\ / view-actions.all.all**
* **keystore-view.\ / entry-actions.all.all**
* Assign the newly created role **ITCONDUCTOR\_CERTIFICATES** to the IT-Conductor monitoring user.
* IT-Conductor will discover and start monitoring individual certificates under Key Store.
{% hint style="info" %}
**Note:** This is the only way SAP allows granting access to individual certificates. Although IT-Conductor only requires READ access, there are no such actions configured out-of-the-box by SAP. If your organization has qualified SAP J2EE developers, they can create custom actions to grant only READ access in SAP Java Studio and install them into the system. These actions can be assigned to the ITCONDUCTOR\_CERTIFICATES role instead of view-actions.all.all/ entry-actions.all.all
{% endhint %}
### Related Information
* [SAP PO Application Monitoring](https://docs.itconductor.com/user-guide/monitoring/sap/netweaver/j2ee-system/po-application-monitoring)
* [SAP J2EE Monitoring Role](https://docs.itconductor.com/user-guide/monitoring/sap/netweaver/j2ee-system/monitoring-role)
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.itconductor.com/user-guide/monitoring/sap/netweaver/j2ee-system/keystore-views-and-certificates-monitoring.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.