Unassigned certificates

Unassigned certificates are unlicensed Trust Protection Foundation certificates that do not allow network validation, expiration monitoring, enrollment, provisioning, or onboard validation. However, they are included in selected reports and on the dashboard.

What Unassigned is for

Unassigned is intended as a one-time, temporary triage bucket for newly discovered certificates. When Trust Protection Foundation discovers a certificate, the certificate can appear in your inventory as Unassigned so that you can see it without consuming a license. You are expected to review Unassigned certificates and either promote each one to a managed type (Monitoring, Enrollment, or Provisioning) or disable/retire it.

Unassigned is not intended for long-term categorization of certificates that you want to keep alive but unlicensed. Certificates left in the Unassigned state do not receive expiration monitoring, network or onboard validation, enrollment, or renewal, so they can expire without warning.

Unassigned but still licensed

Beginning in 26.1, Trust Protection Foundation permanently tracks whether a certificate has ever been managed. The first time a certificate's management type is set to Monitoring, Enrollment, or Provisioning, Trust Protection Foundation flags the certificate as having been managed. This flag is set during daily tasks and is one-way: once a certificate has been managed, the flag is never cleared.

License counting is based on this flag rather than on the certificate's current management type. As a result, a certificate that has ever been managed continues to count toward your license even if it is later returned to Unassigned. This behavior is sometimes described as Management Type Unassigned - Still Licensed.

The web interface prevents you from setting a previously managed certificate back to Unassigned. If you use a policy lock or the Web SDK to override the management type, the certificate visually shows as Unassigned, but it remains licensed and continues to count toward your license.

To learn how to change a certificate's management type, see Changing a certificate's type in the Trust Protection Foundation Certificate Management Guide.