Credential and Certificate Governance
Track and manage expiring credentials, certificates, and password hygiene for connected applications.
Last updated: June 2026
Who this is for
Admins and IT security teams responsible for maintaining valid credentials and certificates across SaaS apps and connectors.
Before you start
Connectors must be configured for the applications you want to monitor. Credential tracking works for systems where Nuxari can read credential metadata through your configured integrations.
Expiring app registration secrets
App registrations in identity providers often use client secrets for authentication. When a secret approaches its expiry date, services that rely on it begin to fail. Nuxari monitors secret expiry dates across your connected identity systems and surfaces a finding when any secret is within a configurable warning threshold, giving you time to rotate before the expiry occurs.
Expiring certificates
TLS certificates, SAML signing certificates, and other cryptographic materials have fixed validity periods. Nuxari tracks certificate expiry dates for connected applications and surfaces a finding when expiry is approaching. The finding includes the certificate subject, the connected application, and the number of days remaining.
Connector credential age
The credentials Nuxari uses to authenticate against connected systems should be rotated periodically. Nuxari tracks the age of each connector's credential and surfaces a finding when a credential has not been rotated within your policy threshold. You can rotate credentials directly in Settings > Connectors > [connector] > Rotate Credentials.
Password hygiene
Where supported by connected systems, Nuxari tracks password age and policy compliance for service accounts and shared accounts. This helps identify accounts that have not been rotated according to your organization's password policy.
Ownership and rotation tracking
Each credential and certificate finding includes the owner, the team or individual responsible for the app registration or certificate, so you know exactly who needs to take action. When a rotation is completed, Nuxari records the update event in the audit log.
How findings are routed to remediation
- 1A credential or certificate finding appears in Governance > Findings with the severity and days-remaining context.
- 2Click the finding and select Create Remediation Plan. Assign the owner or your security team as the responsible party.
- 3After the rotation is completed in the external system, run the Credential Hygiene Pack to confirm the finding is closed.
Evidence of rotation
When Nuxari detects that a credential has been rotated, either through the platform or confirmed via the next evaluation cycle, the rotation event is recorded in the audit log and evidence store. This provides an auditable record showing the before and after credential age.