--- title: Certificate Collector node description: Configure the Certificate Collector node to collect X.509 digital certificates from incoming requests for use as authentication credentials in PingAM journeys. component: auth-node-ref version: 8 page_id: auth-node-ref::certificate-collector canonical_url: https://docs.pingidentity.com/auth-node-ref/latest/certificate-collector.html llms_txt: https://docs.pingidentity.com/auth-node-ref/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md keywords: ["Nodes & Trees", "Journeys", "Authentication", "Certificates"] page_aliases: ["self-managed/auth-node-certificate-collector.adoc"] superseded_by: https://docs.pingidentity.com/auth-node-ref/latest/certificate-collector.html section_ids: example: Example availability: Availability inputs: Inputs dependencies: Dependencies configuration: Configuration outputs: Outputs callbacks: Callbacks outcomes: Outcomes errors: Errors --- # Certificate Collector node The Certificate Collector node collects an X.509 digital certificate from the request. The journey can use the collected certificate as authentication credentials for a user or OAuth 2.0 client. AM accepts certificates in PEM and DER format. | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | You can't use this node in isolation because it only *collects* the certificate from the request. It doesn't extract or validate the certificate's content. Use a [Certificate Validation node](certificate-validation.html) to validate the certificate and a [Certificate User Extractor node](certificate-user-extractor.html) to extract the user details from the certificate. | ## Example This example shows an authentication journey using a certificate as credentials. ![journey certificate auth](_images/journey-certificate-auth.png) 1. The Certificate Collector node attempts to collect the certificate from the request body or the header. * If the node can collect the certificate, the journey proceeds to the [Certificate Validation node](certificate-validation.html). * If the node can't collect the certificate, the journey proceeds to a [Page node](page.html) containing a [Platform Username node](platform-username.html) and a [Platform Password node](platform-password.html) to let the user authenticate with username/password credentials. 2. The Certificate Validation node attempts to validate the certificate based on the configuration of that node. * If the certificate can be validated, the journey proceeds to the [Certificate User Extractor node](certificate-user-extractor.html). * If the certificate is invalid, the journey proceeds to the Failure node. * In all other cases, the journey proceeds to a [Page node](page.html) containing a [Platform Username node](platform-username.html) and a [Platform Password node](platform-password.html) to let the user authenticate with username/password credentials. 3. The Certificate User Extractor node extracts the user ID from the certificate and attempts to find a match in the identity store. * If the username can be extracted and a matching user is found in the identity store, the journey increments the login count and authenticates the user. * If the username can't be extracted or no matching user is found in the identity store, the journey proceeds to the Failure node. ## Availability | Product | Available? | | ------------------------------------- | ---------- | | PingOne Advanced Identity Cloud | Yes | | PingAM (self-managed) | Yes | | Ping Identity Platform (self-managed) | Yes | ## Inputs This node reads the certificate from the request payload or in a request header. It doesn't read anything from the shared state. ## Dependencies This node has no dependencies. ## Configuration | Property | Usage | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Certificate Collection Method | How the node should collect the certificate from the request. Possible values are:- `Request` The node locates the certificate in the request. Use this option if TLS termination happens at AM. - `Header` The node locates the certificate in an HTTP header. Specify the header name in the HTTP Header Name for the Client Certificate property. Use this option if TLS termination happens in a proxy or load balancer outside AM. - `Either` The node attempts to locate the certificate in the request. If there's no certificate in the request, the node attempts to locate the certificate in the HTTP header specified in HTTP Header Name for the Client Certificate.Default: `Either` | | HTTP Header Name for the Client Certificate | The name of the HTTP header that contains the certificate. If you set the Certificate Collection Method to `Header` or `Either`, you must set a value here.Default: No value | | Trusted Remote Hosts | A list of IP addresses trusted to supply certificates on behalf of the authenticating client, such as load balancers doing TLS termination.If you don't set a value here, AM rejects certificates supplied by remote hosts. If you set a value of `any`, AM trusts certificates supplied by any remote host, on behalf of the authenticating client.Default: No value | ## Outputs The node outputs the X509 certificate to the transient state to be consumed by the [Certificate Validation node](certificate-validation.html). ## Callbacks This node doesn't send any callbacks. ## Outcomes * `Collected` The node was able to collect the certificate. * `Not Collected` The node was unable to collect the certificate. ## Errors The node can log the following errors: * `Certificate was not successfully collected based on node configuration and client request` No certificates are provided in the configured location (either header or request). * `CertificateFromParameter decode failed, possibly invalid Base64 input` There's a problem with the certificates provided in the header or in the request.