Manage access to Certificates Manager

Last update: October 28 2026Open in Markdown

Access to Certificates Manager is governed by:

• projects — define access within an isolated group of resources;
• roles — define access of Control panel users, service users and groups within an account and project.

Access within projects

All Certificates Manager certificates are added to a project. You can group certificates by different projects and configure user permissions depending on which projects they need access to.

Access within roles

Access to Certificates Manager is granted by Certificates Manager roles and global roles. Learn more about role types in the Role reference.

Role group	Role	Access
Certificates Manager roles	certificates.admin	Manage certificates
	certificates.viewer	View certificates
	certificates.consumer	View and use certificates
Global roles	member	Manage Certificates Manager and other products, account, billing, and projects
	iam.admin	Manage access to Certificates Manager and other products
	iam.viewer	View access to Certificates Manager and other products
	reader	View Certificates Manager certificates and all products, account, billing, and projects

Certificates Manager roles

certificates.admin

The certificates.admin role grants access to managing certificates in Certificates Manager.

Scopes	account; project
Can be assigned to	Control panel users; service users; user groups
Available operations in Certificates Manager	In the Account scope: manage custom certificates (add, update, delete) in all projects; manage Let’s Encrypt® certificates (issue, download, delete) in all projects; manage certificate consumers in all projects; view public and private parts of certificates in all projects
	In the Project scope: manage custom certificates (add, update, delete) in their project; manage Let’s Encrypt® certificates (issue, download, delete) in their project; manage certificate consumers (add, delete) in their project; view public and private parts of certificates in their project

certificates.viewer

The certificates.viewer role grants access to viewing everything managed by certificates.admin.

Scopes	account; project
Can be assigned to	Control panel users; service users; user groups
Available operations in Certificates Manager	In the Account scope: view a list of custom certificates and their details in all projects; view a list of Let’s Encrypt® certificates and their details in all projects; view certificate consumers in all projects; view public parts of certificates in all projects
	In the Project scope: view a list of custom certificates and their details in their project; view a list of Let’s Encrypt® certificates and their details in their project; view certificate consumers in their project; view public parts of certificates in their project

certificates.consumer

The certificates.consumer role grants access to viewing and using certificates in Certificates Manager.

Scopes	account; project
Can be assigned to	Control panel users; service users; user groups
Available operations in Certificates Manager	In the Account scope: view a list of custom certificates and their details in all projects; view a list of Let’s Encrypt® certificates and their details in all projects; manage certificate consumers in all projects; view public and private parts of certificates in all projects
	In the Project scope: view a list of custom certificates and their details in their project; view a list of Let’s Encrypt® certificates and their details in their project; manage certificate consumers in their project; view public and private parts of certificates in their project

Global roles

member

The member role grants full access to all services. It does not grant access to managing Control panel users, service users, user groups, and federations.

Scopes	account; project
Can be assigned to	Control panel users; service users; user groups
Available operations in Certificates Manager	In the Account scope: manage custom certificates (add, update, delete) in all projects; manage Let’s Encrypt® certificates (issue, download, delete) in all projects; manage certificate consumers in all projects; view public and private parts of certificates in all projects
	In the Project scope: manage custom certificates (add, update, delete) in their project; manage Let’s Encrypt® certificates (issue, download, delete) in their project; manage certificate consumers (add, delete) in their project; view public and private parts of certificates in their project

iam.admin

The iam.admin role grants access to managing users and does not grant access to managing products and billing. It does not allow managing one's own account: modifying permissions, managing notifications, or deleting the user. The first user with the iam.admin role is created by the Account Owner.

Scopes	Account
Can be assigned to	Control panel users; service users; user groups
Available operations in Certificates Manager	Manage Control panel users, service users, and user groups

iam.viewer

The iam.viewer role grants access to viewing everything managed by iam.admin.

Scopes	Account
Can be assigned to	Control panel users; service users; user groups
Available operations in Certificates Manager	View Control panel users, service users, and user groups

reader

The reader role grants access to viewing everything managed by member in the same scope.

Scopes	account; project
Can be assigned to	Control panel users; service users; user groups
Available operations in Certificates Manager	In the Account scope: view a list of custom certificates and their details in all projects; view a list of Let’s Encrypt® certificates and their details in all projects; view certificate consumers in all projects; view public parts of certificates in all projects
	In the Project scope: view a list of custom certificates and their details in their project; view a list of Let’s Encrypt® certificates and their details in their project; view certificate consumers in their project; view public parts of certificates in their project