Skip to main content
Version: vNext

🖥️ The web UI

The web UI is built into FleetOS Manager and served on the same HTTPS port, so there is nothing separate to install. A few screens still read demo data in places; they are listed under Known gaps.

This page walks through logging in and finding your way around the FleetOS Manager's web UI. What the FleetOS Manager is, and how nodes join it, is in the FleetOS Manager overview. Each area of the UI then has its own page, linked under Where to go next.

Logging in​

You log in with an operator certificate, not a password. Your fleet admin gives it to you as a .p12 file with a passphrase. If you don't have one yet, make a credential request.

  1. Install the .p12 file in your browser's certificate store. The page shows the same commands when it can't find a certificate.

    On macOS:

    security import operator-admin.p12 -k ~/Library/Keychains/login.keychain-db

    On Linux (needs libnss3-tools or nss-tools):

    pk12util -d sql:$HOME/.pki/nssdb -i operator-admin.p12

    Firefox keeps its own store: Settings, Privacy & Security, View Certificates, Your Certificates, Import.

  2. Open the FleetOS Manager's address. The start page loads without a certificate and says Fleet Manager for CryptOS-PKI.

  3. Select Log in, and pick your certificate when the browser asks.

Expected output

The page says Checking your operator certificate…, then opens the Dashboard. Your certificate's common name shows at the top right.

If the manager turns you away, the page says why and offers Try again:

TitleWhat it means
Certificate not sentThe browser connected without a certificate. If one is installed, the browser has remembered not to send it: quit the browser fully, start it again and log in.
No operator certificateThe service is running, but the browser presented no certificate. Install one.
Certificate not authorizedThe certificate is not valid for this fleet. It may lack an access level, or it may have been revoked.
Fleet Manager unavailableThe API could not be reached. The service may be starting.

Copy diagnostics, in the header and on the login screens, copies a short plain-text report: the page, your login state, your certificate's name, level and serial, and the manager and web builds (read from /version). Paste it into a bug report.

Finding your way around​

The header holds the CryptOS mark (back to the Dashboard), your certificate's name, Copy diagnostics and a light and dark theme switch. The bar under it has every section: Dashboard, Fleet, Root, Nodes, Adopt, Certificates, Enrollment, Profiles, Protocols, Operator CAs, Operators, Agent keys, Approvals and Audit. Operator CAs is its own task: see Managing operator CAs in the web UI.

Lists refresh every 10 seconds. Every table has filters and a search box.

What you can do depends on the access level in your certificate: viewer, operator or admin (see How operators log in). Where a page needs a higher level, it greys out the controls and says why when you hover over them, for example Needs the admin role. The manager checks the level again on every call.

Known gaps​

Some screens still read the web app's built-in demo data instead of the manager:

  • The Certs column on Root and Nodes counts demo certificates.
  • A certificate's own page looks the serial up in demo data, so a real certificate shows Certificate not found. View certificate after issuing goes there too.
  • Days left and the expiring and expired counts are measured from 1 July 2026, not from today.
  • Renew on Certificates and Simulate incoming request on Enrollment only change demo data.
  • The parent check on an enrollment, and the trust chain on a node's page, look the parent up in demo data. A real parent can show as Parent CA "…" not found.
  • Issuing live sends only the request, the node and the profile. Kind, path length, validity and extended key usage come from the profile. Subordinate CA with Generate a key here fails with issueCert: a CSR is required to issue live.

Where to go next​