Plugin SDK Certificates

About plugin certificates

All plugin roles require an SDK certificate to connect to Security Center. The Plugin SDK automatically locates and validates the certificate using a specific file naming convention and folder structure.

Unlike Platform SDK applications where you can set the ApplicationId programmatically, plugins rely on file-based certificate discovery.

Certificate File Naming

The certificate file must be named after the fully qualified class name of the plugin, followed by .cert:

{Namespace}.{ClassName}.cert

Example

Given the plugin class:

namespace Genetec.Dap.CodeSamples
{
    [PluginProperty(typeof(MyPluginDescriptor))]
    public class MyPlugin : Plugin
    {
        // Plugin implementation
    }
}

The certificate file must be named:

Genetec.Dap.CodeSamples.MyPlugin.cert

Certificate Location

The certificate file must be placed in a Certificates folder located in the same directory as the plugin DLL:

YourPlugin.dll
└── Certificates/
    └── Genetec.Dap.CodeSamples.MyPlugin.cert

How the Plugin SDK Locates Certificates

When a plugin role initializes, the Plugin SDK:

1. Determines the plugin's fully qualified type name (Namespace.ClassName)
2. Looks for a file named {Namespace}.{ClassName}.cert
3. Searches in the Certificates subfolder relative to the plugin DLL location
4. Loads and validates the certificate
5. Uses the certificate to authenticate with Security Center

Certificate Content

The certificate file is an XML document containing:

<ClientCertificate>
	<CompanyName>your-company-name</CompanyName>
	<ApplicationName>your-application-name</ApplicationName>
	<ApplicationId>your-application-id</ApplicationId>
</ClientCertificate>

This file is provided by Genetec as part of the Development Acceleration Program (DAP).

License Consumption

Each active plugin role instance consumes one connection from the Security Center license:

• Plugin roles are not listed under System Status > Applications in Config Tool
• Instead, view plugin roles under System Status > Roles
• Each online and initialized plugin role represents an active SDK certificate connection
• Even if multiple plugin roles use the same ApplicationId, each role instance counts as one connection

License Activation

A plugin role connection is counted when:

• The plugin role is loaded and initialized by the Directory
• The plugin successfully authenticates using its certificate

The connection is released when:

• The plugin role is deactivated or unloaded
• The role goes offline

Multiple Plugin Instances

If you have multiple plugin roles that share the same base plugin class, each instance requires:

1. Same certificate content (can copy the .cert file)
2. Same certificate filename (based on the class name)
3. Separate connections to the license pool

For example, if you create two instances of MyPlugin role:

• Both use Genetec.Dap.CodeSamples.MyPlugin.cert
• Each instance consumes one separate connection

ApplicationId Property in PluginDescriptor

In addition to the certificate file, you can specify allowed ApplicationIds directly in your PluginDescriptor class using the ApplicationId property:

public class MyPluginDescriptor : PluginDescriptor
{
    public override Guid PluginGuid => new Guid("{12345678-1234-1234-1234-123456789012}");
    public override string Name => "My Plugin";
    public override string Description => "My plugin description";
    public override string SpecificDefaultConfig => null;

    public override List<string> ApplicationId => new List<string>
    {
        "KxsD11z743Hf5Gq9mv3+5ekxzemlCiUXkTFY5ba1NOGcLCmGstt2n0zYE9NsNimv", // Development environment
        "your-production-application-id"  // Production certificate
    };
}

Purpose

The ApplicationId property allows you to:

• Specify multiple ApplicationIds that are authorized to run your plugin
• Support both development and production certificates simultaneously
• Allow plugins to run on development systems during development

Development Environment ApplicationId

The ApplicationId KxsD11z743Hf5Gq9mv3+5ekxzemlCiUXkTFY5ba1NOGcLCmGstt2n0zYE9NsNimv is a special value that allows plugins to run on development Security Center systems without a production certificate.

How It Works

When the plugin initializes, Security Center validates that the certificate's ApplicationId matches one of the values in:

1. The ApplicationId property returned by your PluginDescriptor
2. The certificate file content

If the ApplicationId list is empty (the default), only the certificate file is used for validation.

Accessing the ApplicationId at Runtime

The Plugin base class provides a protected property to access the certificate's ApplicationId:

protected override void OnPluginLoaded()
{
    // Get the ApplicationId from the certificate file
    string applicationId = SdkClientCertificate;
    Logger.TraceInformation($"Running with ApplicationId: {applicationId}");
}

Certificate Reuse

Can I reuse the same ApplicationId across multiple plugins?

Yes. You can use the same ApplicationId in multiple certificate files. However:

• Each certificate file must still be named after its respective plugin class
• Each active plugin role still counts as a separate connection

Can I share one certificate file between different plugin classes?

No. Each plugin class requires its own certificate file with the correct naming:

• Genetec.Dap.CodeSamples.PluginA.cert for PluginA
• Genetec.Dap.CodeSamples.PluginB.cert for PluginB

You can copy the certificate content between files, but each class needs its own named file.

Obtaining a Certificate

To obtain an SDK certificate for your plugin:

1. Enroll in the Genetec Development Acceleration Program (DAP)
2. Provide your company and integration details
3. Specify your plugin's intended functionality
4. Genetec will issue a .cert file and indicate the required Security Center license part number

Related Topics

• Plugin SDK: Overview - Plugin architecture and lifecycle
• Deploying Plugins and Workspace Modules in Security Center - Deployment procedures
• SDK Certificates for Security Center Integrations - Platform SDK certificate usage