Skip to main content

Two-Factor Authentication (2FA)

Two-factor authentication protects your CertHub account with a second step at sign-in. In addition to your password, you enter a 6-digit code from an authenticator app. The app can run on your phone or on your computer, so you don't need a smartphone. CertHub uses time-based codes (TOTP). Any standard authenticator app works, for example:

  • Google Authenticator
  • Microsoft Authenticator
  • Authy
  • 1Password

No smartphone? Use your computer​

You can generate the codes on your desktop or laptop instead of a phone. These apps work well:

  • 1Password (Windows, macOS, Linux, browser extension): add a One-Time Password field to a login item. 1Password can read the QR code straight from your screen, and the browser extension fills in the code for you at sign-in.
  • Bitwarden (desktop app and browser extension, TOTP requires a premium plan): add the secret to the Authenticator key field of a login item.
  • KeePassXC (Windows, macOS, Linux, free): open an entry, choose Entries → TOTP → Set up TOTP and paste the secret.

On a computer you usually can't scan the QR code with a camera. Use Copy secret during setup instead (see step 3 below) and paste the secret into your app.

tip

If you already use a password manager at work, it is often the easiest choice: with 1Password or Bitwarden your codes sync across your devices together with your passwords. Keep in mind that your password and your codes are then protected by the same master password, so choose a strong one.

Set up 2FA for your account​

You can set up 2FA yourself before your organization requires it. Until an admin turns on the requirement, CertHub does not ask for your code at sign-in; your authenticator is then already in place when it does.

  1. Open Settings → Security.
  2. In the Two-Factor Authentication card, click Set up two-factor authentication.
  3. Scan the QR code with your authenticator app.
    • Can't scan, or using a desktop app? Click the copy icon next to the code below the QR code (Copy secret) and paste it into your app as a manual entry.
  4. Enter the 6-digit code your app shows and click Confirm.

You will see "Two-factor authentication is now enabled." The card now shows your authenticator and the date it was added.

tip

Finish the setup within 5 minutes of opening the QR code. If it expires or you enter the wrong code 5 times, start the setup again and use the new QR code or secret.

Signing in with 2FA​

Once 2FA is required for your account, sign-in has one extra step:

  1. Sign in with your email and password as usual.
  2. The Verify it's you screen appears.
  3. Open your authenticator app, enter the current 6-digit code for CertHub and click Verify.

Codes change every 30 seconds. If a code is rejected, wait for the next one and try again.

If the screen says "Your sign-in timed out", click Sign in again and start over. The verification step only stays open for a few minutes.

When your organization requires 2FA​

Organization admins can make 2FA mandatory for every member. When it is on:

  • Members who already use 2FA enter a code at every sign-in.
  • Members without 2FA are asked to set it up at their next sign-in, on the Set up two-factor authentication screen. They scan the QR code (or copy the secret), enter the code and are then signed in.
  • Members who are already signed in without 2FA see the Two-factor authentication required screen. Click Sign out and set up, then sign in again to set it up.

Setup only takes a minute. Members cannot use CertHub until it is done.

Turn the requirement on or off (admins)​

  1. Open Settings, then Settings under Organization.
  2. In the Two-Factor Authentication card, switch on Require two-factor authentication for this organization.

To switch the requirement off again, you have to enter a current code from your own authenticator app. This stops someone who has taken over an admin's open session from disabling 2FA for the whole organization.

Signing approvals with 2FA​

In organizations that require 2FA, approval decisions can also be confirmed with a code. When this is active, the Two-Factor Authentication card in the organization settings says: "Members also enter a code before approving, rejecting or publishing."

You are then asked for a code when you:

  • approve a step in an approval process
  • reject an approval
  • use Direct Approval to publish a revision without an approval process

How it works:

  1. Click Approve, Reject or Direct Approval as usual.
  2. The Verify it's you dialog shows Signing as followed by your name.
  3. Enter the current 6-digit code from your authenticator app and click Verify.

The decision is then recorded as your electronic signature. The approval history shows "Signed by name as role", for example "Signed by Jane Roe as reviewer", together with a fingerprint of the content you approved (Content SHA-256).

Each code signs exactly one decision. If you approve several items in a row, wait for a new code in your app before each one. If you cancel the dialog, nothing is recorded and your code stays unused.

info

If the content changes after the approval was started, the decision is refused: "The content changed after this approval started. Cancel this approval and start a new one." This makes sure your signature always covers the exact version you reviewed.

Remove or replace your authenticator​

Getting a new phone or switching to a different app (for example from your phone to 1Password)? Remove the old authenticator first, then set up the new one.

  1. Open Settings → Security.
  2. Click Remove next to your authenticator and confirm.
  3. Enter a current code from that authenticator.
  4. Click Set up two-factor authentication and add the new QR code or secret to your new authenticator.
warning

If your organization requires 2FA, step 4 works differently: right after you remove the old authenticator, the Two-factor authentication required screen appears. Click Sign out and set up, sign in again and add the QR code or secret to your new authenticator.

Lost your authenticator or locked out?​

Too many wrong codes: after 5 incorrect codes in a row, verification is locked temporarily ("Too many incorrect codes"). The first lock lasts 5 minutes; each further lock lasts twice as long, up to 24 hours. A correct code resets the count.

Lost access to your authenticator: you cannot remove 2FA yourself without a code. Contact CertHub support at support@certhub.de and tell us which account is affected. After confirming your identity, support resets your 2FA. You then set it up again at your next sign-in.

FAQ​

Do I need 2FA for every action in CertHub?

No. You enter a code when you sign in, when you change 2FA settings (removing your authenticator, or switching off the organization requirement), and, if your organization uses signed approvals, when you approve, reject or publish.

Do I need a smartphone for 2FA?

No. Any app that generates time-based codes (TOTP) works, including desktop apps and password managers such as 1Password, Bitwarden or KeePassXC. See No smartphone? Use your computer.

Can I use SMS or email codes instead of an app?

No. CertHub only supports authenticator apps. SMS codes can be intercepted, and email codes do not protect you if your email account is compromised.

Can I set up 2FA on two devices?

Each account has one authenticator. Many apps (for example 1Password or Bitwarden) sync codes across your devices, so you can use the same authenticator on more than one device.