A template for tokens and users that get certificates for other hosts (jarl cert get): certificates:write, to narrow with names= in the web UI's "Insert a template…", or --role certificates in the CLI. The token form's template filter no longer counts "*" as covering certificates, as the server doesn't. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>