Rights to certifications are done on a certification-by-certification basis or by giving rights to "(all certifications)". When determining if a user has rights to an individual certification VSys will first check that specific certification. If the rights there are "(undefined)" then VSys will check "(all certifications"). From there it will check roles and then the default user rights.