Hide Forgot
In Table A.6. CertificateUsers Module Options there is option roleGroupSeparator and in its description there is "The character used to separate the username from the role group name in the rolesGroup file.", but it should be "rolesProperties" instead of "rolesGroup".
Verified on stage.