Integration with GlobalSign SSL

Key Manager Plus facilitates integration with GlobalSign signing authority, making it possible for enterprises to automate the end-to-end management of web server certificates signed and issued by GlobalSign from a centralized platform. This document discusses the steps to manage the life cycle operations of SSL/TLS certificates issued by GlobalSign directly from the Key Manager Plus web interface—right from importing existing orders, certificate request and provisioning, to deployment, renewal and thereupon.

Before you proceed with the integration, complete the following step as a prerequisite:

1. Steps to Add GlobalSign Account into Key Manager Plus
2. Place a Certificate Order
3. Domain Control Validation, Certificate Issue & Deployment
4. Renew, Reissue, Verify and Delete

1. Steps to Add GlobalSign Account into Key Manager Plus

Follow the below steps to add your GlobalSign account into Key Manager Plus:

1. Navigate to SSL >> GlobalSign and enter your GlobalSign credentials for authentication.
2. Once your GlobalSign account is verified and added, you may proceed with the below steps.
3. If the GlobalSign account fails to get added to Key Manager Plus, contact the GlobalSign support, get an exception for the user's IP address and try again.
4. In case of account add failure, the IP address will be available in the Audit section.

2. Place a Certificate Order

Once you have configured your GlobalSign credentials, you can now leverage GlobalSign's API to generate certificate signing requests (CSRs), place orders, procure, and manage certificates directly from Key Manager Plus.

To generate a CSR and place a certificate order,

1. Navigate to the SSL tab >> GlobalSign.
2. Click Order Certificate.
3. In the window that opens, enter the Common Name, Product Name, SSL Certificate Type, Domain Validation type and Validity.
4. Key Manager Plus supports all the three domain control validation methods: DNS-based, file-based and email validation.
5. Then provide the SSL certificate type, signature algorithm, algorithm length, keystore type, keystore password, primary and secondary contact details. Users also have the option to import and use an already existing CSR or private key.
6. If the Product Name is chosen as Domain SSL, enter the SSL Certificate Type as Single/Wildcard.
7. For any Product Name other than Domain SSL, provide the UCC SAN and validity for the same.
8. The approver email ID is the email ID to which Domain Control Validation (DCV) verification mail will be sent. The approver email ID should take either of the following formats:
   •   <admin@domain>, <administrator@domain>, <hostmaster@domain>, <webmaster@domain> or <postmaster@domain>
   •   Any administrator, registrant, tech or zone contact email address that appears on the domain’s WHOIS record and is visible to the CA system.
9. Then, provide the organization details(applicable for organization validation and extended validation order types only), administrator contact details and contact details of the technician placing the certificate order.
10. After filling in the details, click Create.
11. You will be taken to a window where you can see the list of certificate orders placed along with their statuses displayed to the right of the table view.

2.1 Configuring your DNS Account

If you are opting for DNS based domain validation in the certificate order, you should configure the DNS account in Key Manager Plus and specify it in the 'DNS' field in the order for automating the challenge verification procedure. To configure your DNS account,

1. Navigate to GlobalSign >> Manage
2. Switch to the DNS tab.
3. Here, you can add a maximum of one DNS account for each DNS provider supported. Key Manager Plus currently supports automatic domain control validation for Azure, Cloudflare, Amazon Route 53 DNS, RFC2136 DNS update, GoDaddy DNS, and ClouDNS.
4. Click Add. In the pop-up that opens, choose the DNS provider.

2.1.1 Azure DNS

1. Provide the Subscription ID, which is available in the Overview page of the Azure DNS zone.
2. Provide the Directory ID, which is available in Azure Active Directory >> Properties.
3. If you have an already existing Azure application, provide its Application ID and Key.
4. If not, follow the steps mentioned in this document to create the Azure application and key, and give the application access to the DNS zones for making API calls.
5. Finally, enter the Resource Group Name, which is the group name in which you have created the DNS zone and click Save.
6. Your DNS account details are saved and listed under Manage >> DNS. 

2.1.2 Cloudflare DNS

1. In the Email address field, specify the email address associated with the Cloudflare account.
2. For Global API Key, use the 'Generate API' key option in the domain overview page of the Cloudflare DNS to generate the key and paste the value in this field.
3. Click Save. Your DNS account details are saved and listed under Manage >> DNS.

2.1.3 AWS Route 53 DNS

1. Generate and specify the Access Key ID and Secret associated with your AWS account.
2. If you do not have an AWS account, create one and generate the Access Key ID and Secret by following the steps given below:
   1. Login to the AWS console and navigate to IAM Services >> Users.
   2. Click Add user.
   3. Provide the user name and select the access type as Programmatic access.
   4. Switch to the next tab, click Attach existing policies directly under Set Permissions and search for "AmazonRoute53FullAccess".
   5. Assign the policy that is listed and switch to the next tab.
   6. In the tags section, add appropriate tags (optional) and switch to the next tab.
   7. Review all the information entered and click Create user.
   8. The user account is created and subsequently, an access key ID and a secret is generated. Copy and save the key ID and secret in a secure location for it will not be displayed again.
3. If you already have an AWS user account, you have to grant "AmazonRoute53FullAccess" permission to the user and generate the access key if the user doesn't have one. And if the user account has an access key associated already, it is just enough to ensure the required permission is granted.

To grant the required permissions, follow the below steps:

1. Navigate to the Permissions tab, select the required user account and click Add Permission.
2. Click Attach existing policies directly under Set Permissions and search for "AmazonRoute53FullAccess".
3. Assign the listed policy and hit Save.
4. To generate the access key,
   1. Select the particular user account and navigate to the Security Credentials tab.
   2. In the window that opens, click Create access key.
   3. An access key ID and a secret is generated. Copy and save the key ID and secret in a secure location for it will not be displayed again.

2.1.4 RFC2136 DNS Update

If you are using open source DNS servers such as Bind, PowerDNS etc., that support RFC2136 DNS update, follow the steps below to automate DNS-based domain control validation procedure using Key Manager Plus. 

1. The DNS Server IP / Hostname represents the server name / IP address in which the DNS server is installed or running. 
2. These details are usually found in the server installation directory. For instance, in the case of Bind9 DNS server, you can find these in the file named.local.conf in the server installation directory.
3. Provide the Key Secret, which is nothing but the key content found in the server installation directory.
4. Provide a name for the key, and choose the signature algorithm.
5. Click Save.

2.1.6 ClouDNS

If you are using ClouDNS for DNS validation, follow the steps below to automate the DNS-based domain control validation procedure using Key Manager Plus:

Steps to Obtain ClouDNS API Credentials:

1. Login to your ClouDNS account and go to Reseller API.
2. If you have already created an API user id, you will find it under API Users. If not, click Create API to generate a new one.

Click here to learn more about ClouDNS API Auth IDs.

Now, in the Key Manager Plus interface, follow the below steps to add ClouDNS to GlobalSign CA:

1. Navigate to SSL >> GlobalSign and click Manage from the right most corner.
2. Switch to the DNS tab and click Add.
3. Choose ClouDNS from the DNS Provider drop-down.
4. Choose one of the following options: Auth ID, Sub Auth ID, Sub Auth User.
5. Enter the chosen ClouDNS Auth ID, its respective Auth Password, and click Save.

2.1.7 DNS Made Easy

1. Enter the name of your choice in the Name field.
2. The Key and the Secret will be available in the DNS Made Easy webpage under Config >> Account Information. Enter those details in the respective fields.
3. Now, click Save to save your DNS account details. The saved DNS details will be listed under Manage >>DNS.
   

3. Domain Control Validation, Certificate Issue and Deployment

Once the certificate authority receives your order, you will have to go through a process called Domain control validation (DCV) and prove your ownership over the domain upon the completion of which you will receive the certificate. Key Manager Plus supports all the three DCV methods:

1. E-mail based Domain Control Validation
2. File or HTTP based Domain Control Validation
3. DNS based Domain Control Validation

3.1 E-mail based Domain Control Validation

1. In email based domain control validation, the certificate authority sends a verification email to the approver email ID specified when placing the certificate order.
2. This email will guide you through the steps need to be performed in order to complete the domain control validation procedure.
3. After completing the steps, navigate to the Key Manager Plus server, and switch to the GlobalSign  tab.
4. Select the order and click Verify from the top menu.
5. On successful verification, the certificate authority issues the certificate which is fetched and added to Key Manager Plus' secure repository. You can access the certificate from the SSL >> Certificates tab.
6. From here, you can deploy the certificate to necessary end-point servers such as a Certificate Store or an IIS server directly from Key Manager Plus.

Click here for more details on certificate deployment.

3.2 File / HTTP based Domain Control Validation

1. If you have opted file / HTTP based domain control validation, a challenge file is displayed on creating the order.
2. Navigate to the domain server, create the path specified and deploy the challenge file in that path.

This entire process of deploying the challenge file in the end-point server can be automated from Key Manager Plus. This can be achieved by configuring the server details in the Deploy tab under Manage. To automate domain control validation,

1. Switch to GlobalSign  >> Manage.
2. If the end-server is a Windows machine, initially download and install the Key Manager Plus agent for Windows server from the Windows Agents tab using the following steps
   
   

   Installing Key Manager Plus Agent for Windows Server:

   To install Key Manager Plus agent as a Windows service,

   • Open the command prompt and navigate to the Key Manager Plus installation directory.
   • Execute the command 'AgentInstaller.exe start.'

   To stop the agent and uninstall the Windows service,

   • Open the command prompt and navigate to the Key Manager Plus installation directory.
   • Execute the command 'AgentInstaller.exe stop.'
3. Switch to the Deploy tab and click Add.
4. In the pop-up that opens, choose the challenge type as 'http-01' , specify the domain name, choose the server type (Windows or Linux) and enter the server details. Click Save.
5. The challenge file is automatically deployed to the corresponding end-server in the specified path.
6. Once you have deployed the challenge file, navigate to the Key Manager Plus server, switch to the GlobalSign tab, choose the order and click Check Order Status from the top menu.
7. On successful domain validation, the certificate authority issues the certificate which is fetched, added to Key Manager Plus' certificate repository (SSL >> Certificates).

3.3 DNS based Domain Control Validation

1. If you have opted DNS based domain control validation, a DNS challenge value and text record are displayed on creating the order.
2. Copy and paste the text records manually in the domain server.

Similar to the HTTP challenge, the entire challenge verification process can be automated from Key Manager Plus. This can be achieved by configuring the server details in the Deploy tab under Manage. To automate domain control validation,

1. Switch to GlobalSign >> Manage.
2. If the end-server is a Windows machine, initially download and install the Key Manager Plus agent for Windows server from the Windows Agents tab using the steps mentioned in the previous section.
3. Switch to the Deploy tab and click Add.
4. In the pop-up that opens, choose the challenge type as 'dns-01', specify the domain name, choose the DNS provider (Azure, Cloudflare, Amazon Route 53 DNS, RFC2136 Update, GoDaddy, or ClouDNS) and enter the server details.
5. Check 'Deploy Certificate' option to deploy the certificate to the end-server after procurement. Click Save.
6. The DNS challenge values and text records are automatically created in the corresponding DNS servers.
7. Once the challenges have been fulfilled, navigate to the Key Manager Plus server, switch to the GlobalSign tab, choose the order and click Check Order Status from the top menu.
8. On successful domain validation, the certificate authority issues the certificate which is fetched and automatically added to Key Manager Plus' certificate repository. You can access the certificate from the SSL >> Certificates tab.
9. From here, you can deploy the certificate to the necessary end-point servers such as a Certificate Store or an IIS server directly from Key Manager Plus. Click here for more details on certificate deployment.

4. Renew, Reissue, Verify and Delete Certificate

You can renew, reissue, verify and delete certificate orders placed to third-party certificate authorities from Key Manager Plus.

4.1 Manual Certificate Renewal

To renew the desired certificates manually, perform the steps that follow:

1. Navigate to SSL >> GlobalSign 
2. Select the required order and click Renew Certificate from the top menu.
3. Complete the domain control validation (DCV) procedure if necessary.
4. On successful validation, the certificate is issued and the new version is automatically updated in SSL >> Certificates tab.

Certificate renewal is allowed only 90 days before the expiry date of the selected certificate.

4.2 Automated Certificate Renewal

To configure the auto-renewal process for the desired certificates, perform the steps that follow:

1. Navigate to SSL >> GlobalSign and click Manage from the top right pane.
2. From the page that appears, navigate to the Auto-Renewal section and enable the auto-renewal process.
3. Enter the number of days before expiry in which the auto-renewal process is to be carried out.
4. Select the desired certificates that are to be auto-renewed.
5. Select the Algorithm Length, KeyStore Type, Signature Algorithm and Validity for the newly renewed certificate and click Save.

Based on the configured details, the auto-renewal process will be carried out. Click the Auto-Renewal Audit to get insights about the certificates renewed through the auto-renewal process.

4.3 Reissue Certificate

To reissue the required certificates, do the steps that follow:

1. Navigate to SSL >> GlobalSign
2. Select the required order and click Reissue Certificate from the top menu.
3. The certificate is reissued and automatically updated in the  SSL >> Certificates tab.

4.4 Certificate Request Verification

To verify a certificate request, do the steps that follow:

1. Navigate to SSL >> GlobalSign
2. Select a certificate order which is pending in Key Manager Plus and click Verify from the top menu
3. If the selected certificate is a Domain Validation certificate, then Key Manager Plus will perform Domain Verification and URL Verification with GlobalSign and issue the certificate once the verification is complete. The issued certificate will be added to the SSL certificate repository in Key Manager Plus.
4. If the selected certificate is not a Domain Validation certificate, then Key Manager Plus will fetch the status of the certificate alone from GlobalSign.

4.5 Delete Certificate Orders

To delete the certificates, do the steps that follow:

1. Navigate to SSL >> GlobalSign 
2. Select the required certificate and click Delete from the More top menu.
3. The certificate request is deleted from Key Manager Plus.