- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
ACME CAs: Let's Encrypt, Google Public CA and ACME
Three tiles under Administration > Certificate Authorities > Agentless CAs connect CertSecure Manager to a CA over the ACME protocol (RFC 8555):
| Tile | Page | Directory | External Account Binding |
|---|---|---|---|
| LetsEncrypt | Let's Encrypt CA | Production: https://acme-v02.api.letsencrypt.org/directoryStaging / Test: https://acme-staging-v02.api.letsencrypt.org/directory |
Not used |
| GooglePublicCA | Google Public CA | Production: https://dv.acme-v02.api.pki.goog/directoryStaging / Test: https://dv.acme-v02.test-api.pki.goog/directory |
Required. Generate the key ID and HMAC key in the GCP Public CA console. |
| ACME | ACME CA | Any ACME directory URL, for example an internal ACME server. | Only if the directory requires it. Read directory tells you. |
Certificates from these CAs are issued with dns-01 validation, using the DNS providers registered under ACME > Domain. GlobalSign Atlas (ACME) and GoDaddy Automated SSL are also ACME CAs, but they are configured from the GlobalSign and GoDaddy tiles. For how ACME CAs relate to the rest of the ACME features, see ACME Certificate Authorities.
Prerequisites
- Your CertSecure Manager account has the Manage Certification Authorities permission, and the license covers the CA type.
- The CertSecure Manager backend can reach the ACME directory over HTTPS.
- For Google Public CA: an External Account Binding key ID and HMAC key from the Google Cloud Public CA console. The HMAC key is shown only once.
- For an internal ACME server whose HTTPS certificate the backend does not trust: the PEM certificate of the CA that issued it.
- Each domain you will request certificates for is added under ACME > Domain with a DNS provider whose credentials can create and delete TXT records.
Adding an ACME CA
- Go to Administration > Certificate Authorities and select Configure on the LetsEncrypt, GooglePublicCA or ACME tile.
- Select Add New Connection. The dialog is titled Configure Let's Encrypt, Configure Google Public CA or Configure ACME.
- Fill in the fields below.
- For the ACME tile, select Read directory. CertSecure Manager reads the directory and reports whether it requires External Account Binding, and shows its terms of service.
- Under Default Certificate Template, select Read directory & policy, then complete the template fields that appear. ACME CAs issue at a validity fixed by the CA, so the validity cannot be changed.
- Select Submit. CertSecure Manager adds the CA and registers its ACME account.
| Field | Applies to | What it means |
|---|---|---|
| Name | Required | The name of the CA in CertSecure Manager. Pre-filled for Let's Encrypt and Google Public CA (with "Staging" added for the staging directory); empty for ACME. It cannot be changed later. |
| Description | Optional | A note about the CA. |
| Directory URL | Required | For Let's Encrypt and Google Public CA, select Production or Staging / Test. Production and staging are separate accounts; staging issues untrusted certificates with far higher rate limits, so it suits testing. For ACME, enter the directory URL, for example https://acme.example.com/directory. The directory URL cannot be changed later. |
| Account Email | Optional | The contact address registered with the ACME account. If left blank, the account is registered without a contact. |
| CA Certificate | ACME only, optional | For an internal ACME server only: the PEM certificate of the CA that issued the server's own HTTPS certificate, if the backend does not already trust it. It is not related to the certificates this CA issues. Leave blank for a publicly trusted directory. |
| External Account Binding | Google Public CA and ACME | Field Name and Value rows for the EAB key ID and HMAC key. Google Public CA starts with the rows EAB Key ID and EAB HMAC Key. Select Add New Field to add a row. Values are masked; when you edit the CA, a blank value keeps the stored one. Not shown for Let's Encrypt. |
Note: One CA can be added for each directory. Directories that already have a CA are not offered again, and if every directory of a CA type is used, the dialog asks you to edit the existing CA instead.
ACME CA Connections
The page lists the connections with their Connection ID, Certification Authority, Directory URL, Account Email, ACME Account (Registered or Not registered), Account (the credential status: Configured, Expired, Unverified or Not set) and Status (Enabled, Disabled or Decommissioned). For Google Public CA the list also shows the EAB Key ID. View Decommissioned Connections shows decommissioned connections too.
Select a row to open its Connection Details. The right-click menu offers:
- View Details – shows the stored settings of the connection. The EAB HMAC key is masked.
- Check Credential – checks with the CA that the ACME account is still accepted.
- Edit – opens the dialog as Edit followed by the name. The name and directory URL cannot be changed. Save Changes is available only after Read directory & policy has been run in the dialog.
- Decommission – decommissions the connection after a confirmation. This cannot be undone, and can take up to 15 minutes.
- Restore – for a decommissioned connection, opens the dialog to add it again with the same name.
Issuing Certificates
- Request certificates in Enrollment and select the ACME CA. A certificate template and a common name are required.
- The DNS zone used for validation is chosen automatically from ACME > Domain, by the longest domain that matches the names on the request.
- CertSecure Manager publishes the dns-01 challenge record through the DNS provider of the domain, waits for validation, downloads the certificate and removes the record again.
Troubleshooting
| Message | What to do |
|---|---|
| Could not reach the ACME directory. Check the URL and the network, then try again. | Check the directory URL and that the backend can reach it. For an internal server, add its CA Certificate. |
| This directory requires External Account Binding — supply its key ID and HMAC key | Enter the EAB key ID and HMAC key issued by the CA. |
| Every External Account Binding field needs both a name and a value | Complete or remove the empty External Account Binding row. |
| Must be a PEM certificate, beginning with -----BEGIN CERTIFICATE----- | Paste the whole PEM certificate, including the BEGIN and END lines. |
| Account shows Expired | The CA rejected the ACME account. Issuance fails until the credential is replaced. Edit the CA, or decommission it and add it again. |