- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Sectigo
CertSecure Manager connects to Sectigo Certificate Manager (SCM) through the SCM REST API. The connector is agentless: no software is installed, and the CA is configured from the Sectigo tile under Administration > Certificate Authorities > Agentless CAs. Sectigo issues a certificate only for domains that have passed Domain Control Validation (DCV).
Note: Sectigo and Sectigo-PS use a single license entry. A license that includes Sectigo covers both connectors. This page describes the Sectigo (SCM) connector.
Prerequisites
- Your CertSecure Manager account has the Manage Certification Authorities permission.
- An SCM administrator login with API access enabled, and your Customer URI.
- At least one SCM organization, with its numeric organization ID, that is entitled to at least one SSL certificate type.
- Outbound HTTPS (TCP 443) from the CertSecure Manager backend to the Sectigo API, without TLS interception by a proxy.
Adding a Sectigo CA
- Go to Administration > Certificate Authorities and select Configure on the Sectigo tile.
- Select Add New Connection on the Sectigo CA page.
- Enter the Name (up to 50 characters), the Username and Password of the SCM administrator login, an optional Description, and the Customer URI (up to 100 characters).
- Enter the API Base URL if it differs from the default,
https://cert-manager.com/api. - Select Test credentials & read account. CertSecure Manager contacts SCM and loads the choices the account offers.
- Complete the Default Certificate Template fields that appear and select Add.
The Sectigo CA page lists the connections with their Connection ID, Certification Authority, Customer URI, Sync, Status and Last Successful Sync. The right-click menu of a connection offers View Details, Edit, Check Credential, and Decommission (Restore for a decommissioned connection). See Managing a Configured CA.
Configs
Select Manage Configs on the Sectigo CA page to open Sectigo Configs. The list shows the Name, Username, Customer URI, API Base URL and DCV Mode of each config. The right-click menu of a config offers View Details, Edit Config, Manage DCVs, Manage Domains and Delete Config.
| Field | Applies to | What it means |
|---|---|---|
| Name, Username, Password, Customer URI | Required | The SCM connection details. |
| DCV Mode | Required | Manual or Auto. |
| API Base URL | Optional | The SCM API address. |
| Organization ID | Optional | The numeric ID of the SCM organization to issue under. |
| Cert Type ID | Optional | The SSL certificate type to request. |
| Description | Optional | A note about the config. |
Note: Deleting a config may affect pending DCV tasks associated with it.
Domains and Domain Control Validation
- Right-click the config and select Manage Domains.
- Select Add Domain and enter the Name of the domain, select the Organization and the Certificate Type, and add an optional Description. Select Submit.
- Right-click the config and select Manage DCVs. The Domain Control Validations list shows the Method, Order Method, Domain, Status (Not Initiated, Validated or Expired) and Expires On of each validation.
- Right-click a domain, select Validate With, and choose HTTP, HTTPS, Email or CName.
- In Start Validation, choose the DCV Mode and, if needed, the Propagation Seconds, then select Start.
- For Email validation, select one of the admin email addresses Sectigo offers for the domain and submit.
- If a validation of the same type is already in progress for the domain, CertSecure Manager asks whether to submit it or restart it.
Issuing, Renewing and Revoking
- To issue a certificate, use Enrollment and select the Sectigo CA and a template.
- Renew and revoke Sectigo certificates from Inventory.
Troubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
| The Sectigo tile is greyed out | The license does not cover Sectigo. | Check the license under About License. |
| The credential test fails | The credentials or the Customer URI are wrong, or the login has no API access. | Check the values, and ask Sectigo to enable API access for the login. |
| An enrollment is rejected because a domain is not validated | The domain has not passed DCV. | Complete DCV for the domain first. |
| 401 or 403 | The credentials were changed or revoked in Sectigo. | Edit the connection with the current credentials. Check Credential confirms them. |
| TLS error | A proxy or firewall intercepts TLS to the Sectigo host. | Allow direct HTTPS from the backend to the Sectigo host. |