- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Pre-requisites
This section lists everything you need to plan and prepare before you install CertSecure Manager. It covers the knowledge expected from the people performing the installation, deployment planning, the requirements of each CertSecure Manager component, and the network ports, host names and certificate that every deployment needs. Platform-specific requirements, such as the supported operating system and hardware, are listed in the installation guide for each platform.
Work through the pre-requisites in this order:
- Intended Audience: confirm that the team performing the installation has the required skills.
- Deployment Planning: choose the environment, the installation method and whether you need high availability or a load balancer.
- Component Requirements: plan the database, connectors, agents and authentication.
- Network and Ports: open the required ports and prepare the host names and TLS certificate.
- Platform-Specific Requirements: check the requirements of the platform you are installing on.
- Pre-Installation Checklist: gather everything you need for the installation and the first configuration.
Intended Audience
All products produced by Encryption Consulting are designed to be installed, configured, operated, and maintained by personnel with the necessary knowledge, skill, training, and qualifications to safely perform their duties. This section is intended for personnel responsible for architecting, engineering, installing, configuring, operating, and/or troubleshooting enterprise certificate lifecycle management solutions. It is assumed that the readers of this section and the users of its content are proficient with:
- Basic networking concepts
- Security concepts including, but not limited to, authentication, authorization, digital signatures, and logging
Additionally, it is strongly recommended that readers of this section first read Encryption Consulting's datasheets and the Architecture section.
Deployment Planning
Deployment Environment
CertSecure Manager can be deployed in different Cloud Environments, On-Premises, Hybrid IT Environments, and Kubernetes Clusters. Decide where CertSecure Manager will run, and then choose the installation method that matches that platform.
Table 1: Installation Methods
| Platform | Installation method | Guide |
|---|---|---|
| Windows | CertSecure Manager Installer wizard on Windows Server. The whole stack is installed on a single server, and the installation runs offline. | Windows |
| Linux | install-linux.sh script on a supported Linux distribution. | Linux |
| Docker | Containers under Docker Compose, on Linux or on Windows with Docker Desktop in Linux containers mode. | Docker |
High Availability and Scaling
All server-side nodes within CertSecure are stateless. They can run as standalone single nodes or in high-availability clusters, and more nodes can be added to the cluster during peak usage periods. Decide before installation whether you need a single node or a cluster, because a cluster needs a load balancer in front of the nodes.
Load Balancer
All server-side components within CertSecure have been meticulously engineered to offer flexibility when it comes to load balancing. They are designed to operate seamlessly, whether you choose to implement a load balancer or not. CertSecure does not include its own load-balancing solution but is fully compatible with a wide range of commercially available load balancers.
This design ensures that CertSecure can adapt to the specific needs and preferences of your infrastructure. If you opt for load balancing, our components seamlessly integrate with various load balancer solutions, enabling you to distribute incoming traffic efficiently across multiple server instances. Load balancing enhances system reliability, availability, and scalability, making it a valuable addition for organizations with high traffic or stringent uptime requirements.
Note: If you plan to use a load balancer, provide it yourself and have it ready before installation. CertSecure does not install one.
Component Requirements
The components below are described in the Architecture section. This section lists what each of them needs from your environment.
Database
CertSecure Manager uses a MongoDB database for storing persistent data critical to various aspects of its operation. This secure storage solution ensures the confidentiality and integrity of sensitive information, making it an ideal choice for configuration, user initialization, and supporting vital services like Email.
The use of encryption in MongoDB guarantees that data remains protected both in transit and at rest, safeguarding it from unauthorized access or data breaches. This level of security is essential, especially when dealing with user configuration settings and other critical data, as it fortifies the application's ability to maintain the privacy and integrity of user-specific information.
Replica set of MongoDB are initialized with x509 certificate authentication ensuring utmost security and robustness.
The database server listens on port 27017. See Ports.
Connectors
A single connector can only connect to a single CA at a time. Multiple connectors are needed to meet multiple CA requirements. Before installation, list the Certificate Authorities you want to integrate with CertSecure Manager and plan one connector for each of them. The setup for each supported CA is described in Certificate Authorities.
Agents
Similar to connector, an agent can be coupled to a single system only. Plan one agent for each system that CertSecure Manager needs to work with, and make sure the agent port is reachable from CertSecure Manager. See Ports.
Authentication
CertSecure Manager supports two authentication methods. Prepare the one you plan to use:
- Azure Active Directory (Azure AD): only authorized users within your organization can access CertSecure Manager. You need an Azure AD (Microsoft Entra) tenant with permission to create an app registration.
- Multi-Factor Authentication (MFA): someone with a valid username and password needs to perform additional verification with Google authenticator. Users need the Google authenticator app on their device.
Network and Ports
Ports
CertSecure Manager has meticulously defined a set of standard ports for various essential services to ensure seamless and secure communication within the platform. These standardized ports cover a range of critical functions, including HTTPS for secure web access, MongoDB for database operations, and Agents for autonomous task execution, among others.
By specifying these standard ports, CertSecure Manager not only simplifies the configuration and deployment process but also enhances the overall manageability and security of the platform.
Services include HTTPS, MongoDB, and Agents.
Table 2: CertSecure Manager Ports
| Host Name | Port | Protocol | Comments |
|---|---|---|---|
| MongoDB | 27017 | TCP | Encrypted Database server of CertSecure Manager |
| Agents | 9087 | TCP | Agent port exposed to CertSecure Manager |
| HTTPS | 443 | TCP | Service port to access CertSecure Manager |
Note: Each platform also uses a few local-only ports, for example for the backend and Keycloak. These must be free on the server before you install. The full list is in the platform guide: Windows, Linux and Docker.
Host Names
Users reach CertSecure Manager through Nginx on port 443, and Nginx routes each request by host name. Every installation therefore needs three different host names, all resolving to the CertSecure Manager server:
- Frontend: the host name of the CertSecure Manager web UI.
- Backend (API): the host name of the CertSecure Manager API. Agents and connectors connect to this name.
- Keycloak: the host name of the sign-in service.
Create DNS records for all three host names before you install, so that users' browsers, agents and connectors can reach the server.
TLS Certificate
Nginx serves all three host names with a single TLS certificate. For production, request a certificate from your organization's CA that covers the frontend, backend and Keycloak host names, for example through Subject Alternative Names or a wildcard. Each platform guide explains where to place the certificate and what is used if you do not provide one.
Platform-Specific Requirements
The supported operating systems, hardware sizing and the software the installer sets up differ by platform. Check the requirements for your platform before you start:
Table 3: Platform-Specific Requirements
| Platform | Where to find the requirements |
|---|---|
| Windows | Before You Begin (requirements checklist, host names, TLS certificate and ports) |
| Linux | Supported Linux Distributions and What the Installer Sets Up |
| Docker | Prerequisites for a Docker Installation (host, operating system, network, certificate and license requirements) |
Pre-Installation Checklist
Before you start the installation, make sure you have:
- A server that meets the requirements of your platform.
- Port 443 open for inbound traffic from users, agents and connectors.
- Three different host names with DNS records that point to the server.
- A TLS certificate that covers all three host names (recommended for production).
- A valid CertSecure Manager license key from Encryption Consulting.
- The installation package for your platform.
For the configuration steps after installation, also have these ready:
- A Certificate Authority reachable from the server, for certificate issuance, and one connector planned for each CA.
- An Active Directory service account for the LDAP bind, with read access to the user and group containers.
- An Azure AD (Microsoft Entra) tenant with permission to create an app registration, if single sign-on is required.
- An SMTP server or internal mail relay for notification delivery.