Documentation | CertSecure

Zendesk

The Zendesk tab in Service Setup connects CertSecure Manager to a Zendesk account. CertSecure Manager then keeps a Zendesk group for every department and opens Zendesk tickets for certificates that are about to expire, so that the people responsible are told in the tool they already use for support work.

To open it, go to Miscellaneous > Service Setup and select Zendesk.

Zendesk tab in Service Setup

What the Integration Does

Department groups: a Zendesk group is created for each CertSecure Manager department, named after the department. The sync keeps the members of the group up to date.
Expiry tickets: when a certificate reaches an expiry alert, CertSecure Manager opens a Zendesk ticket for it, assigns the ticket to the responsible person, and keeps track of it until it is solved.

Note: A Zendesk group can contain agents only. The sync adds the department administrators and the department users who are Zendesk agents or administrators. A department user who exists in Zendesk but is not an agent is not added, and a department user who is not in Zendesk at all is skipped.

Prepare Zendesk

CertSecure Manager signs in to Zendesk with an OAuth client, not with an API token. Create the client in Zendesk before configuring CertSecure Manager.

In the Zendesk Admin Center, go to Apps and integrations > APIs > OAuth clients and create a client of type Confidential.
Grant it these scopes: tickets:read, tickets:write, users:read, groups:read and groups:write. The scopes in Zendesk are per resource, so a client that has only the ticket scopes cannot read users or manage groups.
Note the client ID and the client secret.
Optionally, note the numeric ID of the Zendesk group that new tickets should be sent to.

Configure the Integration

Select the Zendesk tab in Miscellaneous > Service Setup.
Enter the settings described below.
Select Save.
Select Sync to create the department groups and their members.

Field	Description
Subdomain	Required. The part of the Zendesk address before `.zendesk.com`. For `yourcompany.zendesk.com`, enter `yourcompany`.
Client ID	Required. The client ID of the OAuth client.
Client Secret	Required. The client secret of the OAuth client. It cannot contain spaces.
Group ID (optional)	The numeric ID of the Zendesk group that new tickets are routed to. Leave it empty to create tickets without a group.

When Save is selected, CertSecure Manager signs in to Zendesk with the client ID and secret. If Zendesk refuses them, the settings are not saved and the message "Wrong Credentials" is shown.

Saving and syncing need the Configure CertSecure permission. Viewing the settings needs the View CertSecure Configuration permission.

Sync

Sync reconciles every department with Zendesk. For each department, it creates the group when it does not exist, adds the department administrators and department users who are Zendesk agents, and removes group members who no longer belong to the department. The sync runs in the background, and only one sync can run at a time.

A group is also created when a new department is added, if the Zendesk settings have been saved. The members of that group are added by the next sync.

When the sync finishes, it reports how many departments were processed, how many groups were created, how many members were added and removed, and the departments for which an error occurred.

Expiry Tickets

A ticket is opened for a certificate when its expiry alert fires for the alert tiers that raise tickets: the critical alert days, the first alert tier, and the 30-day mark. When certificate criticality levels are configured, the level of the certificate decides whether a ticket is raised and with which priority. A critical alert opens an Urgent ticket, and the other alerts open a Normal ticket.

The ticket is assigned to the first of these groups of people that contains at least one Zendesk agent:

The owner of the certificate.
The PKI Admins and Department PKI Admins of the department of the certificate, or of the departments of its CA.
All PKI Admins and Department PKI Admins.
The Admin.

The first agent of that group is the assignee. The other people in the same group are added to the ticket as collaborators, so one certificate does not produce several tickets. If a Group ID is set, the ticket is sent to that group.

A certificate that already has an open ticket never gets a second one. When a later alert is more urgent, the priority of the existing ticket is raised. It is never lowered.
A ticket that has not been solved after 7 days is reassigned to the manager of the department group.
A ticket that is solved or closed in Zendesk, or whose certificate no longer exists, is dropped from the list of tracked tickets, and the certificate can get a new ticket later.

On this Page: