- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Architecture
CertSecure Manager is made up of many components, some required and some optional. This section provides an overview of CertSecure Manager's architecture and how these components integrate.
The requirements for installing CertSecure Manager, such as the ports, database, connectors, agents and load balancer, are listed in Pre-requisites.
Design Decision
The design philosophy behind CertSecure Manager is the result of meticulous deliberation, with a clear focus on delivering the best possible solutions for organizations. Our platform is intricately crafted to address and streamline the common challenges and obstacles that organizations encounter in their day-to-day operations.
CertSecure Manager is built to simplify and mitigate the issues that organizations frequently face, offering practical and user-centric solutions. Our goal is to empower organizations with an intuitive and efficient tool that enhances their operations, optimizes processes, and promotes productivity while maintaining the highest standards of security and compliance. CertSecure Manager is designed while keeping the following principles in mind:
Security
CertSecure Manager keeps strict security compliance with the latest guidelines from the CA/B forum, ensuring the highest level of compliance and security for managing your certificates. The CA/Browser Forum's guidelines represent the industry's best practices for certificate management, and CertSecure Manager's strict alignment with these standards guarantees the integrity and trustworthiness of your digital certificates.
API Integrations
CertSecure Manager provides strong API integration support for organizations. Organizations can integrate our APIs into their solution. By embracing our APIs, organizations can enjoy the flexibility to tailor CertSecure Manager to their unique needs and objectives. Whether it's enhancing security measures, automating processes, or delivering a more customized user experience, our API integration support paves the way for innovation and improved efficiency.
Scalable
All server-side nodes within CertSecure are purposefully designed to be stateless, offering a fundamental advantage in terms of scalability and robustness. They are architected to operate seamlessly in high-availability clusters or as standalone single nodes, granting users the freedom to tailor their infrastructure to their specific needs.
This adaptability means that customers have the flexibility to make real-time decisions about their infrastructure. During peak usage periods or when faced with increased demands, customers have the option to effortlessly add more nodes to the cluster. This dynamic scaling not only enhances performance but also ensures that system resources are optimally utilized.
Easy to Integrate
CertSecure Manager is designed to be simple to deploy and integrate with your environment. Furthermore, it is designed to integrate with your PKI and services. We understand that streamlined integration is essential for the smooth operation of your certificate management processes.
RBAC
CertSecure Manager's role-based Access control is designed to provide a clear and authoritative hierarchy of rights and data control when it comes to certificates. This design guarantees that access to critical certificate data is exclusively granted to authorized individuals within your organization. By implementing this robust access control system, CertSecure Manager ensures the utmost level of data security and integrity, protecting sensitive certificate information from unauthorized access and safeguarding your organization's digital assets.
Departments
CertSecure Manager's Department feature is designed for user compartmentalization and user segregation. This means that Departments provide a secure way of segregating the users and their information accesses. Users belonging to a particular department do not have access to information of user belonging to another department. User can see the data that belongs to him only. This ensures that department specific data is handled sensitively and any authorized access is stopped.
Work Anywhere
CertSecure Manager is designed to run on a very simple platform that can be run on-premise in your data center, in the cloud or in a hybrid environment between the two. This allows for maximum flexibility when architecting for high availability and disaster recovery.
CertSecure Manager Overview
Encryption Consulting's CertSecure Manager is the ultimate all-in-one solution for enterprises seeking to manage and secure their digital certificates effortlessly. Seamlessly integrating with cloud-native environments, CertSecure Manager is an easy-to-use tool that protects your organization's sensitive information while complying with regulatory standards. With CertSecure Manager, you can be confident in the security and management of your digital certificates.
CertSecure Manager's highlights strong integration with MS PKI and Public CAs such as Entrust, DigiCert, etc.
CertSecure Manager stands atop of five (5) pillars
- Inventory: The inventory system acts as a centralized location for managing digital certificates from public authorities such as DigiCert and Sectigo and private trust CAs like Microsoft PKI. It enables effective management of all digital certificates in one place.
- Reports: Intelligent data is generated based on the inventory, with reports such as an inventory report, an expiration report (listing certificates expiring soon), and a key length report (highlighting any certificates that use weaker cryptography keys).
- Alerts: The system includes a built-in alert feature that sends notifications when a certificate is about to expire, as well as other important updates that require attention.
- Enrollment: The system provides a web interface and APIs to request new certificates from registered CAs, creating a more controlled certificate enrollment environment with approvals-based enrollment.
- Certificate Discovery: An additional feature that enables organizations to discover certificates being used in a network, identify vulnerabilities, and track certificate usage on servers. It also allows users to upload certificate discovery reports from tools like Tenable and Qualys.
- Automation: The system enables automated deployment of new certificates onto web servers such as IIS, Apache, and Tomcat, as well as load balancers like F5, to minimize downtime and prevent outages. This is done through our elevated agent based architecture.
Microservices Architecture
CertSecure Manager is built upon a Microservices architecture, a design framework that forms the foundation for a more agile, streamlined, and resilient solution. This architecture enables CertSecure Manager to function seamlessly, breaking down complex functionalities into smaller, individual services. Each of these services operates independently, allowing for more efficient development, deployment, and management.
Microservices contribute to CertSecure Manager's agility and responsiveness, making it easier to adapt to evolving requirements and scale as needed. With this architecture, we can quickly develop and deploy new features or updates, ensuring that our solution remains current and capable of meeting your organization's changing needs.
Furthermore, the Microservices architecture enhances the robustness and reliability of CertSecure Manager by isolating services and containing failures to prevent system-wide disruptions. This approach results in a more stable and resilient solution, ultimately providing a higher level of service quality and performance for our users.
Benefits cultivated using micro-services are listed below:
- Scalability: Microservices allow you to scale individual components of your application independently, which can optimize resource usage and handle varying workloads more efficiently.
- Flexibility: Each microservice can be developed, deployed, and maintained separately, enabling agile development, faster updates, and easier testing and debugging.
- Technology Diversity: Microservices support the use of different programming languages, frameworks, and databases for each service, allowing you to choose the best tool for each specific task.
- Fault Isolation: Problems in one microservice typically do not affect the entire application, as failures are contained within the service where they occur, enhancing system resilience.
- Continuous Integration/Continuous Deployment (CI/CD): Microservices fit well with CI/CD pipelines, facilitating automated testing and deployment, resulting in faster and more reliable software releases.
Figure 1: CertSecure On-Prem Architecture
Figure 2: CertSecure SaaS Architecture
CertSecure Manager is made up of the following components coupled tightly together:
Authentication
CertSecure Manager leverages the robust security capabilities of Azure Active Directory (Azure AD) and Multi-Factor Authentication (MFA). These two ways provide a highly secure approach for authentication. By using the Azure AD way, we ensure a highly secure authentication process that surpasses the conventional method of using email and passwords. Azure AD authentication guarantees that only authorized users within your organization can access our solution, reinforcing data integrity and providing peace of mind for your sensitive information and critical processes.
On the other hand, by using MFA, someone with a valid username and password needs to perform additional verification with Google authenticator. This provides a scalable and secure solution for providing authentication in CertSecure Manager. MFA significantly strengthens your organization's security posture by making unauthorized access much more difficult in the system.
Backend
CertSecure Backends are the machines where the backend piece of code is deployed. Backend as a REST server. It serves as the core engine that handles incoming requests, processes data, and delivers responses to client applications. This server is designed to follow the principles of Representational State Transfer (REST), which means it uses stateless communication and standard HTTP methods (GET, POST, PUT, DELETE) to interact with clients.
Frontend
CertSecure Frontends represents the client-facing components of our software, where the frontend code is deployed. These frontends serve as the user interface and interaction points, facilitating a seamless user experience. They are responsible for rendering web pages, presenting content, capturing user input, and communicating with the backend server through APIs.
Our front-end solutions are meticulously designed to adhere to best practices in web development, offering an intuitive and visually appealing user interface. They enable users to interact with our software efficiently, delivering a user-friendly and responsive experience. Frontends play a pivotal role in shaping the way users perceive and interact with our application, ensuring accessibility, usability, and performance.
Connectors
CertSecure Connectors serve as the intermediary components that bridge the gap between diverse systems, enabling seamless communication and data exchange. These connectors play a vital role in facilitating interoperability, data flow, and integration between various software applications, databases, or platforms.
Our connectors are meticulously designed to understand the unique protocols, data formats, and APIs of the systems they connect. They ensure the smooth and reliable transfer of data, making it possible for different components to work together cohesively.
For how many connectors you need, see Pre-requisites.
Database
MongoDB database for storing persistent data critical to various aspects of its operation. This secure storage solution ensures the confidentiality and integrity of sensitive information, making it an ideal choice for configuration, user initialization, and supporting vital services like Email. For database encryption and authentication details, see Pre-requisites.
Agents
CertSecure Agents serve as dedicated components that actively perform tasks and functions within the CertSecure ecosystem. These agents are designed to execute specific operations, and monitor, or facilitate communication between various parts of the system, ensuring a seamless and efficient workflow.
Our CertSecure Agents are engineered to be task-oriented and operate autonomously, often carrying out tasks that require periodic or event-driven execution. They serve as silent workers behind the scenes, handling tasks such as data collection, processing, and analysis, all while ensuring data integrity and system efficiency.
For how many agents you need, see Pre-requisites.
Load Balancer
All server-side components within CertSecure can run with or without a load balancer, which lets you distribute incoming traffic across multiple server instances. For load balancer requirements, see Pre-requisites.
FAQ's
On which platforms does Certificate Management Solution – CertSecure Manager work?
CertSecure Manager can be deployed in different Cloud Environments, On-Premises, Hybrid IT Environments, and Kubernetes Clusters.
Does this solution support role-based access control for certificate management?
Yes, this solution supports Role-Based Access Control (RBAC) for certificate management. It provides a comprehensive list of roles and their associated permissions, allowing administrators to manage access effectively. New roles can be added, existing ones can be removed, and each role can be customized with specific permissions to align with organizational policies. This ensures that users have the appropriate level of access based on their responsibilities.
Will Certificate Management Solution – CertSecure Manager help me comply with the industry standards?
Yes, CertSecure Manager keeps you compliant with the highest levels of industry standards such as CA/B, PCI DSS, HIPAA, GDPR, and NIST to meet security and regulatory requirements.
Can I scale the solution as my microservices environment grows?
The solution should be scalable to accommodate the growth of your microservices ecosystem, allowing you to manage an increasing number of certificates and services.
Does the solution provide reporting and auditing capabilities for certificate management activities?
Reporting and auditing features are essential for tracking certificate-related activities and ensuring compliance. The CertSecure Manager provides detailed logs, audits, and reports.
Does the solution offer certificate templates to streamline the configuration of common certificate settings?
It does indeed. We provide certificate templates that simplify the configuration process for common certificate settings.
Can I set up custom notifications and alerts based on certificate-related events or issues?
Yes, you can configure custom notifications and alerts to stay informed about certificate events and resolve issues promptly.
Can the solution automatically renew certificates without manual intervention?
Our solution offers automated certificate renewal, reducing the risk of certificate expiration and the need for manual intervention.
What level of granularity can I achieve in access control and permissions for certificate management within the solution?
The solution offers fine-grained access control and permissions to allow you to define specific roles and responsibilities for certificate management tasks.
Can the solution integrate with certificate authorities (CAs) or public key infrastructures (PKIs) for external certificate issuance?
Yes, it can integrate with CAs and PKIs, allowing for external certificate issuance while still providing centralized management. More specifically Public CA integration like DigiCert, Entrust, AWS, and more is offered by CertSecure.
Can I discover unmanaged or rogue certificates in my environment?
Yes, CertSecure Manager includes a certificate discovery feature that scans networks and systems to identify unmanaged, expired, or unauthorized certificates.
Does CertSecure Manager support ACME protocol for automated certificate issuance?
Yes, CertSecure Manager provides ACME (Automated Certificate Management Environment) support, enabling automated certificate issuance and renewal for web servers, applications, and services.