Step 7 of 8
7. Choose where certificates come from
Copy link to the page “7. Choose where certificates come from”Choose where your certificates will be issued.
What you need
Copy link to the section “What you need”- The names the certificate should cover, prepared in step 6.
- A user with permission to create installation plans.
Use the certificate sources included with your licence
Copy link to the section “Use the certificate sources included with your licence”-
Open Certificates › Sources. Free certificates from Let’s Encrypt and Google through sslbrain Cloud (EU) are included with your licence and require no CA account setup.
-
Open Certificates › Profiles to see which certificate sources your profile uses.
-
Use the free certificate source in the proposals in step 8.
Check that it works
Copy link to the section “Check that it works”The free certificate source shows Ready under Certificates › Sources. The certificate itself is ordered when you start the installation plan in step 8.
Next step
Copy link to the section “Next step”Install the first certificate on your server.
If it fails
Copy link to the section “If it fails”- The free certificate source is not ready → open it under Certificates › Sources, read the reason and check the connection to sslbrain Cloud.
- The profile shows No source can issue right now → open the source linked by the profile and correct the error. See Renewal fails.
- Issuance stops at domain validation → follow Validation fails.
- An uploaded certificate cannot be installed → upload its matching private key with the certificate.
How the certificate connects to your servers
Copy link to the section “How the certificate connects to your servers”A certificate is issued according to its profile, and installation plans install it on servers. If several plans use the same certificate, they all receive the renewed version.
The certificate profile lists certificate sources in order and sets key requirements. If the first source cannot issue, the next is tried. Each renewal starts at the top. The appliance selects a key type supported by the profile, the certificate source and the services.
Adjust a certificate profile
Copy link to the section “Adjust a certificate profile”Open Certificates › Profiles › Create certificate profile. Give the profile a Name, add Certificate sources and use the arrows to put them in order. Select the allowed Key types and click Create profile. Profiles from sslbrain Cloud are edited in sslbrain Cloud.
The four certificate source types
Copy link to the section “The four certificate source types”- sslbrain Cloud: Let’s Encrypt, Google, DigiCert and Sectigo through sslbrain Cloud. Available products depend on your agreement.
- Custom ACME: your own account with a CA that the appliance contacts directly.
- Internal CA: Windows CA, EJBCA or SCEP for internal certificates.
- Manual import: a certificate you upload yourself.
The appliance creates the key for automatically issued certificates and sends the certificate request to the CA. The key is sent to the server when the installation plan installs the certificate.
Use certificates from FairSSL
Copy link to the section “Use certificates from FairSSL”Ask FairSSL to link your sslbrain Cloud account to your FairSSL account. Then select the relevant certificate source in the installation plan. Certificates are ordered automatically. Products priced in units use units purchased under Licences and units in sslbrain Cloud (licences and units).
DigiCert through sslbrain Cloud may require _dnsauth.<domain>. Use the record from the domain setup.
Use your own account with a CA
Copy link to the section “Use your own account with a CA”ACME is the protocol a CA uses to issue certificates automatically. Under Certificates › Profiles › ACME accounts, select Add ACME account. Give the account a Name. Choose the CA under Provider, or enter the ACME Directory URL. Fill in Email and, if the CA requires them, the EAB Key ID and EAB HMAC Key supplied by the CA.
Test connection only reads the CA’s directory. Click Create to save the account, then use it in your certificate source. The account page lets you edit the connection and view issued certificates.
Use certificates from your internal CA
Copy link to the section “Use certificates from your internal CA”Windows CA is a certificate source of type Internal CA. Follow Internal certificates from Windows CA. For EJBCA and SCEP, use the connection details supplied by your CA administrator.
Use a certificate you already have
Copy link to the section “Use a certificate you already have”Open Certificates › Upload certificate. Manual import accepts PEM, CRT, CER, DER, PFX, P12 and JKS, up to 5 MB per file. P7B is not accepted. Include the private key if installation plans should install the certificate. Without the key, it can be monitored.
Include the certificate chain: the intermediate certificates that link the server’s certificate to a root the browser trusts. An imported certificate is not renewed automatically. Use Upload new version on the certificate when it needs replacing.
Change a certificate’s source
Copy link to the section “Change a certificate’s source”Select the certificate under Certificates and click Change certificate source. Select the certificate source you want, read What happens when you change and click At next renewal.
The next version is issued from the selected source. The current certificate stays in use until then. Installation plans install the version if they are active, follow the certificate’s version and have Install on renewal enabled. The selected certificate profile determines whether reserve sources are available.
Choose a lifetime at Let’s Encrypt
Copy link to the section “Choose a lifetime at Let’s Encrypt”The ACME profile (certificate lifetime) field on the certificate source shows the profiles offered by the CA. This is the CA’s lifetime choice, separate from your certificate profile with sources and key requirements. It applies to all certificates from the source and requires Basic, Professional or Enterprise.
Use shortlived only when both DNS validation and installation run automatically. It lasts about 6 days and renews after about 3. If issuance moves to another CA, that CA’s lifetime applies.