Skip to content

Commit 0557959

Browse files
author
Keyfactor
committed
Update generated docs
1 parent b3f3d50 commit 0557959

1 file changed

Lines changed: 65 additions & 142 deletions

File tree

‎README.md‎

Lines changed: 65 additions & 142 deletions
Original file line numberDiff line numberDiff line change
@@ -447,70 +447,90 @@ This section outlines all required ports, file access, permissions, and validati
447447

448448
* **Gateway Registration**
449449

450-
TODO Gateway Registration is a required section
450+
Each ACME CA issues certificates that chain to a specific intermediate and root certificate. For trust validation and proper integration with the Keyfactor Gateway, the following steps are required for **every ACME CA** used in your environment.
451451

452-
* **CA Connection**
452+
---
453453

454-
Populate using the configuration fields collected in the [requirements](#requirements) section.
454+
### 🔍 Retrieving Root and Intermediate Certificates
455455

456-
* **DirectoryUrl** - ACME directory URL (e.g. Let's Encrypt, ZeroSSL, etc.)
457-
* **Email** - Email for ACME account registration.
458-
* **EabKid** - External Account Binding Key ID (optional)
459-
* **EabHmacKey** - External Account Binding HMAC key (optional)
460-
* **SignerEncryptionPhrase** - Used to encrypt singer information when account is saved to disk (optional)
461-
* **DnsProvider** - DNS Provider to use for ACME DNS-01 challenges (options Google, Cloudflare, AwsRoute53, Azure, Ns1)
462-
* **Google_ServiceAccountKeyPath** - Google Cloud DNS: Path to service account JSON key file only if using Google DNS (Optional)
463-
* **Google_ProjectId** - Google Cloud DNS: Project ID only if using Google DNS (Optional)
464-
* **Cloudflare_ApiToken** - Cloudflare DNS: API Token only if using Cloudflare DNS (Optional)
465-
* **Azure_ClientId** - Azure DNS: ClientId only if using Azure DNS and Not Managed Itentity in Azure (Optional)
466-
* **Azure_ClientSecret** - Azure DNS: ClientSecret only if using Azure DNS and Not Managed Itentity in Azure (Optional)
467-
* **Azure_SubscriptionId** - Azure DNS: SubscriptionId only if using Azure DNS and Not Managed Itentity in Azure (Optional)
468-
* **Azure_TenantId** - Azure DNS: TenantId only if using Azure DNS and Not Managed Itentity in Azure (Optional)
469-
* **AwsRoute53_AccessKey** - Aws DNS: Access Key only if not using AWS DNS and default AWS Chain Creds on AWS (Optional)
470-
* **AwsRoute53_SecretKey** - Aws DNS: Secret Key only if using AWS DNS and not using default AWS Chain Creds on AWS (Optional)
471-
* **Ns1_ApiKey** - Ns1 DNS: Api Key only if Using Ns1 DNS (Optional)
456+
Here is how to obtain the root and intermediate CA certificates from supported ACME providers:
472457

473-
2. Define [Certificate Profiles](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCP-Gateway.htm) and [Certificate Templates](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm) for the Certificate Authority as required. One Certificate Profile must be defined per Certificate Template. It's recommended that each Certificate Profile be named after the Product ID. The Acme plugin supports the following product IDs:
458+
#### Let's Encrypt
474459

475-
* **default**
460+
- **Root**: ISRG Root X1
461+
- **Intermediate**: R3
476462

477-
3. Follow the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Keyfactor.htm) to add each defined Certificate Authority to Keyfactor Command and import the newly defined Certificate Templates.
463+
**How to Get:**
464+
- Browse to: https://letsencrypt.org/certificates/
465+
- Download both the **ISRG Root X1** and **R3 Intermediate Certificate (PEM format)**.
478466

467+
#### Google Certificate Authority Service (CAS)
479468

480-
## Compatibility
469+
- **Root** and **Intermediate** are custom per CA Pool.
481470

482-
The Acme AnyCA Gateway REST plugin is compatible with the Keyfactor AnyCA Gateway REST 24.2 and later.
471+
**How to Get:**
472+
1. In the [Google Cloud Console](https://console.cloud.google.com/security/privateca), navigate to your CA pool.
473+
2. Click the CA name and go to the **Certificates** tab.
474+
3. Download the **root** and **intermediate** certificates for the issuing CA in PEM format.
483475

484-
## Support
485-
The Acme AnyCA Gateway REST plugin is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com.
476+
#### ZeroSSL
486477

487-
> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
478+
- **Root**: USERTrust RSA Certification Authority
479+
- **Intermediate**: ZeroSSL RSA Domain Secure Site CA
488480

489-
## Installation
481+
**How to Get:**
482+
- Visit: https://zerossl.com
483+
- Download the full certificate chain in PEM format.
484+
- Extract individual certs if needed using OpenSSL or a text editor.
490485

491-
1. Install the AnyCA Gateway REST per the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/InstallIntroduction.htm).
486+
#### Buypass
492487

493-
2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [Acme AnyCA Gateway REST plugin](https://github.com/Keyfactor/acme-caplugin/releases/latest) from GitHub.
488+
- **Root**: Buypass Class 3 Root CA
489+
- **Intermediate**: Buypass Class 3 CA 1 / G2 (depends on issuance)
494490

495-
3. Copy the unzipped directory (usually called `net6.0`) to the Extensions directory:
491+
**How to Get:**
492+
- Go to: https://www.buypass.com
493+
- Download both root and intermediate in PEM or DER format.
496494

497-
```shell
498-
Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions
499-
```
495+
---
500496

501-
> The directory containing the Acme AnyCA Gateway REST plugin DLLs (`net6.0`) can be named anything, as long as it is unique within the `Extensions` directory.
497+
### 🧩 Installing Certificates on the Keyfactor Gateway Server
502498

503-
4. Restart the AnyCA Gateway REST service.
499+
Once downloaded, the **root and intermediate certificates must be installed** in the proper Windows certificate stores on the Gateway server.
504500

505-
5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the Acme plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal.
501+
#### Steps:
506502

507-
## Configuration
503+
1. **Open** `certlm.msc` (Local Computer Certificates)
504+
2. Install the **Root CA certificate** into:
505+
- `Trusted Root Certification Authorities` → `Certificates`
506+
3. Install the **Intermediate CA certificate** into:
507+
- `Intermediate Certification Authorities` → `Certificates`
508508

509-
1. Follow the [official AnyCA Gateway REST documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm) to define a new Certificate Authority, and use the notes below to configure the **Gateway Registration** and **CA Connection** tabs:
509+
You can import certificates using the GUI or PowerShell:
510510

511-
* **Gateway Registration**
511+
```powershell
512+
Import-Certificate -FilePath "C:\path\to\intermediate.crt" -CertStoreLocation "Cert:\LocalMachine\CA"
513+
Import-Certificate -FilePath "C:\path\to\root.crt" -CertStoreLocation "Cert:\LocalMachine\Root"
514+
```
515+
516+
---
517+
518+
### 🔑 Using the Intermediate Thumbprint
519+
520+
When registering a new CA in Keyfactor Command:
512521

513-
TODO Gateway Registration is a required section
522+
- You must specify the **thumbprint** of the Intermediate CA certificate.
523+
- This is used to associate issued certificates with the correct issuing chain.
524+
525+
**How to Get the Thumbprint:**
526+
527+
1. In `certlm.msc`, open the certificate under **Intermediate Certification Authorities**.
528+
2. Go to **Details** tab → Scroll to **Thumbprint**.
529+
3. Copy the hex string (ignore spaces).
530+
531+
---
532+
533+
⚠️ All certificate chains must be trusted by the Gateway OS. If the intermediate is missing or untrusted, issuance will fail or returned certificates may not chain properly.
514534

515535
* **CA Connection**
516536

@@ -533,113 +553,16 @@ The Acme AnyCA Gateway REST plugin is supported by Keyfactor for Keyfactor custo
533553
* **AwsRoute53_SecretKey** - Aws DNS: Secret Key only if using AWS DNS and not using default AWS Chain Creds on AWS (Optional)
534554
* **Ns1_ApiKey** - Ns1 DNS: Api Key only if Using Ns1 DNS (Optional)
535555
536-
2. The ACME Gateway Plugin does not require specific certificate templates to be mapped to individual ACME providers in Keyfactor. Instead, you have the flexibility to define templates based on your organization's needs or the specific capabilities of the ACME provider.
537-
538-
Key considerations:
539-
- There is no required or hardcoded template for enrollment.
540-
- The **default template** configured in Keyfactor Command will work for the majority of cases.
541-
- You may create additional templates with specific **key types and sizes** (e.g., RSA 2048, RSA 4096, ECC P-256) to match the requirements or limitations of your chosen ACME CA.
542-
543-
This allows you to support a variety of use cases or certificate profiles without being tightly coupled to the ACME provider’s template logic. The ACME Gateway simply passes the CSR (generated using the selected Keyfactor template) to the ACME provider.
556+
2. Define [Certificate Profiles](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCP-Gateway.htm) and [Certificate Templates](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm) for the Certificate Authority as required. One Certificate Profile must be defined per Certificate Template. It's recommended that each Certificate Profile be named after the Product ID. The Acme plugin supports the following product IDs:
544557

545-
> ✅ The plugin will accept any Keyfactor template that produces a valid CSR in a format compatible with the selected ACME provider.
558+
* **default**
546559

547560
3. Follow the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Keyfactor.htm) to add each defined Certificate Authority to Keyfactor Command and import the newly defined Certificate Templates.
548561

549-
## Root CA Configuration
550-
551-
Each ACME CA issues certificates that chain to a specific intermediate and root certificate. For trust validation and proper integration with the Keyfactor Gateway, the following steps are required for **every ACME CA** used in your environment.
552-
553-
---
554-
555-
### 🔍 Retrieving Root and Intermediate Certificates
556-
557-
Here is how to obtain the root and intermediate CA certificates from supported ACME providers:
558-
559-
#### Let's Encrypt
560-
561-
- **Root**: ISRG Root X1
562-
- **Intermediate**: R3
563-
564-
**How to Get:**
565-
- Browse to: https://letsencrypt.org/certificates/
566-
- Download both the **ISRG Root X1** and **R3 Intermediate Certificate (PEM format)**.
567-
568-
#### Google Certificate Authority Service (CAS)
569-
570-
- **Root** and **Intermediate** are custom per CA Pool.
571-
572-
**How to Get:**
573-
1. In the [Google Cloud Console](https://console.cloud.google.com/security/privateca), navigate to your CA pool.
574-
2. Click the CA name and go to the **Certificates** tab.
575-
3. Download the **root** and **intermediate** certificates for the issuing CA in PEM format.
576-
577-
#### ZeroSSL
578-
579-
- **Root**: USERTrust RSA Certification Authority
580-
- **Intermediate**: ZeroSSL RSA Domain Secure Site CA
581-
582-
**How to Get:**
583-
- Visit: https://zerossl.com
584-
- Download the full certificate chain in PEM format.
585-
- Extract individual certs if needed using OpenSSL or a text editor.
586-
587-
#### Buypass
588-
589-
- **Root**: Buypass Class 3 Root CA
590-
- **Intermediate**: Buypass Class 3 CA 1 / G2 (depends on issuance)
591-
592-
**How to Get:**
593-
- Go to: https://www.buypass.com
594-
- Download both root and intermediate in PEM or DER format.
595-
596-
---
597-
598-
### 🧩 Installing Certificates on the Keyfactor Gateway Server
599562

600-
Once downloaded, the **root and intermediate certificates must be installed** in the proper Windows certificate stores on the Gateway server.
601-
602-
#### Steps:
603-
604-
1. **Open** `certlm.msc` (Local Computer Certificates)
605-
2. Install the **Root CA certificate** into:
606-
- `Trusted Root Certification Authorities` → `Certificates`
607-
3. Install the **Intermediate CA certificate** into:
608-
- `Intermediate Certification Authorities` → `Certificates`
609-
610-
You can import certificates using the GUI or PowerShell:
611-
612-
```powershell
613-
Import-Certificate -FilePath "C:\path\to\intermediate.crt" -CertStoreLocation "Cert:\LocalMachine\CA"
614-
Import-Certificate -FilePath "C:\path\to\root.crt" -CertStoreLocation "Cert:\LocalMachine\Root"
615-
```
616-
617-
---
618-
619-
### 🔑 Using the Intermediate Thumbprint
620-
621-
When registering a new CA in Keyfactor Command:
622-
623-
- You must specify the **thumbprint** of the Intermediate CA certificate.
624-
- This is used to associate issued certificates with the correct issuing chain.
625-
626-
**How to Get the Thumbprint:**
627-
628-
1. In `certlm.msc`, open the certificate under **Intermediate Certification Authorities**.
629-
2. Go to **Details** tab → Scroll to **Thumbprint**.
630-
3. Copy the hex string (ignore spaces).
631-
632-
---
633-
634-
⚠️ All certificate chains must be trusted by the Gateway OS. If the intermediate is missing or untrusted, issuance will fail or returned certificates may not chain properly.
635-
636-
## License
637-
638-
Apache License 2.0, see [LICENSE](LICENSE).
639-
640-
## Related Integrations
563+
## Compatibility
641564

642-
See all [Keyfactor Any CA Gateways (REST)](https://github.com/orgs/Keyfactor/repositories?q=anycagateway).
565+
The Acme AnyCA Gateway REST plugin is compatible with the Keyfactor AnyCA Gateway REST 24.2 and later.
643566

644567

645568
## License

0 commit comments

Comments
 (0)