|
1 | | -<h1 align="center" style="border-bottom: none"> |
2 | | - GoDaddy AnyCA Gateway Plugin |
3 | | -</h1> |
4 | | - |
5 | | -<p align="center"> |
6 | | - <!-- Badges --> |
7 | | -<img src="https://img.shields.io/badge/integration_status-prototype-3D1973?style=flat-square" alt="Integration Status: prototype" /> |
8 | | -<a href="https://github.com/Keyfactor/godaddy-anycagateway/releases"><img src="https://img.shields.io/github/v/release/Keyfactor/godaddy-anycagateway?style=flat-square" alt="Release" /></a> |
9 | | -<img src="https://img.shields.io/github/issues/Keyfactor/godaddy-anycagateway?style=flat-square" alt="Issues" /> |
10 | | -<img src="https://img.shields.io/github/downloads/Keyfactor/godaddy-anycagateway/total?style=flat-square&label=downloads&color=28B905" alt="GitHub Downloads (all assets, all releases)" /> |
11 | | -</p> |
12 | | - |
13 | | -<p align="center"> |
14 | | - <!-- TOC --> |
15 | | - <a href="#support"> |
16 | | - <b>Support</b> |
17 | | - </a> |
18 | | - · |
19 | | - <a href="#installation"> |
20 | | - <b>Installation</b> |
21 | | - </a> |
22 | | - · |
23 | | - <a href="#license"> |
24 | | - <b>License</b> |
25 | | - </a> |
26 | | - · |
27 | | - <a href="https://github.com/orgs/Keyfactor/repositories?q=anycagateway"> |
28 | | - <b>Related Integrations</b> |
29 | | - </a> |
30 | | -</p> |
31 | | - |
32 | | - |
33 | | -The GoDaddy AnyCA REST plugin extends the capabilities of the [GoDaddy Certificate Authority (CA)](https://www.godaddy.com/web-security/ssl-certificate) to Keyfactor Command via the Keyfactor . The plugin represents a fully featured AnyCA REST Plugin with the following capabilies: |
34 | | -* CA Sync: |
35 | | - * Download all certificates issued to the customer by the GoDaddy CA. |
36 | | -* Certificate enrollment for all published GoDaddy Certificate SKUs: |
37 | | - * Support certificate enrollment (new keys/certificate). |
38 | | - * Support certificate renewal (extend the life of a previously issued certificate with the same or different domain names). |
39 | | - * Support certificate re-issuance (new public/private keys with the same or different domain names). |
40 | | -* Certificate revocation: |
41 | | - * Request revocation of a previously issued certificate. |
42 | | - |
43 | | - |
44 | | - |
45 | | -## Compatibility |
46 | | - |
47 | | -The GoDaddy AnyCA Gateway plugin is compatible with the Keyfactor AnyCA Gateway REST 24.2 and later. |
48 | | - |
49 | | -## Support |
50 | | -The GoDaddy AnyCA Gateway plugin is open source and community supported, meaning that there is **no SLA** applicable. |
51 | | - |
52 | | -> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. |
53 | | -
|
54 | | -## Requirements |
55 | | - |
56 | | -1. **GoDaddy Account** |
57 | | - |
58 | | - To use the GoDaddy AnyCA REST plugin, a production GoDaddy account must be created and configured fully. To create a new account, follow [GoDaddy's official documentation](https://www.godaddy.com/help/create-a-godaddy-account-16618). Make sure that your [account Profile is configured fully](https://www.godaddy.com/help/update-my-godaddy-account-profile-27250) with at least the following fields: |
59 | | - * Full Name |
60 | | - * Address |
61 | | - * Organization |
62 | | - * Email |
63 | | - * Primary Phone |
64 | | - |
65 | | - Your GoDaddy account must also have at least one payment method. Follow [GoDaddy's official documentation](https://www.godaddy.com/help/add-a-payment-method-to-my-godaddy-account-20037) to add a payment method. |
66 | | - |
67 | | -2. **GoDaddy Certificate** |
68 | | - |
69 | | - The GoDaddy AnyCA REST plugin does not purchase certificates from GoDaddy on its own. To enroll a certificate using the plugin, you must first [purchase a certificate from GoDaddy](https://www.godaddy.com/web-security/ssl-certificate). Once purchased, the AnyCA REST plugin enables enrollment, [renewal](https://www.godaddy.com/help/renewing-my-ssl-certificate-864), and [rekeying (re-issuing)](https://www.godaddy.com/help/ssl-certificates-1000006) your purchased certificate. |
70 | | - |
71 | | -3. **GoDaddy API Key** |
72 | | - |
73 | | - The GoDaddy AnyCA REST plugin uses the [GoDaddy API](https://developer.godaddy.com/doc/endpoint/certificates) to perform all certificate operations. GoDaddy offers an environment for testing (OTE) and an environment for production use (Production). To configure the plugin, follow the [official GoDaddy documentation](https://developer.godaddy.com/getstarted) to create a [production API key](https://developer.godaddy.com/keys). To configure the , you'll need the following parameters handy: |
74 | | - |
75 | | - * API URL (https://api.godaddy.com or https://api.ote-godaddy.com) |
76 | | - * API Key |
77 | | - * API Secret |
78 | | - |
79 | | -4. **GoDaddy Shopper ID** |
80 | | - |
81 | | - To synchronize certificates issued by the GoDaddy CA, the GoDaddy AnyCA REST plugin needs to know your Shopper ID (shown as Customer # on the GoDaddy website). The Shopper ID is a number with a max length of 10 (e.g., 1234567890). To find your Shopper ID, sign into [GoDaddy](https://www.godaddy.com/) and click on your name dropdown on the top right. The Shopper ID is shown as **Customer #** in this dropdown. |
82 | | - |
83 | | - |
84 | | - |
85 | | -## Installation |
86 | | - |
87 | | -1. Install the AnyCA Gateway REST per the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/InstallIntroduction.htm). |
88 | | - |
89 | | -2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [GoDaddy AnyCA Gateway REST plugin](https://github.com/Keyfactor/godaddy-anycagateway/releases/latest) from GitHub. |
90 | | - |
91 | | -3. Copy the unzipped directory (usually called `net6.0`) to the Extensions directory: |
92 | | - |
93 | | - ```shell |
94 | | - Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions |
95 | | - ``` |
96 | | - |
97 | | - > The directory containing the GoDaddy AnyCA Gateway REST plugin DLLs (`net6.0`) can be named anything, as long as it is unique within the `Extensions` directory. |
98 | | - |
99 | | -4. Restart the AnyCA Gateway REST service. |
100 | | - |
101 | | -5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the GoDaddy plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal. |
102 | | - |
103 | | -## Configuration |
104 | | - |
105 | | -1. Follow the [official AnyCA Gateway REST documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm) to define a new Certificate Authority, and use the notes below to configure the **Gateway Registration** and **CA Connection** tabs: |
106 | | - |
107 | | - * **Gateway Registration** |
108 | | - |
109 | | - |
110 | | - GoDaddy has four available Certificate Authorities: |
111 | | - |
112 | | - - GoDaddy SHA-1 (GODADDY_SHA_1) |
113 | | - - [Root Certificate](https://certs.godaddy.com/repository/gd-class2-root.crt) |
114 | | - - [Intermediate Certificate](https://certs.godaddy.com/repository/gd_intermediate.crt.pem) |
115 | | - - GoDaddy SHA256 (GODADDY_SHA_2) |
116 | | - - [Root Certificate](https://certs.godaddy.com/repository/gdroot-g2.crt) |
117 | | - - [Intermediate Certificate](https://certs.godaddy.com/repository/gdig2.crt.pem) |
118 | | - - Starfield SHA-1 (STARFIELD_SHA_1) |
119 | | - - [Root Certificate](https://certs.godaddy.com/repository/sf-class2-root.crt) |
120 | | - - [Intermediate Certificate](https://certs.godaddy.com/repository/sf_intermediate.crt.pem) |
121 | | - - Starfield SHA256 (STARFIELD_SHA_2) |
122 | | - - [Root Certificate](https://certs.godaddy.com/repository/sfroot-g2.crt) |
123 | | - - [Intermediate Certificate](https://certs.godaddy.com/repository/sfig2.crt.pem) |
124 | | - |
125 | | - Each defined Certificate Authority in the AnyCA REST can support one certificate authority. Since GoDaddy has four available Certificate Authorities, if you require certificate enrollment from multiple GoDaddy Certificate Authorities, you must define multiple Certificate Authorities in the AnyCA Gateway REST. This will manifest in Command as one GoDaddy CA per defined Certificate Authority. |
126 | | - |
127 | | - |
128 | | - |
129 | | - * **CA Connection** |
130 | | - |
131 | | - Populate using the configuration fields collected in the [requirements](#requirements) section. |
132 | | - |
133 | | - |
134 | | - |
135 | | - * **ApiKey** - The API Key for the GoDaddy API |
136 | | - * **ApiSecret** - The API Secret for the GoDaddy API |
137 | | - * **BaseUrl** - The Base URL for the GoDaddy API - Usually either https://api.godaddy.com or https://api.ote-godaddy.com |
138 | | - * **ShopperId** - The Shopper ID of the GoDaddy account to use for the API calls (ex: 1234567890) - has a max length of 10 digits |
139 | | - * **Enabled** - Flag to Enable or Disable gateway functionality. Disabling is primarily used to allow creation of the CA prior to configuration information being available. |
140 | | - |
141 | | -2. Define [Certificate Profiles](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCP-Gateway.htm) and [Certificate Templates](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm) for the Certificate Authority as required. One Certificate Profile must be defined per Certificate Template. It's recommended that each Certificate Profile be named after the Product ID. The GoDaddy plugin supports the following product IDs: |
142 | | -
|
143 | | -
|
144 | | -
|
145 | | - * **DV_SSL** |
146 | | - * **DV_WILDCARD_SSL** |
147 | | - * **EV_SSL** |
148 | | - * **OV_CS** |
149 | | - * **OV_DS** |
150 | | - * **OV_SSL** |
151 | | - * **OV_WILDCARD_SSL** |
152 | | - * **UCC_DV_SSL** |
153 | | - * **UCC_EV_SSL** |
154 | | - * **UCC_OV_SSL** |
155 | | -
|
156 | | -3. Follow the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Keyfactor.htm) to add each defined Certificate Authority to Keyfactor Command and import the newly defined Certificate Templates. |
157 | | -
|
158 | | -4. In Keyfactor Command, for each imported Certificate Template, follow the [official documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Configuring%20Template%20Options.htm) to define enrollment fields for each of the following parameters: |
159 | | -
|
160 | | -
|
161 | | -
|
162 | | - * **JobTitle** - The job title of the certificate requestor |
163 | | - * **CertificateValidityInYears** - Number of years the certificate will be valid for |
164 | | - * **LastName** - Last name of the certificate requestor |
165 | | - * **FirstName** - First name of the certificate requestor |
166 | | - * **Email** - Email address of the requestor |
167 | | - * **Phone** - Phone number of the requestor |
168 | | - * **SlotSize** - Maximum number of SANs that a certificate may have - valid values are [FIVE, TEN, FIFTEEN, TWENTY, THIRTY, FOURTY, FIFTY, ONE_HUNDRED] |
169 | | - * **OrganizationName** - Name of the organization to be validated against |
170 | | - * **OrganizationAddress** - Address of the organization to be validated against |
171 | | - * **OrganizationCity** - City of the organization to be validated against |
172 | | - * **OrganizationState** - Full state name of the organization to be validated against |
173 | | - * **OrganizationCountry** - 2 character abbreviation of the country of the organization to be validated against |
174 | | - * **OrganizationPhone** - Phone number of the organization to be validated against |
175 | | - * **RegistrationAgent** - Registration agent name assigned to the organization when its documents were filed for registration |
176 | | - * **RegistrationNumber** - Registration number assigned to the organization when its documents were filed for registration |
177 | | - * **RootCAType** - The certificate's root CA - Depending on certificate expiration date, SHA_1 not be allowed. Will default to SHA_2 if expiration date exceeds sha1 allowed date. Options are GODADDY_SHA_1, GODADDY_SHA_2, STARFIELD_SHA_1, or STARFIELD_SHA_2. |
178 | | - |
179 | | -## License |
180 | | - |
181 | | -Apache License 2.0, see [LICENSE](LICENSE). |
182 | | - |
183 | | -## Related Integrations |
184 | | - |
185 | | -See all [Keyfactor Any CA Gateways (REST)](https://github.com/orgs/Keyfactor/repositories?q=anycagateway). |
0 commit comments