Managing CA connectors

Configure a CA connector

Each CA has specific configuration instructions that must be completed once the CA connector is installed.

  • AWS Private CA

  • DigiCert

  • EJBCA

  • GCP CA Service

  • Microsoft CA

  • GlobalSign Atlas

  1. In a command prompt window, navigate to the CA connector install location.

  2. Create a new backend.

    sectigo-cbcs.exe backend add -name <backend_name> -type acmpca -accesskeyid <key_id> -secretaccesskey <secret_access_key> -region <region>

    The command options are outlined in the following table.

    Option Description

    name

    The name used to represent the CA backend.

    type

    The type of CA that is being connected to.

    For ACM the value must be acmpca.

    accesskeyid

    The AWS access key ID generated when adding a user to AWS.

    secretaccesskey

    The AWS secret access key generated when adding a user to AWS.

    region

    The region specified during CA creation.
    Sample command
    sectigo-cbcs.exe backend add -name test-acmpca -type acmpca -accesskeyid AKIAIOSFODNN7EXAMPLE -secretaccesskey wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY -region us-east-1

  1. In a command prompt window, navigate to the CA connector install location.

  2. Create a new backend.

    sectigo-cbcs.exe backend add -name <backend_name> -type digicert -apikey <digicert_api_key>

    The command options are outlined in the following table.

    Option Description

    name

    The name used to represent the CA backend.

    type

    The type of CA that is being connected to.

    For DigiCert the value must be digicert.

    apikey

    The DigiCert API key.
    Sample command
    sectigo-cbcs.exe backend add -name DigiCertCA -type digicert -apikey 49ca638f-ec73-40fa-a6f6-6a85e997a5a7

  1. In a command prompt window, navigate to the CA connector install location.

  2. Create a new backend using either mutual TLS (mTLS) authentication or OAuth 2.0 client credentials.

    1. To use mTLS authentication, run the following command:

      sectigo-cbcs.exe backend add -name <backend_name> -type ejbca -baseurl <ejbca_base_url> -ca <ca_name> -cert <path_to_client_certificate> -key <path_to_client_private_key>

    2. To use OAuth 2.0 client-credentials authentication, run the following command:

      sectigo-cbcs.exe backend add -name <backend_name> -type ejbca -baseurl <ejbca_base_url> -ca <ca_name> -tokenendpoint <oauth_token_endpoint> -clientid <client_id> -clientsecret <client_secret>
      You must configure one authentication method. Do not provide both mTLS and OAuth 2.0 authentication options.

      For an encrypted mTLS private key, add the -password <private_key_password> option to the command.

      The command options are outlined in the following table.

      Option Description

      name

      The name used to represent the local EJBCA backend.

      type

      The type of CA that is being connected to.

      For EJBCA, the value must be ejbca.

      baseurl

      The root URL of the EJBCA server.

      Do not include the /ejbca/…​ path.

      ca

      The name of the EJBCA CA that the local backend uses.

      Each local EJBCA backend can use one CA.

      cert

      The path to the client certificate used for mTLS authentication.

      key

      The path to the private key for the client certificate used for mTLS authentication.

      password

      The password for the encrypted private key.

      This option is required only when the private key is encrypted.

      tokenendpoint

      The OAuth 2.0 token endpoint.

      clientid

      The OAuth 2.0 client ID.

      clientsecret

      The OAuth 2.0 client secret.
      Sample mTLS command
      sectigo-cbcs.exe backend add -name EJBCA-CA1 -type ejbca -baseurl https://ejbca.example.com -ca ExampleCA -cert C:/EJBCA/client.pem -key C:/EJBCA/client-key.pem
      Sample OAuth 2.0 command
      sectigo-cbcs.exe backend add -name EJBCA-CA1 -type ejbca -baseurl https://ejbca.example.com -ca ExampleCA -tokenendpoint https://auth.example.com/realms/ejbca/protocol/openid-connect/token -clientid scm-connector -clientsecret example-client-secret

  3. (Optional) For mTLS authentication, delete the client certificate and private-key files after creating the local backend.

    The CA connector copies and encrypts the mTLS certificate and private key when the local backend is created.

  1. In a command prompt window, navigate to the CA connector install location.

  2. Create a new backend.

    sectigo-cbcs.exe backend add -name <backend_name> -type gcpcas -project <project_id> -location <location> -key <path_to_key_file>

    The command options are outlined in the following table.

    Option Description

    name

    The name used to represent the CA backend.

    type

    The type of CA that is being connected to.

    For GCP CA Service the value must be gcpcas.

    project

    The GCP Project ID.

    location

    The location specified during CA creation.

    key

    The path to the service account key .json file.
    Sample command
    sectigo-cbcs.exe backend add -name GoogleCA -type gcpcas -project private-ca-342871 -location us-east-1 -key C:/Users/sampleuser/Downloads/service-account-key.json

  3. (Optional) Delete the service account key file.

    All required information is copied and encrypted from this file during the creation of the backend CA.

  1. In a command prompt window, navigate to the CA connector install location.

  2. Create a new backend.

    sectigo-cbcs.exe backend add -name <backend_name> -type msca -server <server> -ca <ca_common_name>

    The command options are outlined in the following table.

    Option Description

    name

    The name used to represent the CA backend.

    type

    The type of CA that is being connected to.

    For Microsoft CA the value must be msca.

    server

    The hostname of the server hosting the Microsoft CA.

    ca

    The CA’s Common Name.
    Sample command
    sectigo-cbcs.exe backend add -name MSCA1 -type msca -server SectigoTestCA -ca local-SectigoTestCA-CA

  3. Generate the Enrollment Agent (EA) key pair and enroll the Enrollment Agent Certificate.

    sectigo-cbcs.exe backend msca enroll-agent-cert -name <backend_name> -ca <ca_common_name>
    You can specify an alternative EA template by adding the -template <your_ea_name> option.

  1. In a command prompt window, navigate to the CA connector install location.

  2. Create a new backend.

    sectigo-cbcs.exe backend add -name <Name> -type globalsign_atlas -apikey <API Key> -apisecret <API Secret> -cert <path/to/mtls.crt> -key <path/to/mtls.key>

    The command options are outlined in the following table.

    Option Description

    name

    The name used to represent the CA backend.

    type

    The type of CA that is being connected to.

    For GlobalSign Atlas the value must be globalsign_atlas.

    apikey

    The API key that was generated.

    apisecret

    The API secret.

    cert

    The path to the mTLS client certificate downloaded from the GlobalSign Atlas API Credential card.

    key

    The path to the private key that corresponds to the mTLS client certificate.
    Sample command
    sectigo-cbcs.exe backend add -name GlobalSign -type globalsign_atlas -apikey <api_key> -apisecret <api_secret> -cert C:/Users/sampleuser/Downloads/mtls.crt -key C:/Users/sampleuser/Downloads/mtls.key

You can view additional CLI commands with the help command.

sectigo-cbcs help

Restore a CA connector

CA Connectors that are offline for over 30 days may lose the ability to connect to SCM. In most cases, this connectivity can be restored by doing the following:

  1. Log in to SCM.

  2. Navigate to Integrations  CA Connectors.

  3. Select the connector to be restored, and click Restore.

  4. Click OK.

  5. Save the displayed token, and close the Restore Connector dialog.

  6. In a command prompt window, navigate to the CA connector install location.

  7. Restore the connector.

    register -token <registration_token> -force

Update a CA connector

  1. Log in to SCM.

  2. From the left-hand menu, select About.

  3. Click the Download CA Connector icon.

  4. (Optional) If required, move the SectigoCBCS.msi file to the CA connector machine.

  5. Right-click SectigoCBCS.msi and click Install.

    The package automatically recognizes that there’s an existing version of the CA connector and initiates an update instead of a new install.

  6. Read the EULA, select I accept the terms in the License Agreement, and click Next.

  7. (Optional) Specify an installation location.

  8. Click Next, Install, and Close.

  9. In SCM, navigate to the CA Connectors page and verify that the connector is connected and showing the correct version.

Uninstall a CA connector

  1. In Windows, navigate to Settings  Apps & features.

  2. Search for Sectigo.

  3. Select the Sectigo CA Backend Connector and click Uninstall.

  4. (Optional) Delete the files and logs associated with the CA connector.

    1. Navigate to C:\ProgramData\Sectigo Limited.

    2. Delete the SectigoCBCS folder.

      This cannot be undone. Only delete this folder if you want to completely remove all files and logs related to the CA connector.

  5. In SCM, navigate to Integrations  CA Connectors.

  6. Select the connector you want to delete.

  7. Click the Delete icon.

  8. Click Delete.

CA connector service commands

Command Description

Start

Start a CA connector:

sc start SectigoCBCS

Stop

Stop a CA connector:

sc stop SectigoCBCS

Query

Query the status of a CA connector:

sc query SectigoCBCS