Managing SSL/TLS automation endpoints

Orchestration gateways are deployed within your internal network to allow SSL certificate auto-installation on added endpoints.

Orchestration gateways can be configured for certificate installation in the following ways:

  • Local — An orchestration gateway is installed on the same host as the endpoint. The orchestration gateway uses local commands to interact with the endpoint software and configuration.

  • Remote — A single orchestration gateway is installed on a central server and configured with the details of the other endpoints on your network. The orchestration gateway uses remote connections that require authentication to interact with the endpoint software and configuration.

Orchestration gateway connection types are limited as outlined in the following table.

Endpoint Type Gateway Installation on Windows OS Gateway Installation on Linux OS Gateway Installation on Docker

Apache 2.4

Remote auto-installation

Local/Remote auto-installation

Remote auto-installation

Tomcat 9.x, 10.x, 11.x

Local/Remote auto-installation

Local/Remote auto-installation

Remote auto-installation

Microsoft IIS 10

Local/Remote auto-installation

Remote auto-installation

Remote auto-installation

Windows certificate store

Local/Remote auto-installation

Remote auto-installation

Remote auto-installation

F5 BIG-IP 15.1, 16.1, 17.1

Remote auto-installation

Remote auto-installation

Remote auto-installation

F5 XC

Remote auto-installation

Remote auto-installation

Remote auto-installation

Imperva

Remote auto-installation

Remote auto-installation

Remote auto-installation

Nginx

Local/Remote auto-installation

Local/Remote auto-installation

Remote auto-installation

P12, JKS, PEM

Local/Remote auto-installation

Local/Remote auto-installation

Remote auto-installation

Citrix

Remote auto-installation

Remote auto-installation

Remote auto-installation

Cloudflare

Remote auto-installation

Remote auto-installation

Remote auto-installation

Akamai

Remote auto-installation

Remote auto-installation

Remote auto-installation

Palo Alto Firewall

Remote auto-installation

Remote auto-installation

Remote auto-installation
Windows certificate store, P12, JKS, and PEM endpoints support the use of custom scripts following certificate installation or endpoint restart. For more information, see Custom scripts.

Adding endpoints to an orchestration gateway

Endpoint requirements

  • Microsoft IIS

  • Windows certificate store

  • Apache

  • Apache Tomcat

  • F5 BIG-IP

  • F5 XC

  • Imperva

  • Nginx

  • P12 / JKS / PEM

  • Citrix

  • Cloudflare

  • Akamai

  • Palo Alto Firewall

To add Microsoft IIS servers to an orchestration gateway, the following requirements must be satisfied:

  • The Microsoft IIS server type is enabled for your account.

  • User is part of local Administrators Group.

To add Windows certificate store endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The Windows certificate store endpoint type is enabled for your account.

  • User is part of local Administrators Group

    • (Optional) When using custom scripts, the following requirements must be satisfied:

    • The script must be manually added to each connected endpoint machine.

    • For local connections, scripts must be run by the root or administrator user.

    • For remote connections, the specified user account must have sufficient permissions to access and execute the custom script on the endpoint machine(s).

To add Apache servers to an orchestration gateway, the following requirements must be satisfied:

  • The Apache server type is enabled for your account.

  • Local:

    • The sectigo-orchestration-gateway service has, by default, all required permissions to manage an Apache web server.

  • Remote:

    • The account specified for remote access must have permissions on the remote Apache web server to do the following:

      • Execute apachectl

      • Read and write site configuration files in ServerRoot

      • Write certificate files to a remote certificates directory (default /var/sectigo-orchestration-gateway-certs)

To add Apache Tomcat servers to an orchestration gateway, the following requirements must be satisfied:

  • The Apache Tomcat server type is enabled for your account.

  • Local:

    • The sectigo-orchestration-gateway service has, by default, all required permissions to manage an Apache Tomcat web server.

  • Remote:

    • The account specified for remote access must have permissions on the remote Apache Tomcat web server to do the following:

      • Start and stop the Apache Tomcat service

      • Read and write site configuration files in the Tomcat installation folder

      • Write JKS certificate files to the Tomcat installation folder

For Apache Tomcat on Ubuntu. Add the following rule to the /etc/polkit-1/rules.d/50-tomcat.rules file to prevent the Tomcat service restart from failing.

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        action.lookup("unit") == "tomcat.service" &&
        subject.isInGroup("tomcat")) {
        return polkit.Result.YES;
    }
});

To add F5 BIG-IP endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The F5 BIG-IP endpoint type is enabled for your account.

  • User must have the Administrator role with CLI enabled in the F5 BIG-IP application.

  • User must add a valid certificate and ensure it is trusted by the orchestration gateway machine.

To add F5 XC endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The F5 XC endpoint type is enabled for your account.

  • User must have an F5 XC API token with access to the required namespace.

Imperva endpoint supports Web Application Firewall (WAF) and Content Delivery Network (CDN) deployments.

To add Imperva endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The Imperva endpoint type is enabled for your account.

  • An API ID and API Key are generated in the Imperva management console with the following permissions:

    • View account SSL settings

    • Manage account SSL settings

    • View SSL Certificates

    • Manage custom certificates

    • View delivery settings

After changing permissions, regenerate the API key for the changes to take effect.

  • The Imperva site is created in the Imperva account.

  • Outbound HTTPS access from the orchestration gateway to the Imperva cloud:

    • Certificate metadata API: https://api.imperva.com

    • Sites list and custom certificate upload API: https://my.imperva.com

EC:384 certificates require additional configuration. Contact Imperva Support to enable this option for your Imperva endpoints.

To add Nginx servers to an orchestration gateway, the following requirements must be satisfied:

The Nginx server type is enabled for your account.

  • Local:

    • The sectigo-orchestration-gateway service has, by default, all required permissions to manage an Nginx web server.

  • Remote:

    • The account specified for remote access must be either:

      • The root user.

      • A configured non-root account.

        • The orchestration gateway version is 2.1 or later.

        • The Nginx server runs Linux with systemd and has sudo installed.

    • The temporary directory on the Nginx server (by default, /tmp) is not mounted with the noexec option.

      The error failed to connect … check credentials and server availability, even when the credentials are correct, typically indicates that this prerequisite has not been met.

To add p12, jks, or pem endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The p12, jks, or pem endpoint type is enabled for your account.

  • The required p12, jks, or pem file already exists on the orchestration gateway machine.

    For information about enabling file-based endpoints, contact your Sectigo account manager.

  • (Optional) When using custom scripts, the following requirements must be satisfied:

    • The script must be manually added to each connected endpoint machine.

    • For local connections, scripts must be run by the root or administrator user.

    • For remote connections, the specified user account must have sufficient permissions to access and execute the custom script on the endpoint machine(s).

To add Citrix endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The Citrix endpoint type is enabled for your account.

  • User must have access to a valid Citrix ADC instance.

  • User must have valid credentials for the Citrix ADC instance, including a username and password.

  • User must have a Citrix account with the following permissions:

    • Allowed Management Interface: API

    • Command Policy: partition-admin

Citrix virtual servers support multiple certificates only when Server Name Indication (SNI) is enabled

To add Cloudflare endpoints to an orchestration gateway, the following requirements must be satisfied:

  • A Cloudflare API Token with the following permissions on the target zone(s):

    • Zone: Read

    • SSL and Certificates: Edit

To add Akamai endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The Akamai endpoint type is enabled for the account.

  • Access to an Akamai Control Center API client with EdgeGrid credentials.

  • Access to the relevant Akamai contract and group.

  • An Akamai-managed keystore configured in the target Akamai account.

  • Network access to the Akamai API host.

  • The API client must have the following permissions:

    • CPS: Read/Write

    • PAPI: Read/Write (required when edge binding is used)

To add Palo Alto Firewall endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The Palo Alto Firewall endpoint type is enabled for the account.

  • Access to a Palo Alto Firewall instance.

  • A Palo Alto Firewall API key, generated using valid firewall user credentials. The API key can be entered directly in the endpoint configuration or retrieved from a credential store for authentication.

Add an endpoint

  • Microsoft IIS

  • Windows certificate store

  • Apache

  • Apache Tomcat

  • F5 BIG-IP

  • F5 XC

  • Imperva

  • Nginx

  • P12

  • JKS

  • PEM

  • Citrix

  • Cloudflare

  • Akamai

  • Palo Alto Firewall

If using WINRM HTTP, WINRM HTTPS, or WINRM HTTPS (INSECURE), WinRM must be configured on the target server. For more information, see Configure WinRM.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select IIS for Microsoft IIS endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH (WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select WCS for Windows certificate store endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Key provider model

    The key storage provider used for the endpoint’s private keys.

    Scope

    Specifies whether the certificate store is created for a specific user or for the entire machine.

    Certificate Store

    The name of the certificate store.

    Whether the private key is exportable

    Specifies whether the private key is exportable.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Authenticate with

    The authentication method for the remote system.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Apache for Apache endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    Certificate storage directory

    The certificate directory.

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Path to apachectl

    The path to the apachectl.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Apache Tomcat for Apache Tomcat endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path to Tomcat directory

    The path to the Tomcat directory, for example, /opt/tomcat.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select F5 BIG-IP for F5 BIG-IP endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Server hostname

    The server hostname.

    Server port

    The server port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select F5 XC for F5 XC endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Host

    The server hostname.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • API Token

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    API Token

    The API token.

    Namespace

    The F5 distributed cloud namespace.

    If omitted, it defaults to all the namespaces you have access to.

    Route requires through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Update proxy server details.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Imperva for Imperva endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Imperva API host

    Overrides the default Imperva certificate-management endpoint. Set it only if Imperva’s endpoint changes or you need to point the gateway at a specific Imperva environment.

    Public-facing HTTPS port

    Public-facing HTTPS port on Imperva sites.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • API ID/Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    API ID

    The Imperva API ID.

    API Key

    The Imperva API Key.

    Imperva account ID

    The Imperva account ID.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Update proxy server details.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Nginx for Nginx endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Option Description

    Name

    The name of the endpoint.

    Must be between 1 and 32 characters.

    This field is not editable after the endpoint is created.

    Connection type

    The connection type.

    The supported types are:

    • LOCAL — The orchestration gateway is installed on the Nginx server.

    • SSH — The orchestration gateway connects to the Nginx server using SSH.

    Remote hostname/address

    The hostname or IP address of the target system.

    Required if selecting SSH for the Connection type option.

    Remote port

    The ssh port of the Nginx server (by default, 22).

    Required if selecting SSH for the Connection type option.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Required if selecting User/Password or SSH Key for the Authenticate with option.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file on the orchestration gateway machine (for example, /root/.ssh/sog_nginx).

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Leave the field empty if the key has no passphrase.

    Path to Nginx config file

    The path to the Nginx config file (by default, /etc/nginx/nginx.conf).

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select P12 for P12 endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Keystore password

    The keystore password.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

    Is legacy

    Specifies which password-based encryption (PBE) scheme is used to encrypt the PKCS#8 private key inside the PKCS#12 ShroudedKeyBag.

    If toggled on, the legacy PKCS#12 PBE scheme is used. If toggled off, the PKCS#5 PBE scheme is used.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select JKS for JKS endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Keystore password

    The keystore password.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select PEM for PEM endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select NetScaler ADC for Citrix endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Server hostname

    The server hostname.

    Server port

    The server port.

    Is running in cloud

    Specifies whether the endpoint is a cloud endpoint.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    If the toggle is on, requests are routed through the configured proxy. By default, the toggle is off.

    For more information about proxy configuration, see Update proxy server details.

    Allow legacy RSA TLS ciphers

    Specifies whether to allow legacy static-RSA TLS cipher suites and TLS 1.0/1.1 negotiation for Citrix ADC/NetScaler instances that don’t support modern TLS 1.2 ECDHE cipher suites.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Cloudflare for Cloudflare endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    Only REST is supported for Cloudflare endpoints.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Update proxy server details.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • API Token

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    API Token

    The Cloudflare API token.

    Zone ID

    The Cloudflare zone ID.

    If specified, discovery is scoped to this zone only.

    If omitted, all zones accessible by the API token are discovered.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Akamai for Akamai endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    Only REST is supported for Akamai endpoints.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    If the toggle is on, requests are routed through the configured proxy. By default, the toggle is off.

    For more information about proxy configuration, see Update proxy server details.

    Contract ID

    The contract ID for the endpoint.

    Host

    The host of the target system.

    Enrollment admin/tech contact email

    The email address of the enrollment admin or technical contact.

    Enrollment organization name

    The name of the enrollment organization.

    This must match the organization name specified in the CSR subject O (Organization) attribute.

    Enrollment organization state/province

    The state or province of the enrollment organization.

    This must match the state or province specified in the CSR subject ST (State or Province) attribute.

    Enrollment organization locality/city

    The locality (city) of the enrollment organization.

    This must match the locality (city) specified in the CSR subject L (Locality) attribute.

    Enrollment template JSON for CPS create

    Enrollment template JSON used when creating a CPS enrollment.

    The template includes contact, organization, CSR, and network configuration settings.

    CPS certificate type for created enrollments

    The CPS certificate type to use for created enrollments (for example, SAN, single-domain, wildcard, or third-party certificates).

    CPS secure network for created enrollments (standard-tls or enhanced-tls)

    Secure network type for created CPS enrollments. Valid values are standard-tls and enhanced-tls.

    CPS network geography for created enrollments

    The network geography for created CPS enrollments (for example, core, china or russia).

    Create enrollment as SNI-Only

    Indicates whether to create CPS enrollments as SNI-only enrollments.

    PAPI group id for edge hostname and property operations

    The PAPI group ID used for edge hostname and property operations.

    PAPI product id used when creating edge hostnames

    The PAPI product ID used when creating edge hostnames.

    PAPI property id to bind the edge hostname to

    The PAPI property ID to bind the edge hostname to enable edge binding.

    PAPI property version to update

    The PAPI property version to update. If not specified, it falls back to the node_details property_version.

    Activation network for edge binding

    The activation network for edge binding. Valid values are STAGING and PRODUCTION.

    Edge hostname domain suffix

    The domain suffix for the edge hostname. For ENHANCED_TLS, this is typically edgekey.net.

    Authenticate with

    The authentication method to use for the edge hostname.

    The supported authentication methods are:

    • Credential Store

    • edgegrid

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Akamai EdgeGrid Credentials

    The Akamai EdgeGrid credentials in the following required format:

    host=akab-xxxxx-xxxxxx.luna.akamaiapis.net client_token=akab-xxxxx-xxxxx access_token=akab-xxxxx-xxxxx client_secret=xxxxxx

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Palo Alto Firewall for Palo Alto Firewall endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Firewall hostname or IP

    The hostname or IP address of the PAN-OS firewall or of the Panorama management server.

    Management port

    The management port of the firewall or Panorama. If omitted, it defaults to 443.

    Authenticate with

    The authentication method to use for the connection.

    The supported authentication methods are:

    • Credential Store

    • API Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    API Key

    The PAN-OS API key used to authenticate management API calls.

    Virtual system to scan

    The virtual system (vsys) to scan. If omitted, the shared location and the default virtual system (vsys1) are scanned.

    For Panorama, this selects the virtual system within the template. If omitted, the shared configuration of the template is used.

    Panorama template or template-stack to manage

    The Panorama template or template-stack that the endpoint manages. Specify several by separating them with commas. If omitted, all templates on the Panorama are used. This field is not required for a directly connected firewall.

    Panorama template-stack to push to

    The Panorama template-stack that committed changes are pushed to. Multiple template-stacks can be specified as a comma-separated list.

    If omitted, the push targets are the template-stacks that contain the certificate’s template. This field is not required for a directly connected firewall.

    Push committed Panorama changes to its devices

    Specifies whether the committed Panorama configuration is pushed to its managed devices after the Panorama commit. This field is ignored for a directly connected firewall.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    If the toggle is on, requests are routed through the configured proxy. By default, the toggle is off.

    For more information about proxy configuration, see Update proxy server details.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

Once an endpoint is added to an orchestration gateway, you must complete the following steps:

  • Delegate the endpoint to the appropriate organization or department. For more information, see Delegate an endpoint.

  • Discover nodes associated with the endpoint. For more information, see Discover nodes.

Add an endpoint (CLI)

If an option value contains special characters, enclose the value in quotes. Use single quotes ' in Bash and PowerShell, and double quotes " in Command Prompt (Cmd). This ensures that the value is passed to the orchestration gateway as entered.

  • Microsoft IIS

  • Windows certificate store

  • Apache

  • Apache Tomcat

  • F5 BIG-IP

  • F5 XC

  • Imperva

  • Nginx

  • P12

  • JKS

  • PEM

  • Citrix

  • Cloudflare

  • Akamai

  • Palo Alto Firewall

If using winrm_http, winrm_https, or winrm_https_insecure, WinRM must be configured on the target server. For more information, see Configure WinRM.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a Microsoft IIS server using the orchestration gateway based on your system.

    Remove any unused options from the command.

    The command options are outlined in the following table.

    • Windows

      sectigo-og.exe tls add iis --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Linux

      ./sectigo-og tls add iis --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add iis --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The supported types are:

      • local

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select your orchestration gateway and click Sync Endpoints.

If using winrm_http, winrm_https, or winrm_https_insecure, WinRM must be configured on the target endpoint. For more information, see Configure WinRM.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add Windows certificate store endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    The command options are outlined in the following table.

    • Windows

      sectigo-og.exe tls add wcs --name <endpoint-name> --key_provider <key-provider> --cert_store <cert-store> --exportable <true-or-false> --connection_type <connection_type> --scope <user-or-machine> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Linux

      ./sectigo-og tls add wcs --name <endpoint-name> --key_provider <key-provider> --cert_store <cert-store> --exportable <true-or-false> --connection_type <connection_type> --scope <user-or-machine> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add wcs --name <endpoint-name> --key_provider <key-provider> --cert_store <cert-store> --exportable <true-or-false> --connection_type <connection_type> --scope <user-or-machine> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --key_provider

      required

      The key storage provider used for the endpoint’s private keys.

      The possible values are:

      • CSP

      • KSP

      --cert_store

      required

      The name of the certificate store.

      --exportable

      required

      Specifies whether the private key is exportable.

      The possible values are:

      • true — The private key is exportable.

      • false — The private key is not exportable.

      --connection_type

      required

      The connection type.

      The supported types are:

      • local

      • ssh

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --scope

      required

      Specifies whether the certificate store is created for a specific user or for the entire machine.

      The possible values are:

      • user

      • machine

      When using the local connection type, only the machine scope is supported. The user scope is supported for any remote connection type.

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --install_script

      optional

      The path to the install script.

      For more information about custom scripts, see Custom scripts.

      --restart_script

      optional

      The path to the restart script.

      For more information about custom scripts, see Custom scripts.

      --help, -h

      optional

      Displays the help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Apache server using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add apache --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --apachectl_path <apachectl-path> --cert_storage_dir <cert-storage-dir>

    • Linux

      ./sectigo-og tls add apache --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --apachectl_path <apachectl-path> --cert_storage_dir <cert-storage-dir>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add apache --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --apachectl_path <apachectl-path> --cert_storage_dir <cert-storage-dir>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The supported types are:

      • local

      • ssh

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --apachectl_path

      required

      The path to apachectl.

      Must be between 1 and 4096 characters.

      --cert_storage_dir

      required

      The certificate directory.

      Must be between 1 and 4096 characters.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Apache Tomcat server using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add tomcat --name <endpoint-name> --tomcat_dir <tomcat-path> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Linux

      ./sectigo-og tls add tomcat --name <endpoint-name> --tomcat_dir <tomcat-path> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add tomcat --name <endpoint-name> --tomcat_dir <tomcat-path> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --tomcat_dir

      required

      The path to the Tomcat directory, for example /opt/tomcat.

      Must be at least 1 character long.

      --connection_type

      required

      The connection type.

      The supported types are:

      • local

      • ssh

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an F5 BIG-IP endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add f5 --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Linux

      ./sectigo-og tls add f5 --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add f5 --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>
      One of the following authentication options is required when the connection type is not rest_insecure: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The supported types are:

      • rest

      • rest_insecure

      --host

      conditional

      The server hostname.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The server port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an F5 XC endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add f5xc --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --namespace <namespace> --use_proxy <true-or-false>

    • Linux

      ./sectigo-og tls add f5xc --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --namespace <namespace> --use_proxy <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add f5xc --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --namespace <namespace> --use_proxy <true-or-false>
      One of the following authentication options is required: --api_token, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The supported types are:

      • rest

      • rest_insecure

      --host

      required

      The server hostname.

      Must be between 1 and 255 characters.

      --api_token

      conditional

      The API token.

      Required if --store and --store_cred_id are not specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --namespace

      optional

      The F5 XC namespace.

      If omitted, it defaults to all the namespaces you have access to.

      --use_proxy

      optional

      Specifies whether to route requests through a configured proxy.

      The possible values are:

      • true — Route requests through the configured proxy.

      • false — Do not route requests through the proxy.

      If omitted, it defaults to false.

      To add proxy configuration, see Update proxy server details.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Imperva endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add imperva --name <endpoint-name> --connection_type <connection-type> --api_id <api-id> --api_key <api-key> --account_id <account-id> --base_url <base-url> --port <port> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>

    • Linux

      ./sectigo-og tls add imperva --name <endpoint-name> --connection_type <connection-type> --api_id <api-id> --api_key <api-key> --account_id <account-id> --base_url <base-url> --port <port> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add imperva --name <endpoint-name> --connection_type <connection-type> --api_id <api-id> --api_key <api-key> --account_id <account-id> --base_url <base-url> --port <port> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>
      One of the following authentication options is required when the connection type is not rest_insecure: --user and --password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The supported types are:

      • rest

      • rest_insecure

      Use rest_insecure only when TLS verification needs to be skipped (for example, when used in a test environment).

      --api_id

      required

      The Imperva API ID.

      --api_key

      required

      The Imperva API key.

      --account_id

      required

      The Imperva account ID.

      --base_url

      optional

      Overrides the default Imperva certificate-management endpoint. Leave blank to use the standard cloud endpoint. Set it only if Imperva’s endpoint changes or you need to point the gateway at a specific Imperva environment.

      --port

      optional

      Public-facing HTTPS port on Imperva sites.

      The default value is 443.

      --store

      conditional

      The credential store ID.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --use_proxy

      optional

      Specifies whether to route requests through a configured proxy.

      The possible values are:

      • true — Route requests through the configured proxy.

      • false — Do not route requests through the proxy.

      If omitted, it defaults to false.

      To add proxy configuration, see Update proxy server details.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Nginx server using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add nginx --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --nginx_config_path <nginx-config-file-path>

    • Linux

      ./sectigo-og tls add nginx --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --nginx_config_path <nginx-config-file-path>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add nginx --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --nginx_config_path <nginx-config-file-path>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The supported types are:

      • local — The orchestration gateway is installed on the Nginx server.

      • ssh — The orchestration gateway connects to the Nginx server using SSH.

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password or SSH key authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified and the SSH key is protected by a password.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --nginx_config_path

      required

      The path to the Nginx config file (by default, /etc/nginx/nginx.conf).

      Must be between 1 and 4096 characters.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a P12 endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add p12 --name <endpoint-name> --connection_type <connection_type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path> --is_legacy <true-or-false>

    • Linux

      ./sectigo-og tls add p12 --name <endpoint-name> --connection_type <connection_type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path> --is_legacy <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add p12 --name <endpoint-name> --connection_type <connection_type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path> --is_legacy <true-or-false>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --path

      required

      The path to the keystore or certificate file.

      The filename must be included in this option.

      --store_password

      required

      The keystore password.

      --connection_type

      required

      The connection type.

      The supported types are:

      • local

      • ssh

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --install_script

      optional

      The path to the install script.

      For more information about custom scripts, see Custom scripts.

      --restart_script

      optional

      The path to the restart script.

      For more information about custom scripts, see Custom scripts.

      --is_legacy

      optional

      Specifies which password-based encryption (PBE) scheme is used to encrypt the PKCS#8 private key inside the PKCS#12 ShroudedKeyBag.

      The valid values are:

      • true: old PKCS#12 legacy PBE.

      • false: (recommended) modern PKCS#5 PBES2.

      The value defaults to false.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a JKS endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add jks --name <endpoint-name> --connection_type <connection-type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Linux

      ./sectigo-og tls add jks --name <endpoint-name> --connection_type <connection-type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add jks --name <endpoint-name> --connection_type <connection-type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --path

      required

      The path to the keystore or certificate file.

      The filename must be included in this option.

      --store_password

      required

      The keystore password.

      --connection_type

      required

      The connection type.

      The supported types are:

      • local

      • ssh

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --install_script

      optional

      The path to the install script.

      For more information about custom scripts, see Custom scripts.

      --restart_script

      optional

      The path to the restart script.

      For more information about custom scripts, see Custom scripts.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Run the following command to add a PEM endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add pem --name <endpoint-name> --connection_type <connection-type> --path <file-path> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Linux

      ./sectigo-og tls add pem --name <endpoint-name> --connection_type <connection-type> --path <file-path> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add pem --name <endpoint-name> --connection_type <connection-type> --path <file-path> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --path

      required

      The path to the file.

      The filename must be included in this option.

      --connection_type

      required

      The connection type.

      The supported types are:

      • local

      • ssh

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --install_script

      optional

      The path to the install script.

      For more information about custom scripts, see Custom scripts.

      --restart_script

      optional

      The path to the restart script.

      For more information about custom scripts, see Custom scripts.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a Citrix endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add citrix --name <endpoint-name> --host <hostname-or-ip> --connection_type <connection-type> --is_cloud <true-or-false> --user <user> --password <password> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false> --use_legacy_rsa <true-or-false>

    • Linux

      ./sectigo-og tls add citrix --name <endpoint-name> --host <hostname-or-ip> --connection_type <connection-type> --is_cloud <true-or-false> --user <user> --password <password> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false> --use_legacy_rsa <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add citrix --name <endpoint-name> --host <hostname-or-ip> --connection_type <connection-type> --is_cloud <true-or-false> --user <user> --password <password> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false> --use_legacy_rsa <true-or-false>
      One of the following authentication options is required: --user and --password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --host

      required

      The hostname or IP address of the target system.

      Must be between 1 and 255 characters.

      --connection_type

      required

      The connection type.

      The supported types are:

      • rest

      • rest_insecure

      Use rest_insecure only when TLS verification needs to be skipped (for example, when used in a test environment).

      --is_cloud

      required

      Specifies whether the endpoint is a cloud endpoint.

      The valid values are:

      • true: the endpoint is a cloud endpoint.

      • false: the endpoint is on premises.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --use_proxy

      optional

      Specifies whether to route requests through a configured proxy.

      The possible values are:

      • true — Route requests through the configured proxy.

      • false — Do not route requests through the proxy.

      If omitted, it defaults to false.

      To add proxy configuration, see Update proxy server details.

      --use_legacy_rsa

      optional

      Specifies whether to allow legacy static-RSA TLS cipher suites and TLS 1.0/1.1 negotiation for Citrix ADC/NetScaler instances that don’t support modern TLS 1.2 ECDHE cipher suites.

      The possible values are:

      • true — Allow legacy negotiation.

      • false — Use modern TLS only.

      If omitted, it defaults to false.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a Cloudflare endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add cloudflare --name <endpoint-name> --connection_type rest --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --zone_id <zone-id>

    • Linux

      ./sectigo-og tls add cloudflare --name <endpoint-name> --connection_type rest --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --zone_id <zone-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add cloudflare --name <endpoint-name> --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --zone_id <zone-id>
      One of the following authentication options is required: --api_token, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --api_token

      conditional

      The Cloudflare API Token.

      Required if credential store authentication is not used.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --zone_id

      optional

      The Cloudflare Zone ID.

      If specified, discovery is scoped to this zone only.

      If omitted, all zones accessible by the API token are discovered.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Akamai endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      ./sectigo-og.exe tls add akamai --name <endpoint-name> --connection_type rest --host <api-host> --contract_id <contract-id> --edgegrid '<endpoint-info>' --use_proxy false --admin_email <email> --group_id <group-id> --product_id <product-id> --property_id <property-id> --property_version <version> --network <STAGING_or_PRODUCTION> --domain_suffix <domain> --store <credential-store-id> --store_cred_id <credential-id>

    • Linux

      ./sectigo-og tls add akamai --name <endpoint-name> --connection_type rest --host <api-host> --contract_id <contract-id> --edgegrid '<endpoint-info>' --use_proxy false --admin_email <email> --group_id <group-id> --product_id <product-id> --property_id <property-id> --property_version <version> --network <STAGING_or_PRODUCTION> --domain_suffix <domain> --store <credential-store-id> --store_cred_id <credential-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add akamai --name <endpoint-name> --connection_type rest --host <api-host> --contract_id <contract-id> --edgegrid '<endpoint-info>' --use_proxy false --admin_email <email> --group_id <group-id> --product_id <product-id> --property_id <property-id> --property_version <version> --network <STAGING_or_PRODUCTION> --domain_suffix <domain> --store <credential-store-id> --store_cred_id <credential-id>
      One of the following authentication options is required: --edgegrid, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint. Must be between 1 and 32 characters.

      --connection_type

      required

      Only rest is supported for Akamai endpoints.

      --host

      required

      The Akamai EdgeGrid API hostname.

      --contract_id

      required

      The Akamai contract ID.

      --edgegrid

      optional

      The Akamai EdgeGrid credentials in the following required format:

      host=akab-xxxxx-xxxxxx.luna.akamaiapis.net client_token=akab-xxxxx-xxxxx access_token=akab-xxxxx-xxxxx client_secret=xxxxxx

      --store

      conditional

      The credential store ID. Required if credential store authentication is used.

      --store_cred_id

      conditional

      The EdgeGrid credential ID within the specified credential store. Required if --store is specified.

      --use_proxy

      optional

      Specifies whether to route requests through a configured proxy.

      The possible values are:

      • true — Route requests through the configured proxy.

      • false — Do not route requests through the proxy.

      If omitted, it defaults to false.

      To add proxy configuration, see Update proxy server details.

      --admin_email

      required

      The email address used for Akamai activation notifications.

      --group_id

      required

      The group containing the Akamai property.

      --product_id

      required

      The product used to create the edge hostname.

      --property_id

      optional

      The property to bind. If specified, edge binding is enabled.

      --property_version

      conditional

      The property version to update and activate. Required when --property_id is specified.

      --network

      required

      The activation target. Valid values are STAGING and PRODUCTION.

      --domain_suffix

      optional

      The edge-hostname suffix. Typically edgekey.net.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a Palo Alto Firewall endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      ./sectigo-og.exe tls add paloalto --name <endpoint-name> --connection_type <connection-type> --host <hostname-or-ip> --api_key <api-key> --store <store-id> --store_cred_id <store-cred-id> --vsys <vsys-name>  --template <template-name> --push_target <push-targets> --push_to_devices <true-or-false> --use_proxy <true-or-false>

    • Linux

      ./sectigo-og tls add paloalto --name <endpoint-name> --connection_type <connection-type> --host <hostname-or-ip> --api_key <api-key> --store <store-id> --store_cred_id <store-cred-id> --vsys <vsys-name>  --template <template-name> --push_target <push-targets> --push_to_devices <true-or-false> --use_proxy <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add paloalto --name <endpoint-name> --connection_type <connection-type> --host <hostname-or-ip> --api_key <api-key> --store <store-id> --store_cred_id <store-cred-id> --vsys <vsys-name>  --template <template-name> --push_target <push-targets> --push_to_devices <true-or-false> --use_proxy <true-or-false>
      One of the following authentication options is required: --api_key or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The supported types are:

      • rest

      • rest_insecure

      Use rest_insecure only when TLS verification needs to be skipped (for example, when used in a test environment).

      --host

      required

      The hostname or IP address of the target system.

      Must be between 1 and 255 characters.

      --api_key

      conditional

      The PAN-OS API key used for management API calls.

      Required if API key authentication is used.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --vsys

      optional

      The virtual system to scan. If omitted, the shared location and the default virtual system (vsys1) are scanned.

      For Panorama, this selects the virtual system within the template. If omitted, the shared configuration of the template is used.

      --template

      optional

      The Panorama template or template-stack that the endpoint manages. Multiple templates can be specified as a comma-separated list.

      If omitted, all templates on the Panorama are used. This field is not required for a directly connected firewall.

      --push_target

      optional

      The Panorama template-stack that committed changes are pushed to. Multiple template-stacks can be specified as a comma-separated list.

      If omitted, the push targets are the template-stacks that contain the certificate’s template. This field is not required for a directly connected firewall.

      --push_to_devices

      optional

      Specifies whether the committed Panorama configuration is pushed to its managed devices after the Panorama commit. This field is not required for a directly connected firewall.

      The possible values are:

      • true — Push to the managed devices after the Panorama commit.

      • false — Do not push to the managed devices after the Panorama commit.

      If omitted, it defaults to false.

      --use_proxy

      optional

      Specifies whether to route requests through a configured proxy.

      The possible values are:

      • true — Route requests through the configured proxy.

      • false — Do not route requests through the proxy.

      If omitted, it defaults to false.

      To add proxy configuration, see Update proxy server details.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select your orchestration gateway and click Sync Endpoints.

Once an endpoint is added to an orchestration gateway, you must complete the following steps:

  • Delegate the endpoint to the appropriate organization or department. For more information, see Delegate an endpoint.

  • Discover nodes associated with the endpoint. For more information, see Discover nodes.

Edit an endpoint

  • Microsoft IIS

  • Windows certificate store

  • Apache

  • Apache Tomcat

  • F5 BIG-IP

  • F5 XC

  • Imperva

  • Nginx

  • P12

  • JKS

  • PEM

  • Citrix

  • Cloudflare

  • Akamai

  • Palo Alto Firewall

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH (WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Key provider model

    The key storage provider used for the endpoint’s private keys.

    Scope

    Specifies whether the certificate store is created for a specific user or for the entire machine.

    Certificate Store

    The name of the certificate store.

    Whether the private key is exportable

    Specifies whether the private key is exportable.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Authenticate with

    The authentication method for the remote system.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    Certificate storage directory

    The certificate directory.

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Path to apachectl

    The path to the apachectl.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path to Tomcat directory

    The path to the Tomcat directory, for example, /opt/tomcat.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Server hostname

    The server hostname.

    Server port

    The server port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Host

    The server hostname.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • API Token

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    API Token

    The API token.

    Namespace

    The F5 distributed cloud namespace.

    If omitted, it defaults to all the namespaces you have access to.

    Route requires through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Update proxy server details.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Imperva API host

    Overrides the default Imperva certificate-management endpoint. Set it only if Imperva’s endpoint changes or you need to point the gateway at a specific Imperva environment.

    Public-facing HTTPS port

    Public-facing HTTPS port on Imperva sites.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • API ID/Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    API ID

    The Imperva API ID.

    API Key

    The Imperva API Key.

    Imperva account ID

    The Imperva account ID.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Update proxy server details.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Option Description

    Name

    The name of the endpoint.

    Must be between 1 and 32 characters.

    This field is not editable after the endpoint is created.

    Connection type

    The connection type.

    The supported types are:

    • LOCAL — The orchestration gateway is installed on the Nginx server.

    • SSH — The orchestration gateway connects to the Nginx server using SSH.

    Remote hostname/address

    The hostname or IP address of the target system.

    Required if selecting SSH for the Connection type option.

    Remote port

    The ssh port of the Nginx server (by default, 22).

    Required if selecting SSH for the Connection type option.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Required if selecting User/Password or SSH Key for the Authenticate with option.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file on the orchestration gateway machine (for example, /root/.ssh/sog_nginx).

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Leave the field empty if the key has no passphrase.

    Path to Nginx config file

    The path to the Nginx config file (by default, /etc/nginx/nginx.conf).

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Keystore password

    The keystore password.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

    Is legacy

    Specifies which password-based encryption (PBE) scheme is used to encrypt the PKCS#8 private key inside the PKCS#12 ShroudedKeyBag.

    If toggled on, the legacy PKCS#12 PBE scheme is used. If toggled off, the PKCS#5 PBE scheme is used.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Keystore password

    The keystore password.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Connection Type

    The connection type.

    The supported types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    • SSH Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Private key file path

    The path to the SSH key file.

    Passphrase

    The password for the SSH key.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Server hostname

    The server hostname.

    Server port

    The server port.

    Is running in cloud

    Specifies whether the endpoint is a cloud endpoint.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • User/Password

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    If the toggle is on, requests are routed through the configured proxy. By default, the toggle is off.

    For more information about proxy configuration, see Update proxy server details.

    Allow legacy RSA TLS ciphers

    Specifies whether to allow legacy static-RSA TLS cipher suites and TLS 1.0/1.1 negotiation for Citrix ADC/NetScaler instances that don’t support modern TLS 1.2 ECDHE cipher suites.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    Only REST is supported for Cloudflare endpoints.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Update proxy server details.

    Authenticate with

    The authentication method for the remote system.

    The supported authentication methods are:

    • Credential Store

    • API Token

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    API Token

    The Cloudflare API token.

    Zone ID

    The Cloudflare zone ID.

    If specified, discovery is scoped to this zone only.

    If omitted, all zones accessible by the API token are discovered.

  3. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    Only REST is supported for Akamai endpoints.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    If the toggle is on, requests are routed through the configured proxy. By default, the toggle is off.

    For more information about proxy configuration, see Update proxy server details.

    Contract ID

    The contract ID for the endpoint.

    Host

    The host of the target system.

    Enrollment admin/tech contact email

    The email address of the enrollment admin or technical contact.

    Enrollment organization name

    The name of the enrollment organization.

    This must match the organization name specified in the CSR subject O (Organization) attribute.

    Enrollment organization state/province

    The state or province of the enrollment organization.

    This must match the state or province specified in the CSR subject ST (State or Province) attribute.

    Enrollment organization locality/city

    The locality (city) of the enrollment organization.

    This must match the locality (city) specified in the CSR subject L (Locality) attribute.

    Enrollment template JSON for CPS create

    Enrollment template JSON used when creating a CPS enrollment.

    The template includes contact, organization, CSR, and network configuration settings.

    CPS certificate type for created enrollments

    The CPS certificate type to use for created enrollments (for example, SAN, single-domain, wildcard, or third-party certificates).

    CPS secure network for created enrollments (standard-tls or enhanced-tls)

    Secure network type for created CPS enrollments. Valid values are standard-tls and enhanced-tls.

    CPS network geography for created enrollments

    The network geography for created CPS enrollments (for example, core, china or russia).

    Create enrollment as SNI-Only

    Indicates whether to create CPS enrollments as SNI-only enrollments.

    PAPI group id for edge hostname and property operations

    The PAPI group ID used for edge hostname and property operations.

    PAPI product id used when creating edge hostnames

    The PAPI product ID used when creating edge hostnames.

    PAPI property id to bind the edge hostname to

    The PAPI property ID to bind the edge hostname to enable edge binding.

    PAPI property version to update

    The PAPI property version to update. If not specified, it falls back to the node_details property_version.

    Activation network for edge binding

    The activation network for edge binding. Valid values are STAGING and PRODUCTION.

    Edge hostname domain suffix

    The domain suffix for the edge hostname. For ENHANCED_TLS, this is typically edgekey.net.

    Authenticate with

    The authentication method to use for the edge hostname.

    The supported authentication methods are:

    • Credential Store

    • edgegrid

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    Akamai EdgeGrid Credentials

    The Akamai EdgeGrid credentials in the following required format:

    host=akab-xxxxx-xxxxxx.luna.akamaiapis.net client_token=akab-xxxxx-xxxxx access_token=akab-xxxxx-xxxxx client_secret=xxxxxx

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The supported types are:

    • REST

    • REST (Insecure)

    Firewall hostname or IP

    The hostname or IP address of the PAN-OS firewall or of the Panorama management server.

    Management port

    The management port of the firewall or Panorama. If omitted, it defaults to 443.

    Authenticate with

    The authentication method to use for the connection.

    The supported authentication methods are:

    • Credential Store

    • API Key

    Store Name

    The name of the credential store to use for authentication.

    Credential ID

    The identifier of the credential to use from the credential store.

    API Key

    The PAN-OS API key used to authenticate management API calls.

    Virtual system to scan

    The virtual system (vsys) to scan. If omitted, the shared location and the default virtual system (vsys1) are scanned.

    For Panorama, this selects the virtual system within the template. If omitted, the shared configuration of the template is used.

    Panorama template or template-stack to manage

    The Panorama template or template-stack that the endpoint manages. Specify several by separating them with commas. If omitted, all templates on the Panorama are used. This field is not required for a directly connected firewall.

    Panorama template-stack to push to

    The Panorama template-stack that committed changes are pushed to. Multiple template-stacks can be specified as a comma-separated list.

    If omitted, the push targets are the template-stacks that contain the certificate’s template. This field is not required for a directly connected firewall.

    Push committed Panorama changes to its devices

    Specifies whether the committed Panorama configuration is pushed to its managed devices after the Panorama commit. This field is ignored for a directly connected firewall.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    If the toggle is on, requests are routed through the configured proxy. By default, the toggle is off.

    For more information about proxy configuration, see Update proxy server details.

  4. Click Save.

Delegate an endpoint

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to delegate.

  3. Click Edit.

  4. In the Edit SSL/TLS Automation Endpoint dialog, select the organization and department you want to assign to the endpoint.

  5. Click Save.

Delete an endpoint

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to delete.

  3. Click Delete and then click Delete again to confirm.

Managing nodes

Discover nodes

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select your endpoint.

  3. Click Discover Nodes.

    You need to assign an organization or a department to the endpoint before you can discover nodes.

View nodes

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select your endpoint.

  3. Click Nodes to view the nodes associated with the endpoint.

    Each node is displayed as a collapsible heading that shows the name of the node, the vendor, and the node state.

    Column Name Description

    Name

    The name of the node.

    Alias

    The alias for the node (if available).

    Protocol

    Whether the node is connected through HTTP or HTTPS.

    IP Address

    The IP address of the node.

    Port

    The port used to connect to the node.

    Restart Required

    Whether an endpoint restart is required to complete certificate installation on this node.

    To restart an endpoint, see Restart an endpoint.

    SSL/TLS Automation Endpoint

    The name of the SSL/TLS Automation Endpoint associated with the node.

    SSL

    The order number of the SSL certificate associated with the node.

    Discovered certificates that have not been assigned to an organization or department are displayed as External.
Click the value in the SSL column for any given node to view or manage the associated SSL certificate.

Restart an endpoint

  1. Navigate to Certificates  SSL Certificates.

  2. Select the certificate installed on the server you want to restart, and click View.

  3. In the SSL Certificate dialog, select the Management tab, and expand the Auto-Installation section.

  4. Locate the server you want to restart, and click Restart.

    The Restart button is only available for connected endpoints.

Configure WinRM

Microsoft IIS endpoints that use the winrm_http, winrm_https, or winrm_https_insecure connection types require WinRM to be configured before certificate installation can occur.

WinRM server configuration can be performed using either HTTP or HTTPS, depending on security and environment requirements. The Sectigo Orchestration Gateway supports:

  • Basic authentication over HTTPS.

  • Kerberos authentication over HTTP or HTTPS.

  • NTLM authentication over HTTP or HTTPS.

The provided setup scripts automate the configuration by enabling and starting the WinRM service, creating the appropriate listener (HTTP or HTTPS), configuring required firewall rules, and applying recommended authentication settings.

  1. Validate WinRM server connectivity.

    1. Copy the following script and save it as validate-winrm-server.ps1.

      Powershell script 
      # ================================================
# WinRM Server Configuration and Port Check Script
# ================================================

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)

if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Script must be run as Administrator" -ForegroundColor Red
    exit 1
}

$serverName = $env:COMPUTERNAME
$computerAccount = "$env:USERDOMAIN\$serverName`$"

Write-Host "`n=== SERVER INFO ==="
Write-Host "Server name: $computerAccount"
Write-Host "User account: $(whoami)"
Write-Host "`n=== WINRM SERVICE STATUS ==="
$service = Get-Service WinRM -ErrorAction SilentlyContinue
if ($service -and $service.Status -eq "Running") {
    Write-Host "WinRM service is running" -ForegroundColor Green
} else {
    Write-Host "WinRM service is not running" -ForegroundColor Red
    exit 1
}

Write-Host "`n=== WINRM CONFIGURATION ==="
$config = winrm get winrm/config/service
($config | Out-String) | Write-Host
$basic = ($config | Select-String "Basic").ToString()
$basicEnabled = $basic -match "Basic\s*=\s*true"
if ($basicEnabled) {
    Write-Host "Insecure WinRM configuration detected: Disable Basic authentication or enforce HTTPS." -ForegroundColor Red
}

Write-Host "`n=== WINRM LISTENERS ==="
winrm enumerate winrm/config/listener

Write-Host "`n=== FIREWALL RULES (WINRM) ==="

$lines = netsh advfirewall firewall show rule name=all
$rule = @()
foreach ($line in $lines) {
    if ($line -match "^Rule Name:") {
        # print previous rule if it matched
        if ($rule -match "LocalPort:\s+(5985|5986)") {
            $rule -join "`n"
            Write-Host ""
        }
        $rule = @()
    }

    $rule += $line
}

# check last rule
if ($rule -match "LocalPort:\s+(5985|5986)") {
    $rule -join "`n"
}

Write-Host "`n=== TESTING PORT CONNECTIVITY ==="
$ports = @(5985, 5986)
foreach ($port in $ports) {
    $result = Test-NetConnection -ComputerName localhost -Port $port -WarningAction SilentlyContinue

    if ($result.TcpTestSucceeded) {
        Write-Host "Port $port is OPEN" -ForegroundColor Green
    } else {
        Write-Host "Port $port is CLOSED" -ForegroundColor Red
    }
}

Write-Host "`n=== SPN VALIDATION ==="
Write-Host "Checking SPN: */$serverName*"
$spnOutput = & cmd /c setspn -Q "*/$serverName*" 2>$null

# Extract only SPN lines (ignore CN=..., blank lines, etc.)
$spnLines = $spnOutput | Where-Object { $_ -match "^\s*(HTTP|HOST)/" }

# Check for HTTP or HOST specifically
$match = $spnLines | Where-Object { $_ -match "^\s*(HTTP|HOST)/$serverName([.\s]|$)" }

if ($match) {
    Write-Host "Valid SPN found (HTTP or HOST)" -ForegroundColor Green
    ($spnLines | Out-String) | Write-Host
} else {
    Write-Host "No valid HTTP/HOST SPN found" -ForegroundColor Red
    ($spnOutput | Out-String) | Write-Host
}

    2. Log in to the target server.

    3. Open PowerShell as Administrator.

    4. Navigate to the script location.

    5. Run the following command.

      powershell -ExecutionPolicy Bypass -File .\validate-winrm-server.ps1

  2. If server http connectivity validation fails, configure http connection.

    1. Copy the following script and save it as setup-winrm-server-http.ps1.

      Powershell script 
      param(
    [Parameter(
        Mandatory=$true,
        HelpMessage = "FQDN of this server (e.g. server01.domain.com). Should match DNS and the hostname used for WinRM connections."
    )]
    [string]$ServerFQDN
)

# ============================================
# Configure WinRM over HTTP
# ============================================

Write-Host "=== CONFIGURING WINRM HTTP FOR $ServerFQDN ==="
winrm quickconfig -q

# --------------------------------------------
# Step 1: Configure WinRM service settings
# --------------------------------------------
Write-Host "`nConfiguring WinRM service settings..."

Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $false
Set-Item -Path WSMan:\localhost\Service\Auth\Kerberos -Value $true
Set-Item -Path WSMan:\localhost\Service\Auth\Negotiate -Value $true

# --------------------------------------------
# Step 2: Open firewall port 5985
# --------------------------------------------
Write-Host "`nOpening firewall port 5985..."

New-NetFirewallRule `
    -Name "WinRM-HTTP" `
    -DisplayName "WinRM HTTP" `
    -Protocol TCP `
    -LocalPort 5985 `
    -Direction Inbound `
    -Action Allow `
    -ErrorAction SilentlyContinue | Out-Null

# --------------------------------------------
# Step 3: Restart WinRM
# --------------------------------------------
Write-Host "`nRestarting WinRM service..."

Restart-Service WinRM

# --------------------------------------------
# Step 4: Validate
# --------------------------------------------
Write-Host "`nValidating WinRM HTTP..."
try {
	Invoke-Command -ComputerName $ServerFQDN  -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
    Write-Host "Remote WinRM over HTTP succeeded" -ForegroundColor Green
} catch {
    Write-Host "Remote WinRM over HTTP FAILED" -ForegroundColor Red
}

    2. Log in to the target server.

    3. Open PowerShell as Administrator.

    4. Navigate to the script location.

    5. Run the following command and modify <server-fqdn> to a fully qualified domain name of the WinRM server.

      powershell -ExecutionPolicy Bypass -File .\setup-winrm-server-http.ps1 -ServerFQDN <server-fqdn>

  3. If server https connectivity validation fails, configure https connection.

    1. Copy the following script and save it as setup-winrm-server-https.ps1.

      Powershell script 
      param(
    [Parameter(
        Mandatory=$true,
        HelpMessage = "FQDN of this server (e.g. server01.domain.com). Should match DNS and the hostname used for WinRM connections."
    )]
    [string]$ServerFQDN
)

# ============================================
# Configure WinRM over HTTPS
# ============================================

Write-Host "=== CONFIGURING WINRM HTTPS FOR $ServerFQDN ==="
winrm quickconfig -q

# --------------------------------------------
# Step 1: Secure WinRM settings
# --------------------------------------------
Write-Host "`nConfiguring WinRM service settings..."

Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $false
Set-Item -Path WSMan:\localhost\Service\Auth\Kerberos -Value $true
Set-Item -Path WSMan:\localhost\Service\Auth\Negotiate -Value $true

# --------------------------------------------
# Step 2: Create certificate
# --------------------------------------------
Write-Host "`nCreating self-signed certificate..."

$cert = New-SelfSignedCertificate `
    -DnsName "$ServerFQDN" `
    -CertStoreLocation Cert:\LocalMachine\My

Write-Host "Certificate created with thumbprint: $($cert.Thumbprint)"

# --------------------------------------------
# Step 3: Create HTTPS listener
# --------------------------------------------
Write-Host "`nCreating WinRM HTTPS listener..."
winrm delete winrm/config/Listener?Address=*+Transport=HTTPS 2>$null
winrm create winrm/config/Listener?Address=*+Transport=HTTPS "@{Hostname=`"$ServerFQDN`"; CertificateThumbprint=`"$($cert.Thumbprint)`"}"

# --------------------------------------------
# Step 4: Open firewall port 5986
# --------------------------------------------
Write-Host "`nOpening firewall port 5986..."

New-NetFirewallRule `
    -Name "WinRM-HTTPS" `
    -DisplayName "WinRM HTTPS" `
    -Protocol TCP `
    -LocalPort 5986 `
    -Direction Inbound `
    -Action Allow `
	-ErrorAction SilentlyContinue | Out-Null

# --------------------------------------------
# Step 5: Restart WinRM
# --------------------------------------------
Write-Host "`nRestarting WinRM service..."

Restart-Service WinRM

# --------------------------------------------
# Step 6: Validate
# --------------------------------------------
Write-Host "`nValidating WinRM HTTPS..."
$options = New-PSSessionOption -SkipCACheck -SkipCNCheck
try {
	Invoke-Command -ComputerName $ServerFQDN -UseSSL -SessionOption $options -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
    Write-Host "Remote WinRM over HTTPS succeeded" -ForegroundColor Green
} catch {
    Write-Host "Remote WinRM over HTTPS FAILED" -ForegroundColor Red
}

    2. Log in to the target server.

    3. Open PowerShell as Administrator.

    4. Navigate to the script location.

    5. Run the following command and modify <server-fqdn> to a fully qualified domain name of the WinRM server.

      powershell -ExecutionPolicy Bypass -File .\setup-winrm-server-https.ps1 -ServerFQDN <server-fqdn>

  4. Validate WinRM client connectivity.

    1. Copy the following script and save it as validate-winrm-client.ps1.

      Powershell script 
      param(
    [Parameter(
        Mandatory=$true,
        HelpMessage = "FQDN of WinRM server (e.g. server01.domain.com). Should match DNS and the hostname used for WinRM connections."
    )]
    [string]$WinRMServer
)

# ================================================
# WinRM Client Configuration and Port Check Script
# ================================================

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)

if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Script must be run as Administrator" -ForegroundColor Red
    exit 1
}

$computerAccount = "$env:USERDOMAIN\$env:COMPUTERNAME`$"

Write-Host "`n=== SERVER INFO ==="
Write-Host "Client machine: $computerAccount"
Write-Host "Target WinRM server: $WinRMServer"
Write-Host "User account: $(whoami)"
Write-Host "`n=== WINRM SERVICE STATUS ==="
$service = Get-Service WinRM -ErrorAction SilentlyContinue
if ($service -and $service.Status -eq "Running") {
    Write-Host "WinRM service is running" -ForegroundColor Green
} else {
    Write-Host "WinRM service is not running" -ForegroundColor Red
    exit 1
}

Write-Host "`n=== WINRM CONFIGURATION (LOCAL CLIENT) ==="
winrm get winrm/config/client

Write-Host "`n=== WINRM LISTENERS (LOCAL CLIENT) ==="
winrm enumerate winrm/config/listener

Write-Host "`n=== FIREWALL RULES (LOCAL CLIENT - WINRM) ==="
(Get-NetFirewallRule -DisplayGroup "Windows Remote Management" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, Enabled, Direction, Action |
    Out-String) | Write-Host

Write-Host "`n=== TESTING PORT CONNECTIVITY TO SERVER ==="
$ports = @(5985, 5986)

foreach ($port in $ports) {
    $result = Test-NetConnection -ComputerName $WinRMServer -Port $port -WarningAction SilentlyContinue

    if ($result.TcpTestSucceeded) {
        Write-Host "$WinRMServer : Port $port is OPEN" -ForegroundColor Green
    } else {
        Write-Host "$WinRMServer : Port $port is CLOSED" -ForegroundColor Red
    }
}

Write-Host "`n=== TESTING WINRM (HTTP) CONNECTIVITY ==="
try {
	Invoke-Command -ComputerName $WinRMServer -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
    Write-Host "Remote WinRM over HTTP succeeded" -ForegroundColor Green
} catch {
    Write-Host "Remote WinRM over HTTP FAILED" -ForegroundColor Red
}


Write-Host "`n=== TESTING WINRM (HTTPS) CONNECTIVITY ==="
$options = New-PSSessionOption -SkipCACheck -SkipCNCheck
try {
	Invoke-Command -ComputerName $WinRMServer -UseSSL -SessionOption $options -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
    Write-Host "Remote WinRM over HTTPS succeeded" -ForegroundColor Green
} catch {
    Write-Host "Remote WinRM over HTTPS FAILED" -ForegroundColor Red
}

Write-Host "`n=== SPN REGISTRATION ==="
Write-Host "Checking Kerberos ticket (klist)..."

# Purge tickets to ensure clean test
klist purge 2>$null | Out-Null

try {
    Invoke-Command -ComputerName $WinRMServer -Authentication Kerberos -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
} catch {
    Write-Host "Kerberos connection attempt FAILED" -ForegroundColor Red
}

# Get tickets
$klistOutput = klist
$spn = "HTTP/$WinRMServer"
$spnPattern = $spn.ToLower()
if ($klistOutput -match $spnPattern) {
    Write-Host "Kerberos ticket FOUND for $spn" -ForegroundColor Green
} else {
    Write-Host "Kerberos ticket NOT found for $spn" -ForegroundColor Yellow
}

    2. Open PowerShell as Administrator.

    3. Navigate to the script location.

    4. Run the following command and modify <winrm-server> to a fully qualified domain name of the WinRM server.

      powershell -ExecutionPolicy Bypass -File .\validate-winrm-client.ps1 -WinRMServer <winrm-server>

  5. If client connectivity validation fails, configure WinRM client.

    1. Copy the following script and save it as setup-winrm-client.ps1.

      Powershell script 
      param(
    [Parameter(
        Mandatory=$true,
        HelpMessage = "FQDN of WinRM server (e.g. server01.domain.com). Should match DNS and the hostname used for WinRM connections."
    )]
    [string]$WinRMServer
)

# ==========================
# WinRM Client Configuration
# ==========================

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)

if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Script must be run as Administrator" -ForegroundColor Red
    exit 1
}

winrm quickconfig -q

# Enable authentication (Kerberos / Negotiate)
Set-Item -Path WSMan:\localhost\Client\Auth\Basic -Value $false
Set-Item -Path WSMan:\localhost\Client\Auth\Kerberos -Value $true
Set-Item -Path WSMan:\localhost\Client\Auth\Negotiate -Value $true

# Read existing TrustedHosts
$existing = (Get-Item -Path WSMan:\localhost\Client\TrustedHosts).Value

if ([string]::IsNullOrWhiteSpace($existing)) {
    # Nothing set yet
    $newValue = $WinRMServer
}
elseif ($existing -notmatch "(^|,)\s*$WinRMServer\s*(,|$)") {
    # Append only if not already present
    $newValue = "$existing,$WinRMServer"
}
else {
    # Already present, keep as is
    $newValue = $existing
}

# Apply value
Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value $newValue -Force

    2. Open PowerShell as Administrator.

    3. Navigate to the script location.

    4. Run the following command and modify <winrm-server> to a fully qualified domain name of the WinRM server.

      powershell -ExecutionPolicy Bypass -File .\setup-winrm-client.ps1 -WinRMServer <winrm-server>

Configure an Nginx non-root account

The requirements in this section apply both to remote non-root accounts and to non-root users that run the sectigo-orchestration-gateway service.

If the service runs as a non-root user, that user must be configured in the same way as a non-root account.

Otherwise, the service must run as root.

You can manage an Nginx endpoint with a non-root account on the Nginx server.

The account can authenticate with either an SSH key or a password.

Because the orchestration gateway cannot enter a sudo password, the account must be permitted to run the required Nginx commands through sudo without a password.

Using a non-root account can reduce the privileges granted to the orchestration gateway while still allowing certificate deployment and Nginx management.

Existing endpoints that use the root account continue to work without any changes.

The orchestration gateway performs two types of operations on the Nginx server:

  • It validates the Nginx configuration and reloads or restarts the Nginx service. These operations require sudo permissions.

  • It updates managed server blocks in the Nginx configuration and uploads certificate and private key files. These operations require write access to the Nginx configuration.

The procedures in this section use sogsvc as an example non-root account name.

Create the account and configure authentication

Skip this procedure if the account already exists.

If the account signs in with a password instead of an SSH key, skip steps 2 to 4.

  1. On the Nginx server, create the account.

    sudo useradd -m -s /bin/bash sogsvc

  2. On the orchestration gateway machine, generate an SSH key pair.

    sudo ssh-keygen -t ed25519 -N "" -f /root/.ssh/sog_nginx
    The private key must stay on the orchestration gateway machine, in a location that the orchestration gateway service can read.

  3. Copy the /root/.ssh/sog_nginx.pub public key file to the Nginx server.

  4. On the Nginx server, add the public key to the authorized_keys file of the account.

    sudo mkdir -p /home/sogsvc/.ssh
sudo tee /home/sogsvc/.ssh/authorized_keys < sog_nginx.pub
sudo chown -R sogsvc: /home/sogsvc/.ssh
sudo chmod 700 /home/sogsvc/.ssh
sudo chmod 600 /home/sogsvc/.ssh/authorized_keys

Allow Nginx commands through sudo

  1. On the Nginx server, create the /etc/sudoers.d/sectigo-nginx file.

    sogsvc ALL=(root) NOPASSWD: /usr/sbin/nginx -v, /usr/sbin/nginx -t, /usr/bin/systemctl reload nginx.service, /usr/bin/systemctl restart nginx.service
    Command paths can differ between Linux distributions. To find the paths on your server, run command -v nginx and command -v systemctl.

  2. Validate the file and set its permissions.

    sudo visudo -cf /etc/sudoers.d/sectigo-nginx
sudo chmod 440 /etc/sudoers.d/sectigo-nginx

    To grant the commands to a group instead of a single account, start the line with %<groupname>, where <groupname> is the name of the group.

    For example, %nginxops ALL=(root) NOPASSWD:.

    In this case, also grant write access to the group in the next procedure, for example, sudo setfacl -m g:nginxops:rw /etc/nginx/conf.d/*.conf and sudo setfacl -m g:nginxops:rwx /etc/nginx.
    Grant only the commands in the /etc/sudoers.d/sectigo-nginx file.

Grant access to the Nginx configuration

The account must have write access to the following:

  • Each Nginx configuration file that contains a server block managed by the orchestration gateway, for example, /etc/nginx/conf.d/example.conf.

  • The directory of the main Nginx configuration file, by default, /etc/nginx.

The orchestration gateway uploads the certificate and private key files to this directory.

  1. On the Nginx server, grant write access by using access control lists.

    sudo setfacl -m u:sogsvc:rw /etc/nginx/conf.d/*.conf
sudo setfacl -m u:sogsvc:rwx /etc/nginx

    The first command grants write access only to the files that exist when you run it.

    When you add a configuration file later, run the command again.

    On Debian and Ubuntu, server blocks are often stored in /etc/nginx/sites-available and linked from /etc/nginx/sites-enabled.

    In this case, also run sudo setfacl -m u:sogsvc:rw /etc/nginx/sites-enabled/*.

    The command grants write access to the files that the links point to.
    Nginx loads its configuration as root.

Grant write access to the Nginx configuration only to the account that the orchestration gateway uses.

Verify your configuration

  1. On the Nginx server, run the following commands.

    sudo -u sogsvc sudo -n -l /usr/sbin/nginx -t
sudo -u sogsvc sudo -n -l /usr/bin/systemctl reload nginx.service
sudo -u sogsvc test -w /etc/nginx && echo "directory ok"
sudo -u sogsvc test -w /etc/nginx/conf.d/example.conf && echo "file ok"

    Each sudo -n -l line prints the permitted command.

If a line prints sudo: a password is required, the entry in the /etc/sudoers.d/sectigo-nginx file is missing or does not match the command.

Troubleshooting

Error Cause Solution

could not open error log file: …​ Permission denied or cannot load certificate key …​ Permission denied

The account is not permitted to run nginx -t through sudo.

Allow Nginx commands through sudo.

sudo: a password is required during restart

The /etc/sudoers.d/sectigo-nginx file does not include the systemctl commands.

Allow Nginx commands through sudo.

open /etc/nginx/…​ : permission denied during installation

The account does not have write access to the configuration file that contains the server block.

Grant access to the Nginx configuration.

put_file …​ permission denied during installation

The account does not have write access to the directory of the main Nginx configuration file.

Grant access to the Nginx configuration.

Custom scripts

When adding P12, JKS, or PEM endpoints to an orchestration gateway, you can optionally configure custom scripts for specific actions.

  • Installation script — When configured, the script runs after the certificate and private key entries have been successfully created in the target keystore. This script is invoked with the alias of the newly created keystore entry passed as a parameter. Custom scripts must be implemented to accept this parameter.

    The following is the example of how the installation script is invoked:

    • Windows:

      .\install.ps1 -Alias "<value>"

    • Linux:

      ./install.sh --alias=<value>

  • Restart script — When configured, this script runs when Restart is clicked in SCM. This script is for specific actions that should be triggered explicitly as an independent step rather than as part of the installation process.