Configuring the connector

This page describes how to configure the connector for certificate enrollment and management.

Configure AWS programmatic access

After installing the AWS CLI, configure environment variables to use AWS programmatically:

Obtain access credentials associated with your IAM user in the AWS console:
1. Navigate to the IAM section.
2. Select Users in the left menu.
3. Select the user and navigate to the Security credentials tab.
4. Click Create access key and copy Access key ID and Secret access key (you can also download a CSV file with the values).

Specify your access keys and default region name for one or more AWS accounts (you can change the default region at any time) using the aws configure command.

Single AWS account
Multiple AWS accounts

aws configure
AWS Access Key ID [None]: "<access_key_id"
AWS Secret Access Key [None]: "<secret_access_key>"
Default region name [None]: "<region_name>"
Default output format [None]: json

Run the aws configure --profile <profile_name> command for each AWS account where you will install the connector.

aws configure -- profile <account_name>
AWS Access Key ID [None]: "<access_key_id"
AWS Secret Access Key [None]: "<secret_access_key>"
Default region name [None]: "<region_name>"
Default output format [None]: json

The profile name and default region are saved to the ~/.aws/config file.

[default]
region=us-west-2
output=json
[profile aws_account_1]
region=ca-central-1
output=json

The AWS credentials are saved to the ~/.aws/credentials file.

[default]
aws_access_key_id=AKIAIOSFODNN7EXAMPLE
aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
[profile aws_account_1]
aws_access_key_id=FLI4IOAFOZNN7EXAPPLE
aws_secret_access_key=cKeprIUhnFJMI/K7VDENG/bPxRfiCYEXAMPLEKEY

Configure the ACME accounts file

Configure the acme_accounts.yaml file.

The acme-account.yaml file is uploaded to the S3 bucket. This file contains EAB information for the ACME accounts, which is sensitive data and must be protected. To edit or redeploy the file, use the AWS CLI commands. You can also work with the file using the AWS console.

Sample ACME accounts file

accounts:
  scm_demo:
    -
      acme-endpoint: "https://acme.demo.sectigo.com"
      eab-hmac-key: "cXJpUlh2OTZFcW11cEIwcFVrWWtCOFRRYWJzTnVqejhrMDd3MWR6TzBkVnpvaTVY"
      eab-key: "dfd846050852841ffaaf87cfa64b53e1"
      email: [email protected]
      RenewBeforeDays: 30
      KeyType: RSA
      KeySize: 2048
  scm_demo2:
    ...

The following table describes the parameters in the file.

Parameter Description

Parameter	Description
`<scm_demo>`	An arbitrary alias for your ACME account
`acme-endpoint`	The URL of the ACME server
`eab-hmac-key`	The HMAC key for external account binding
`eab-key`	The key ID for external account binding
`email`	The email address for ACME account registration and recovery contact
`RenewBeforeDays`	The number of days prior to certificate expiration that a renewal process is initiated. The default expiry window is `30` days.
`KeyType`	The key algorithm to use for certificate enrollment. The possible values are `RSA` and `ECDSA`.
`KeySize`	The key size to use for certificate enrollment. The possible values are `2048` and `4096` for `RSA`, and `256`, `384`, and `521` for `ECDSA`.

<scm_demo>

An arbitrary alias for your ACME account

acme-endpoint

The URL of the ACME server

eab-hmac-key

The HMAC key for external account binding

eab-key

The key ID for external account binding

email

The email address for ACME account registration and recovery contact

RenewBeforeDays

The number of days prior to certificate expiration that a renewal process is initiated. The default expiry window is 30 days.

KeyType

The key algorithm to use for certificate enrollment. The possible values are RSA and ECDSA.

KeySize

The key size to use for certificate enrollment. The possible values are 2048 and 4096 for RSA, and 256, 384, and 521 for ECDSA.