Add a DigiCert issuer

In this guide, you add DigiCert to ITVA as an issuer. You then import the SSL/TLS certificates that DigiCert issued for your account, and create a CA template so that users can request new certificates from DigiCert.

The ITVA platform connects to the DigiCert CertCentral API directly, with an API key. This issuer does not use a probe.

Before you begin

• Your ITVA role can manage Issuers and CA Templates.
• You can create an API key in your DigiCert CertCentral account.
• You know the DigiCert organization ID, and the product name ID of the certificate product that ITVA orders. You need them for the CA template.

Create a DigiCert API key

ITVA uses the API key to list your certificate orders, download certificates, place new orders, and reissue orders.

1. Sign in to DigiCert CertCentral.
2. Create an API key for ITVA.
3. Copy the key. You add it to ITVA in the next section.

Add the issuer

1. In the portal, go to Inventory > Issuers.
2. Select New Certificate Issuer.
3. In Name, enter a name for the issuer. The name must be unique in your organization.
4. In Kind, select DigiCert.
5. In Credential, select Select. The Select Credential panel opens.
6. Select New.
7. In Name, enter a name for the credential.
8. In the type list, select API Key.
9. In API Key, paste the DigiCert API key, then select Save. The portal adds the credential to the issuer.
10. Select Save. The portal opens the page for the new issuer.

Import your DigiCert certificates

1. On the issuer page, select Sync. The portal shows a message that the issuer is scheduled for sync.
2. Wait for the sync to finish, then refresh the page. A large account can take several minutes.

The sync imports each certificate order that is issued, expired, or revoked, for SSL/TLS products only. It skips certificates that expired more than 365 days ago. For each certificate, ITVA downloads the certificate and its chain.

ITVA adds each certificate to an enrollment under the issuer, with one enrollment for each common name. ITVA does not have the private keys of imported certificates. To renew an imported certificate from ITVA, select Renew on its enrollment and select a key source.

ITVA does not sync on a schedule. To import certificates that you ordered outside ITVA, select Sync again.

Create a CA template

The sync does not import templates from DigiCert. To issue new certificates, create at least one template in ITVA. The template tells ITVA which DigiCert organization and product to order.

1. Go to Inventory > CA Templates.
2. Select New.
3. In Name, enter a name that users will recognize when they request a certificate.
4. In Issuer, select your DigiCert issuer. The DigiCert Settings fields show.
5. In Organization ID, enter your DigiCert organization ID. It is a number.
6. In Product Name ID, enter the DigiCert product name ID of the certificate product to order.
7. Optional: In Private Key Algorithms, select the key algorithms that certificates from this template can use. In Organization Information, enter the values that new enrollment requests start with.
8. Select Save.
9. On the CA Templates page, turn on the Enabled switch for the new template. New templates are off, and users who cannot manage CA templates see only the templates that are on.

ITVA orders each certificate from DigiCert with a validity of 1 year and a SHA-256 signature. ITVA asks DigiCert to skip the order approval step in CertCentral.

Check that it worked

1. Open the issuer page. Make sure that your DigiCert certificates show in the enrollments list.
2. Go to Inventory > CA Templates. Make sure that your template shows with your DigiCert issuer, and is enabled.

Troubleshooting

If the portal shows "credential is required" when you save the issuer, select a credential in Credential.

The portal does not show sync errors. If no certificates show after a sync, do these checks:

• Make sure that the credential has the type API Key, and that the key is active in CertCentral.
• Make sure that the account has SSL/TLS certificate orders that are issued, expired, or revoked, and that did not expire more than 365 days ago. The sync skips all other orders.
• If some certificates show and others do not, one download can stop the sync. Select Sync again. ITVA skips the certificates that it already has.

If issuing a certificate fails with an error that digicert_organization_id or digicert_product_name_id is required, edit the template and enter the Organization ID and the Product Name ID.