Keyfactor enables seamless management of diverse certificate authorities (CAs) through gateways—software that translates CA
A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA.-specific APIs and communication protocols into a unified interface. The Keyfactor gateway framework provides shared logic across gateway implementations and facilitates communication with Keyfactor Command. It hosts plug-ins that are purpose-built to interact with specific CAs, allowing third-party CAs to function similarly to those natively supported by Keyfactor Command.
Depending on the implementation, gateways can support key certificate functions, including:
- Role-based certificate management: Use enterprise CA-style access control lists.
- Certificate enrollment: Request certificates via the gateway or standard Microsoft tools.
- Certificate revocation: Revoke issued certificates.
- Certificate chain retrieval: Retrieve complete chains for easy installation.
- Certificate inventory: Query and retrieve existing certificate data.
- Certificate authorization management: Manage certificate approval and denial.
- Certificate renewal: Renew certificates nearing expiration.
Keyfactor offers a range of custom-built gateway plug-ins to support specific CA vendors, available on GitHub:
This guide covers the installation of the base gateway framework. Full implementations require custom plug-ins, which you can obtain from GitHub, develop in-house, or request from Keyfactor's Integration Team.
While each third-party CA integration uses a distinct plug-in, the installation, configuration, and management processes are consistent across integrations. This uniformity is a key benefit of the AnyCAGateway DCOM framework. For more information about building custom gateways, contact support@keyfactor.com.
The logical name of a CA is the common name given to the CA at the time it is created. For Microsoft CAs, this name can be seen at the top of the Certificate Authority MMC snap-in. It is part of the FQDN\Logical Name string that is used to refer to CAs when using command-line tools and in some Keyfactor Command configuration settings (e.g. ca2.keyexample.com\Corp Issuing CA Two)., which is specified in the configuration file (see Edit the JSON Configuration File). If you have more than one type of CA (e.g. Entrust and DigiCert), a separate gateway will need to be installed for each type and these must reside on separate servers.