AnyCAGateway DCOM

Keyfactor enables seamless management of diverse certificate authorities (CAs) through gateways—software that translates CAClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA.-specific APIs and communication protocols into a unified interface. The Keyfactor gateway framework provides shared logic across gateway implementations and facilitates communication with Keyfactor Command. It hosts plug-ins that are purpose-built to interact with specific CAs, allowing third-party CAs to function similarly to those natively supported by Keyfactor Command.

Note:  This documentation covers version 25.1 of the AnyCAGateway DCOM.

Depending on the implementation, gateways can support key certificate functions, including:

  • Role-based certificate management: Use enterprise CA-style access control lists.
  • Certificate enrollment: Request certificates via the gateway or standard Microsoft tools.
  • Certificate revocation: Revoke issued certificates.
  • Certificate chain retrieval: Retrieve complete chains for easy installation.
  • Certificate inventory: Query and retrieve existing certificate data.
  • Certificate authorization management: Manage certificate approval and denial.
  • Certificate renewal: Renew certificates nearing expiration.

Keyfactor offers a range of custom-built gateway plug-ins to support specific CA vendors, available on GitHub:

https://keyfactor.github.io/integrations-catalog/content/ca-gateway

This guide covers the installation of the base gateway framework. Full implementations require custom plug-ins, which you can obtain from GitHub, develop in-house, or request from Keyfactor's Integration Team.

While each third-party CA integration uses a distinct plug-in, the installation, configuration, and management processes are consistent across integrations. This uniformity is a key benefit of the AnyCAGateway DCOM framework. For more information about building custom gateways, visit the Keyfactor Support Portal(opens page in a new tab) to open a support ticket.

Note:  The AnyCAGateway DCOM supports multi-tenancy, which allows one installation of the AnyCAGateway DCOM to connect to multiple cloud provider CAs. Each CA is differentiated by its logical nameClosed The logical name of a certificate authority (CA) is the human-readable name assigned to the CA when it is created. This name is used to uniquely identify the CA within its management system and in Keyfactor Command configuration settings. For some CA types, such as Microsoft CAs, the logical name is combined with the CA host name to form a fully qualified identifier (e.g., ca1.keyexample.com\Corp Issuing CA One) that may be used in command-line tools and configuration references. The exact format and usage of the logical name can vary by CA type., which is specified in the configuration file (see Edit the JSON Configuration File). If you have more than one type of CA (e.g., Entrust and DigiCert), a separate gateway will need to be installed for each type and these must reside on separate servers.