AnyCAGateway REST

The Keyfactor AnyCA Gateway REST enables Keyfactor Command to integrate with supported third-party certificate authorities (CAs) through vendor-specific gateway extensions using a modern REST-based architecture. The gateway provides a common HTTPS interface, while extensions implement support for individual CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. products such as DigiCert, GoDaddy, and other supported CAs. This guide covers installation and configuration of the Keyfactor AnyCA Gateway REST.

Key Benefits:

• Unified Integration: Simplified integration of third-party CAs through a single, consistent interface.

• Scalability: Support multiple gateway instances on a single host, each managing multiple certificate authorities of the same type.

• High Availability: Configurable lockout settings to support high-availability during CA synchronization.

• Centralized Management: Dedicated management portal for configuring and managing the gateway.

• Modern Authentication: Compatibility with modern authentication methods, including OAuth 2.0 and client certificates.

• Support for domain validation through pluggable domain validation providers.

For organizations using Keyfactor Command version 11 or above, the AnyCAGateway REST enables streamlined certificate lifecycle management and improved integration workflows. Upgrades from AnyCAGateway DCOM (version 20.7 or later) are also supported.

Architecture

The AnyCAGateway REST is configured as an HTTPS CA in Keyfactor Command, replacing the DCOM-based configuration used in the earlier AnyCAGateway DCOM. This shift simplifies integration and aligns with modern communication standards. Third-party CA integrations are available on Keyfactor’s GitHub repository to support the REST-based architecture.

Depending on the specific implementation, the gateway supports certificate functions such as:

• Role-based certificate management
• Certificate enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). and revocation
• Certificate chain retrieval—Retrieve full certificate chain for easy installation
• Certificate inventory view—Comprehensive retrieval and querying of existing certificate information
• Certificate authorization management
• Certificate renewal—Renew a certificate approaching expiration

• Domain validation—Verify domain control as part of certificate issuance workflows

Authentication

The AnyCAGateway REST uses authentication to:

• Support user access to the gateway portal for configuration.

• Allow users and services to integrate with the gateway for certificate enrollment and revocation.

• Facilitate Keyfactor Command interaction with the gateway for certificate enrollment, revocation, synchronization, and domain validation.

The gateway supports using either client certificates or OAuth 2.0 OpenID Connect (OIDC) for authentication. Only one authentication method is supported at a time for a given instance of the AnyCAGateway REST.

Integrations

The documentation in this guide focuses on a generic gateway. Integrations for common third-party certificate authorities are publicly available on the Keyfactor GitHub:

As additional third-party CA connections are developed, each will include its own plugin. However, the installation, configuration, and management processes remain consistent across all third-party CAs, as outlined in this guide—a key advantage of the Keyfactor AnyCA Gateway REST.