AnyCAGateway DCOM

The Keyfactor AnyCAGateway DCOM enables Keyfactor Command to integrate with supported third-party certificate authorities (CAs) through vendor-specific gateway extensions. The gateway provides the common communication framework, while extensions implement support for individual CAClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. products such as DigiCert, GoDaddy, and other supported CAs. This guide covers installation and configuration of the AnyCAGateway DCOM.

Note:  This documentation covers version 26.2 of the AnyCAGateway DCOM.

Depending on the implementation, gateways can support key certificate functions, including:

  • Role-based certificate management: Use enterprise CA-style access control lists.
  • Certificate enrollment: Request certificates via the gateway or standard Microsoft tools.
  • Certificate revocation: Revoke issued certificates.
  • Certificate chain retrieval: Retrieve complete chains for easy installation.
  • Certificate inventory: Query and retrieve existing certificate data.
  • Certificate authorization management: Manage certificate approval and denial.
  • Certificate renewal: Renew certificates nearing expiration.

Keyfactor offers a range of custom-built gateway plug-ins to support specific CA vendors, available on GitHub:

https://keyfactor.github.io/integrations-catalog/content/ca-gateway

This guide covers the installation of the base gateway framework. Full implementations require custom plug-ins, which you can obtain from GitHub, develop in-house, or request from Keyfactor's Integration Team.

While each third-party CA integration uses a distinct plugin, the installation, configuration, and management processes are consistent across integrations. This uniformity is a key benefit of the AnyCAGateway DCOM framework. For more information about building custom gateways, visit the Keyfactor Support Portal(opens page in a new tab) to open a support ticket.

Note:  The AnyCAGateway DCOM supports multi-tenancy, which allows one installation of the AnyCAGateway DCOM to connect to multiple cloud provider CAs. Each CA is differentiated by its logical nameClosed The logical name of a certificate authority (CA) is the human-readable name assigned to the CA when it is created. This name is used to uniquely identify the CA within its management system and in Keyfactor Command configuration settings. For some CA types, such as Microsoft CAs, the logical name is combined with the CA host name to form a fully qualified identifier (for example, ca1.keyexample.com\Corp Issuing CA One) that may be used in command-line tools and configuration references. The exact format and usage of the logical name can vary by CA type., which is specified in the configuration file (see Edit the JSON Configuration File). If you have more than one type of CA (for example, Entrust and DigiCert), a separate gateway will need to be installed for each type and these must reside on separate servers.