Create Service Accounts for the Keyfactor CA Connector

The CA ConnectorClosed The Keyfactor CA Connector is installed in the customer environment to provide a connection between a CA and Keyfactor Command when a direct connection is not possible. It is supported on both Windows and Linux and has versions for Microsoft (Windows only) or EJBCA CAs. Client uses up to two service accounts to communicate with the on-premises CAClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA.(s) and the Keyfactor Command server:

  • A service account that runs the CA Connector Client service (see CA Connector Client Service).

  • A service account configured in the Keyfactor Command Management Portal that the CA Connector Client uses to connect to the CA for reading certificate records, enrolling certificates, and performing revocation and other management functions (see CA Connection Access).

The same account can serve both roles.

A client account in your OAuth authentication mechanism is also needed, to provide token authentication from the CA Connector Client to Keyfactor Command (see Identify the CA Connector Client Access Token).

Create the service account(s) before installing the CA Connector Client software, except as noted below for installations on Linux. The person installing the CA Connector Client software needs to know the domain (if applicable), username, and password of each service account.

CA Connector Client Service

  • Windows

    When the CA Connector Client is installed on Windows, you can use either the built-in Network Service account or a custom service account to run the service. The custom service account can be an Active Directory service account, a group managed service account (gMSA), or a local machine account. An Active Directory service account or gMSA is typically used unless the machine is not domain-joined. If you use an Active Directory service account or gMSA, it needs to be a service account in the forestClosed An Active Directory forest (AD forest) is the top most logical container in an Active Directory configuration that contains domains, and objects such as users and computers. in which the CA Connector Client is installed.

    The CA Connector Client runs as the service account you select for this role. The service account requires local Log on as a service permissions.

  • Linux

    For the purposes of this documentation, Linux machines are assumed to be non-domain-joined and to use a local account to run the CA Connector Client.

    For Linux systems, Keyfactor recommends running the service as an account other than root. If you use the --force option during installation, the installer automatically creates the default account keyfactor-caconnector. If you don't use the --force option, you can create a local service account before running the installation script.

CA Connection Access

  • Microsoft CAs

    When each Microsoft CA is configured in the Keyfactor Command Management Portal, you can select the Use Explicit Credentials option and configure a service account from the on-premises forest. When this option is turned on, the CA Connector Client uses this account to communicate with the on-premises CA on behalf of Keyfactor Command. If this option isn't turned on, the CA Connector Client uses the account configured to run the CA Connector Client service instead.

  • EJBCA CAs

    When each EJBCA CA is configured in the Keyfactor Command Management Portal, choose one of the following to authenticate Keyfactor Command to the EJBCA instance via the CA Connector Client:

    • A client certificate issued from the EJBCA CA and associated with an EJBCA end entity. You can create an end entity for this purpose or use an existing one.

    • OAuth authentication.