Request a Certificate

When you request a certificate through Keyfactor ACME, it is requested via the Keyfactor ACME enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). API An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. and validated with your Certbot account and the ACME configuration details. A regular enrollment request is then issued in Keyfactor Command and will display in the certificate search in the Keyfactor Command Management Portal.

Important:  The certificate request is submitted by Certbot with SAN The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common. only and no subject. By default, Keyfactor Command is configured to reject certificate requests that do not contain a value for the CN A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (e.g. CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (e.g. servername.keyexample.com or www.keyexample.com). in the subject. Before submitting a certificate request with Certbot, you will need to remove the default regular expression A regular expression--RegEx--is a pattern used to validate data by ensuring it meets specific criteria. Several fields on the CSR enrollment, CSR generation, and PFX enrollment pages support RegEx validation, including certificate subject and metadata fields. for common names configured in the Keyfactor Command Management Portal under Enrollment Patterns on the Enrollment RegExes tab (see Enrollment Pattern Operations - Adding or Modifying an Enrollment Pattern: Enrollment RegExes Tab in the Keyfactor Command Reference Guide).

Certbot has multiple parameters to specify differing options. The parameter A parameter or argument is a value that is passed into a function in an application. values you will need to make a simple request for a certificate from your Keyfactor ACME server and Keyfactor Command are shown in Table 23: Request Certificate Parameters. Your Certbot implementation may require a different web server plugin than the popular ones shown in this table.

Table 23: Request Certificate Parameters

https://acmesrvr93.keyexample.com/ACME

appsrvr162.keyexample.com

Example for Standalone:

REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt certbot --standalone --server https://acme93.keyexample.com/ACME -d appsrvr18.keyexample.com

Example for Standalone with IP address SANs submitted in a script:

1. Create an input configuration file containing the subject and SAN values:

   Copy

   ip-csr A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA..cnf

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   [req]
   distinguished_name = req_distinguished_name
   req_extensions = req_ext
   prompt = no
   
   [req_distinguished_name]
   CN = mysubject.keyexample.com
   C = US
   ST = Ohio
   L = Independence
   O = Key Example
   OU = IT
   
   [req_ext]
   subjectAltName = @alt_names
   
   [alt_names]
   IP.1 = 192.168.12.148
   IP.2 = 2001:db8:abcd:cdef:1:1:1:1
   DNS.1 = mysan.keyexample.com

2. Create a script to submit the request to the Keyfactor ACME server, calling the configuration file:
3. Copy

   enroll-script.sh

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   #!/bin/bash
   
   # Enroll for an SSL cert with the specified Keyfactor ACME server.
   # Usage: .\scriptname.sh
   
   acmehost=acme93.keyexample.com
   
   openssl genrsa -out keypair.pem 2048
   openssl req -new -key keypair.pem -out ip-csr.csr -config ip-csr.cnf
   
   REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt certbot certonly --standalone --server "https://$acmehost/ACME" -v --csr ip-csr.csr

4. Execute the script.

Example for Apache:

REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt certbot --apache --server https://acme93.keyexample.com/ACME -d appsrvr27.keyexample.com

Example for Nginx:

REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt certbot certonly --nginx --server https://acme93.keyexample.com/ACME -d appsrvr162.keyexample.com

Expected Results in Linux for Nginx:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for appsrvr162.keyexample.com
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
  /etc/letsencrypt/live/appsrvr162.keyexample.com-0001/fullchain.pem
  Your key file has been saved at:
  /etc/letsencrypt/live/appsrvr162.keyexample.com-0001/privkey.pem
  Your cert will expire on 2023-09-14. To obtain a new or tweaked
  version of this certificate in the future, simply run certbot
  again. To non-interactively renew *all* of your certificates, run
  "certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
Donating to EFF:                    https://eff.org/donate-le