Overview of ACME automation service
ACME service components
The ACME automation service for DigiCert® Trust Lifecycle Manager involves the following components.
Component | Description |
|---|---|
ACME client | You need an ACME client installed on each of your systems. |
Certificate profiles | In Trust Lifecycle Manager, you need one or more certificate profiles that your ACME clients can use to request certificates. Certificate profiles supply the required ACME credentials and set the properties of issued certificates. |
Certificate authority (CA) | You need one or more CAs that can issue certificates for your organization/domains. You can use an issuing CA in DigiCert® Private CA or an external issuing CA linked to your Trust Lifecycle Manager account via a CA connector. |
ACME external account binding (EAB)
ACME EAB credentials
The ACME protocol (RFC 8555) defines an external account binding (EAB) field that ACME clients can use to access a specific account on the certificate authority (CA). DigiCert®'s ACME implementation uses the EAB field to identify both your DigiCert® Trust Lifecycle Manager account and a specific certificate profile there.
Your ACME client must send the following EAB credentials to request certificates:
Key identifier (KID): Identifies your DigiCert ONE account and the automation profile for certificate issuance.
HMAC key: Authenticates the ACME client during account creation on the DigiCert ACME service, proving that the client is authorized to use the selected certificate profile.
ACME automation profiles
In Trust Lifecycle Manager, you create ACME-based certificate profiles to get the required ACME EAB credentials and define the types of certificates that can be issued via ACME.
DigiCert provides base templates to facilitate the creation of profiles. To create an ACME-based certificate profile, you select an available base template and then add your unique business and certificate requirements, selecting 3rd-party ACME client as the certificate enrollment method.
Each ACME-based certificate profile has unique ACME external account binding (EAB) credentials associated with it. Your ACME clients use these credentials to request new certificates from that profile.
ACME-based certificate requests
When a new certificate is required on a system, you use the local ACME client there to request the certificate from a particular profile in Trust Lifecycle Manager. The rest of the process is automated:
Trust Lifecycle Manager authenticates and processes the request.
The relevant public or private certificate authority (CA) issues the certificate.
The ACME client downloads and installs the certificate on your system.
 |