Use the Admin web request function on the Enrollments page to enroll a new certificate with automated delivery to external systems.
With this feature, you can enroll a certificate from a variety of issuing CAs and deliver the issued certificate simultaneously to one or more:
Server systems (via DigiCert agents).
AWS Certificate Manager (ACM) instances.
Azure key vaults.
Google Certificate Manager instances.
The automation feature must be enabled for your DigiCert® Trust Lifecycle Manager account. Contact your DigiCert account representative to verify or enable this feature.
To deliver certificates to:
Server systems, you need a DigiCert agent installed on each.
AWS Certificate Manager (ACM) instances, you need an AWS unified connector.
Azure key vaults, you need a vault connector.
Google Certificate Manager instances, you need a GCP unified connector.
You need one or more certificate profiles for the
Admin web requestenrollment method.When creating certificate profiles for automated delivery, look for certificate templates that list "Vault delivery" in the Use cases column. These templates support the required
Admin web requestenrollment method.For CertCentral certificate profiles, only OV/EV certificate products can be requested for delivery. Make sure to select an OV or EV product in the Certificate type dropdown when using the
Admin web requestenrollment method.
On the Enrollments page, select the Admin web request button at top.
Fill out the form as described below.
Profile: Select a certificate profile to use for enrolling the new certificate. Only profiles with the
Admin web requestenrollment method are included in this dropdown menu. Use the Show details link to verify the properties for the selected certificate profile.Certificate information:
Common Name: Enter a common name (CN) for the new certificate.
Other hostnames (SANs): Enter subject alternative names (SANs) to include in the new certificate, one at a time. To instead import the list of SANs from a CSV file, select the Import CSV button.
This field is optional and only appears if the certificate profile you selected supports it.
Under the Enrollments details > Subject Alternative Name (SAN) section, IP addresses are allowed for DNS name.
Additional order options: Enter order handling information, not to be included in the certificate itself. This section is optional and only appears if the certificate profile you selected supports it.
Certificate delivery: Use the checkboxes to select the delivery location(s) for the issued certificate, then select options in the sidebar that opens. For detailed instructions per location type, see the below sections:
|Auto-renew: To automatically renew this certificate before expiration and deliver the new certificate to the same delivery locations, select the Auto-renew schedule checkbox. Select options for when to submit the renewal request (number of days before expiration).
Note: Selections you make here override any auto-renewal options in the certificate profile.
Tags (optional): Apply tags to the issued certificate to help monitor and manage it in Trust Lifecycle Manager.
Custom attributes (optional): Select the required custom attribute.
Note
The custom attributes option is displayed if the selected certificate profile includes the configured custom attributes.
Select the link to read the Certificate Services Agreement and then check the box to acknowledge/agree to it.
Select Submit request to submit the certificate enrollment request based on the values you filled into the form.
The issued certificate gets delivered to the locations you selected and can be monitored and managed from your Inventory page in Trust Lifecycle Manager.