Lead guide

The account lead is responsible for managing assets, users, and is able to sign with the key stored DigiCert® Software Trust Manager.

Follow the instructions below to set up your account for code signing.

Add users to your account

Before adding new users, identify the type of user and the role you need them to play in the account.

User types

There are two types of DigiCert ONE users:

Exemple 1. User

A user has access to DigiCert ONE. A user is generally a person who needs to perform cryptographic actions in Software Trust Manager and clients.

Users are associated with:

First and last name
Username
Email address
Telephone number

Exemple 2. Service user

A service user does not have access to the Software Trust Manager UI. A service user is generally a user-like entity with API access that is not associated with a real person and is used for automation of workflows on a machine such as a build server.

Service users are associated with:

Friendly name
Email address (used for notifications)

User roles

There are 5 types of Software Trust Manager user roles:

Exemple 3. Lead

The lead role is used for users responsible for managing cryptographic assets, enforcing policies, monitoring compliance for users in the account.

The following permissions assigned to this role:

Category	Permission	User can
User settings	Default	View their own user profile and generate their own API key and client authentication certificate in DigiCert ONE.
Account settings	Manage account settings	Update Software Trust Manager > Accounts > Account settings.
Account settings	Manage CertCentral API key	Delete, disable, enable, setup, update and validate a CertCentral API key.
Teams	Manage all teams	Create teams. View, update, deactivate, delete, and assign resources to all teams within the account, provided that they have relevant resource permissions.
Audit logs	View audit log	View audit and signature logs in the account.
Audit logs	Export audit logs	Export audit and signature logs in the account. Note `View audit log` is required as an additional permission to be able to export audit logs.
Certificates	Manage certificate hierarchy	View and create hierarchies. They can also activate and deactivate restricted hierarchies.
	Manage certificate profiles	View, create, update, clone, enable, and disable certificate profiles that are created by the user. View, update, and delete all certificates associated with a certificate profile that the user created.
	View certificate profile	View certificate profiles created by the user.
	View certificate template	View certificate template details in the account.
	Generate certificate	Create a new certificate using keypairs that they are assigned to. Note Users with `Manage keypair` permission can create a new certificate using any keypair within the account.
	Import certificate	Import certificates for keypairs that they are assigned to. Note Users with `Manage keypair` permission can import a certificate to any keypair within the account.
	Revoke certificate	Revoke certificates associated with keypairs that they are assigned to. Note Users with `Manage keypair` permission can revoke certificates associated to any keypair within the account.
	View certificate	View certificate details for all certificates assigned to them. Note Users with `Manage keypair` permission can view all certificates within the account.
Keypairs	Request keypair export	Request to export keypairs that they are assigned to. Note Users with `Manage keypair` permission can request to export any keypair within the account.
	Approve keypair export	Approve requests to export keypairs that they are assigned to. Note Users with `Manage keypair` permission can approve keypair exports for any keypair within the account.
	Approve keypair delete	Approve requests to delete keypairs that they are assigned to. Note Users with `Manage keypair` permission can approve keypair delete for any keypair within the account.
	Import keypair	Import keypairs into the account. Note To import a GPG secring, `Manage master key` is also required.
	Generate keypair	Create a new keypair.
	View keypair	View keypairs and key rotations relying on keypairs assigned to them. Note Users with `Manage keypair` permission can view all keypairs and key rotations within the account.
	Manage keypair	Update, suspend or unsuspend keypairs. Create, update, enable, and disable keypair profiles. Create and update user groups. Create, update, and refresh key rotation. Generate a CSR.
	Manage master GPG key	Create GPG master key, provided that the user also has `Generate keypair` permission. Import a GPG secring, provided that the user also has `Import keypair` permission. Update, suspend, unsuspend master keys that they are assigned to. Note Users with `Manage keypair` permission can update, suspend, unsuspend any master keys within the account. Delete master keys assigned to them, provided that the user also has `Approve keypair delete` permission. Note Users with `Manage keypair` permission can delete any master key within the account. Revoke master keys assigned to them, provided that the user also has `Revoke certificate` permission. Note Users with `Manage keypair` permission can revoke any master key within the account.
Signatures	Sign	Sign software with keypairs assigned to them.
Releases	View release	View all releases in the account.
	Request release	Request to create an offline release.
	Approve release	Create a release and approve or reject requests to create offline releases.
Threat detection	Manage threat detection	Download threat detection reports and assign threat detection scans to projects.

Exemple 4. Team lead

The team lead role is used for managing developers and engineering teams responsible for signing and releasing software.

The following permissions assigned to this role:

Category	Permission	Description
User settings	Default	View their own user profile and generate their own API key and client authentication certificate in DigiCert ONE.
Teams	Manage my teams	View, update, deactivate, and map resources to existing teams that they are part of, provided that they have relevant resource permissions.
Audit logs	View audit log	View audit and signature logs in the account.
Audit logs	Export audit logs	Export audit and signature logs in the account. Note `View audit log` is required as an additional permission to be able to export audit logs.
Certificates	Manage certificate hierarchy	View and create hierarchies. They can also activate and deactivate restricted hierarchies.
	View certificate profile	View certificate profiles created by the user.
	View certificate template	View certificate template details in the account.
	Import certificate	Import certificates for keypairs that they are assigned to. Note Users with `Manage keypair` permission can import a certificate to any keypair within the account.
	Revoke certificate	Revoke certificates associated with keypairs that they are assigned to. Note Users with `Manage keypair` permission can revoke certificates associated to any keypair within the account.
	Generate certificate	Create a new certificate using keypairs that they are assigned to. Note Users with `Manage keypair` permission can create a new certificate using any keypair within the account.
	View certificate	View certificate details for all certificates assigned to them. Note Users with `Manage keypair` permission can view all certificates within the account.
Keypairs	Import keypair	Import keypairs into the account. Note To import a GPG secring, `Manage master key` is also required.
	Request keypair export	Request to export keypairs that they are assigned to. Note Users with `Manage keypair` permission can request to export any keypair within the account.
	Approve keypair export	Approve requests to export keypairs that they are assigned to. Note Users with `Manage keypair` permission can approve keypair exports for any keypair within the account.
	Approve keypair delete	Approve requests to delete keypairs that they are assigned to. Note Users with `Manage keypair` permission can approve keypair delete for any keypair within the account.
	Generate keypair	Create a new keypair.
	View keypair	View keypairs and key rotations relying on keypairs assigned to them. Note Users with `Manage keypair` permission can view all keypairs and key rotations within the account.
	Manage keypair	Update, suspend or unsuspend keypairs. Create, update, enable, and disable keypair profiles. Create and update user groups. Create, update, and refresh key rotation. Generate a CSR.
	Manage master GPG key	Create GPG master key, provided that the user also has `Generate keypair` permission. Import a GPG secring, provided that the user also has `Import keypair` permission. Update, suspend, unsuspend master keys that they are assigned to. Note Users with `Manage keypair` permission can update, suspend, unsuspend any master keys within the account. Delete master keys assigned to them, provided that the user also has `Approve keypair delete` permission. Note Users with `Manage keypair` permission can delete any master key within the account. Revoke master keys assigned to them, provided that the user also has `Revoke certificate` permission. Note Users with `Manage keypair` permission can revoke any master key within the account.
Signatures	Sign	Sign software with keypairs assigned to them.
Releases	View release	View all releases in the account.
	Request release	Request to create an offline release.
	Approve release	Create a release and approve or reject requests to create offline releases.
Threat detection	Manage threat detection	Download threat detection reports and assign threat detection scans to projects.

Exemple 5. Developer

The developer role is used for users responsible for signing, managing assets related to signing, and releasing software.

The following permissions assigned to this role:

Category	Permission	User can
User settings	Default	View their own user profile and generate their own API key and client authentication certificate in DigiCert ONE.
Audit logs	View audit log	View audit and signature logs in the account.
Certificates	View certificate profile	View certificate profiles created by the user.
	View certificate template	View certificate template details in the account.
	Generate certificate	Create a new certificate using keypairs that they are assigned to. Note Users with `Manage keypair` permission can create a new certificate using any keypair within the account.
	View certificate	View certificate details for all certificates assigned to them. Note Users with `Manage keypair` permission can view all certificates within the account.
Keypairs	Generate keypair	Create a new keypair.
Keypairs	View keypair	View keypairs and key rotations relying on keypairs assigned to them. Note Users with `Manage keypair` permission can view all keypairs and key rotations within the account.
Signatures	Sign	Sign software with keypairs assigned to them.
Releases	Request release	Request to create an offline release.
Releases	View release	View all releases in the account.
Threat detection	View Threat detection	View all threat detection scans in the account.

Exemple 6. Build engineer

The build engineer role is for users responsible for signing and scanning software using threat detection.

The following permissions assigned to this role:

Category	Permission	User can
User settings	Default	View their own user profile and generate their own API key and client authentication certificate in DigiCert ONE.
Audit logs	View audit log	View audit and signature logs in the account.
Certificates	View certificate profile	View certificate profiles created by the user.
	View certificate template	View certificate template details in the account.
	View certificate	View certificate details for all certificates assigned to them. Note Users with `Manage keypair` permission can view all certificates within the account.
Keypairs	View keypair	View keypairs and key rotations relying on keypairs assigned to them. Note Users with `Manage keypair` permission can view all keypairs and key rotations within the account.
Signatures	Sign	Sign software with keypairs assigned to them.
Releases	View release	View all releases in the account.
Threat detection	View Threat detection	View all threat detection scans in the account.
	Manage threat detection	Download threat detection reports and assign threat detection scans to projects.
	Run Threat detection scans	Scan software using Threat detection.

Exemple 7. Signer

The signer role is used for engineers or authenticated devices responsible for signing software.

The following permissions assigned to this role:

Category	Permission	User can
User settings	Default	View their own user profile and generate their own API key and client authentication certificate in DigiCert ONE.
Audit logs	View audit log	View audit and signature logs in the account.
Certificates	View certificate profile	View certificate profiles created by the user.
	View certificate template	View certificate template details in the account.
	View certificate	View certificate details for all certificates assigned to them. Note Users with `Manage keypair` permission can view all certificates within the account.
Keypair	View keypair	View keypairs and key rotations relying on keypairs assigned to them. Note Users with `Manage keypair` permission can view all keypairs and key rotations within the account.
Signatures	Sign	Sign software with keypairs assigned to them.
Releases	View release	View all releases in the account.

Add users

Based on the user types and user roles you have reviewed above, follow one of the procedures below to add a user to DigiCert ONE:

Create a team (optional)

Select users, groups, or both to form a team and then map relevant resources to them. You can restrict team resources such as keypairs, releases, and enforce keypair profiles and certificate profiles. If you do not see this option, enable teams.

To create a team:

Sign in to DigiCert ONE.
Navigate to the Manager menu icon (top-right) > Software Trust.
Select Account > Teams.
Select Create.

Astuce

For more detailed instructions, refer to Teams .

Create a keypair profile (optional)

Keypair profiles simplify keypair generation by preconfiguring values for all keypair options. If you do not see Keypair profiles in the left navigation menu, enable keypair profiles.

To create a keypair profile:

Sign in to DigiCert ONE.
Navigate to manager menu icon (top-right) > Software Trust.
Select Keypairs > Keypair profiles.
Select Create keypair profile.

Astuce

For more detailed instructions, refer to Keypair profiles.

Create a keypair

A keypair is required to create a certificate and sign. You have permission create keypairs, review the two keypair types supported by Software Trust Manager:

Exemple 10. Standard keypairs

A standard keypair refers to a public key and an associated private key. The public key encrypts data that can only be decrypted by its associated private key, thereby establishing an encrypted connection.

To create a standard keypair:

Sign in to DigiCert ONE.
Navigate to the manager menu icon (top-right) > Software Trust.
Note
Check the box next to Generate certificate to create a certificate at the same time as generating a keypair.
Select Keypairs > Create keypair.

Astuce

For more detailed instructions, refer to standard keypair.

Exemple 11. GPG keys

GPG keys are different from standard keypairs because each GPG key includes a master key and associated subkeys. We recommend that the master key only be used for creating subkeys and the subkeys be used for signing. In the event that a subkey is compromised, this will allow you to revoke and replace the affected subkey, while the master key and uncompromised subkeys remain secure.

Note

Use of GPG keys are generally enabled by Technical support. However, if DigiCert ONE is hosted in-house, the certificate template can be created by a system scope admin with the Manage account settings permission.

To create a GPG master key or subkey:

Sign in to DigiCert ONE.
Navigate to the manager menu icon (top-right) > Software Trust.
Select Keypairs > GPG keys.
Select Create master key or Create subkey.

Astuce

For more detailed instructions, refer to GPG keys.

Integrate your account with CertCentral (optional)

If you intend to use publicly trusted certificates, integrate your account with CertCentral. If you do not see an Integrations tab in the left navigation bar, contact your account manager to enable CertCentral integration.

Astuce

For more detailed instructions, refer to CertCentral integration.

Set up CertCentral integration

To set up CertCentral integration:

Sign in to DigiCert ONE.
Navigate to the Manager menu icon (top-right) > Software Trust.
In the left navigation bar, select Integration > CertCentral.
Link your CertCentral account by choosing one of the three options below:
1. Enter your CertCentral credentials.
2. Create a CertCentral account.
3. Connect using your CertCentral API key.

Note

If you choose to connect using your API key, follow the instructions below to generate an API key in CertCentral.

Generate an API key in CertCentral

Sign in to CertCentral.
In the left-hand side navigation bar, select Automation.
Navigate to: API Keys > Add API Key.

Complete the following fields:

Field	Description
Description	Provide an identifiable name for your CertCentral API key.
User	Select a user you want to link the CertCentral API key to. Note The user must have the Administrative role assigned to them in CertCentral.
API key restrictions	Select Orders, Domains, and Organizations.

Select Add API Key.

Note

The API key is only shown once, it cannot be accessed again. Securely store the API key to use it later.

Create a certificate profile

Certificate profiles simplify certificate generation by preconfiguring values for all certificate options.

To create a certificate profile:

Sign in to DigiCert ONE.
Navigate to: Manager menu icon (top right) > Software Trust.
Select Certificates > Certificate profiles.
Select Create certificate profile.

Astuce

For more detailed instructions, refer to Certificate profiles.

Create a certificate

A certificate is required to sign. You have permission generate certificates, you can generate public or private code signing certificates in Software Trust Manager.

To create a certificate:

Sign in to DigiCert ONE.
Navigate to the Manager menu icon (top right) > Software Trust.
Select Keypairs.
Hover over the keypair you want to use to create the certificate until the menu icon appears.
Select Generate certificate.

Astuce

For more detailed instructions, refer to Certificates.

Create a release (optional)

Releases protect keys by restricting their use to pre-approved dates and times. The pre-approved date and time selected for a release is referred to as a release window. Within a release window, organizations can control which keypairs can be used, who can use them, and the maximum number of signatures that can be used during the release.

To create a software release:

Sign in to DigiCert ONE.
Navigate to the manager menu icon (top-right) > Software Trust.
Select Releases.
Select Create release.

Astuce

For more detailed instructions, refer to Releases.

Manage threat detection (optional)

Software Trust Manager offers two types of threat detection. You can scan your software for malware, vulnerabilities, secrets, and more before releasing your software for consumption using our Dynamic Application Security Testing (DAST) service powered by ReversingLabs. You can also scan Developer ID-signed software for malicious components before distribution outside of the Mac App Store.

Astuce

If you do not see Threat detection in the left navigation menu, contact your account manager to add ReversingLabs integration to your service agreement. For more information about how to run a scan and interpret a scan report, refer to Threat detection.

Next steps

If you as the account lead also want to sign, follow the instructions in the Signer's guide to get ready to sign with your private key stored in Software Trust Manager.

The following articles may be useful to you while managing the account:

Dans cette section:

Lead guide

Add users to your account

User types

User roles

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Add users

Astuce

Astuce

Create a team (optional)

Astuce

Create a keypair profile (optional)

Astuce

Create a keypair

Note

Astuce

Note

Astuce

Integrate your account with CertCentral (optional)

Astuce

Set up CertCentral integration

Note

Generate an API key in CertCentral

Note

Note

Create a certificate profile

Astuce

Create a certificate

Astuce

Create a release (optional)

Astuce

Manage threat detection (optional)

Astuce

Next steps

Résultats de la recherche