DigiCert requires two-factor authentication (2FA) for all DigiCert® KeyLocker users. This requirement applies not only to signing activities, but also to DigiCert® ONE-based actions, such as keypair and certificate generation.
This requirement ensures compliance with CA/B Browser Forum rules for public code signing and mitigates overall security risks.
To successfully authenticate, two-factor authentication (2FA) must be enabled on your DigiCert® ONE login account.
For DigiCert® ONE logins, users will authenticate with a password and a one-time password (OTP) code generated by the Google Authenticator app.
Users with admin privileges in DigiCert® ONE can enable the 2FA requirement.
DigiCert® KeyLocker utilizes a client certificate and an API key to authenticate with DigiCert during signing.
The API key acts as the first factor of authentication and the client authentication certificate acts as the second when connecting to DigiCert® KeyLocker client tools.
The permissions associated with the API token and client authentication certificate are based upon your user role set in DigiCert® KeyLocker.
An API key is a unique identifier generated by the server to authenticate a user or calling program to an API.
Follow the procedure below based on your user classification:
A client authentication certificate is a X.509 digital certificate with a unique password that is generated by the server to authenticate a user or calling program to an API.
When you are setting up your environment variable, you must provide the DigiCert ONE host value.
The DigiCert ONE host value refers to the specific environment URL for connecting your client tools to perform an operation, such as software signing.
The value is a designated endpoint that corresponds to your operational region and environment (production or demo).
For example, if you are operating a production environment in the United States, then the value for
SM_HOST
would behttps://clientauth.one.digicert.com/
.As another example, if you are operating a demo environment in the Netherlands, then the value for
SM_HOST
would behttps://clientauth.demo.one.nl.digicert.com
.
These host values are essential for configuring your environment variables correctly, ensuring secure and accurate connections between your client tools and DigiCert ONE services.
Nota
You can only connect to the host that was used to create your credentials.
Country | Host type | SM_HOST value |
---|---|---|
United States of America (USA) | ||
Production | https://clientauth.one.digicert.com | |
Netherlands (NL) | ||
Production | https://clientauth.one.nl.digicert.com |
DigiCert® KeyLocker enables you to sign either directly with third-party signing tools or via DigiCert signing tools. Regardless of the method you choose, you will require a cryptographic library to ensure that your private key remains protected while allowing you to create digital signatures.
To download client tools:
Sign in to DigiCert ONE.
Select the Manager meu (top-right) > DigiCert® KeyLocker.
Navigate to: Resources > Client tool repository.
Download the appropriate files, move them to the appropriate client computer, and extract (or install).
The following client tools are available:
Operating systems use the environment variable called PATH to determine where executable files are stored on your system. Use the PATH environment variable to store the file path to your signing tools to ensure that the CLI can reference these signing tools.
Nota
Client tools must be available in the PATH variable for the environment to invoke the client control from CI/CD integration without specifying the path. For the examples given, it is assumed that the path to the client control tools has been set in the path.
Your DigiCert ONE host environment, API key, client authentication certificate, and password make up your environment variables and are required to access DigiCert® KeyLocker client tools. Use one of the methods provided below to securely store your credentials based on your operating system.