Requirements
Two-factor authentication (2FA)
2FA is required when signing with a key stored in Software Trust Manager.
To enable 2FA:
Sign in to DigiCert ONE.
Navigate to the Manager menu icon (top right) > Accounts.
Select the Name of the account.
On the Account details page, navigate to the Sign-in settings for all-account-access users section.
Select the pencil icon next to Two-factor authentication.
Select the radio button next to Enable two-factor authentication.
Select Update two-factor authentication.
API key
An API key is a unique identifier generated by the server to authenticate a user or calling program to an API. The API key acts as the first factor of authentication when connecting to DigiCert® KeyLocker client tools.
Nota
The permissions for the API token are based upon your user role set in DigiCert® KeyLocker.
To create an API key:
Sign in to DigiCert ONE.
Click Profile icon (top-right).
Select Admin Profile.
Identify the On this page section (right), select API tokens.
Select Create API token.
Client authentication certificate
A client authentication certificate is a X.509 digital certificate with a unique password that is generated by the server to authenticate a user or calling program to an API. The client authentication certificate acts as the second factor of authentication when connecting to DigiCert® KeyLocker client tools .
Nota
The permissions for the client authentication certificate are based upon your user role set in DigiCert® KeyLocker.
To generate a client certificate:
Sign in to DigiCert ONE.
Click Profile icon (top-right).
Select Admin Profile.
Identify the On this page section (right), select Authentication Certificates.
Select Create authentication certificate.
Nota
The client certificate password is only shown once after creating the client certificate, it cannot be accessed again. Copy and paste the password directly into this field. Securely store the passcode if you will require it later.
Host environment
During environment variable setup, you are required to provide the DigiCert ONE host value.
Nota
You can only connect to the host that was used to create your credentials.
Country | Host type | SM_HOST value |
|---|---|---|
United States of America (USA) | ||
Production | https://clientauth.one.digicert.com | |
Netherlands (NL) | ||
Production | https://clientauth.one.nl.digicert.com |
Client tools
To download client tools:
Sign in to DigiCert ONE.
Select the Manager meu (top-right) > DigiCert® KeyLocker.
Navigate to: Resources > Client tool repository.
Download the appropriate files, move them to the appropriate client computer, and extract (or install).
The following client tools are available:
Set PATH environment variables
Operating systems use the environment variable called PATH to determine where executable files are stored on your system. Use the PATH environment variable to store the file path to your signing tools to ensure that the CLI can reference these signing tools.
Nota
Client tools must be available in the PATH variable for the environment to invoke the client control from CI/CD integration without specifying the path. For the examples given, it is assumed that the path to the client control tools has been set in the path.
Secure your credentials
Your DigiCert ONE host environment, API key, client authentication certificate and password makes up your environment variables and are required to access DigiCert® KeyLocker client tools. Use one of the methods provided below to securely store your credentials based on your operating system.