ACME 自動化サービスのアーキテクチャ
ACME service components
DigiCert® Trust Lifecycle Manager の ACME 自動化サービスには、以下の基本コンポーネントがあります。
Component | Description |
|---|---|
ACME client | You need an ACME client installed on each of your systems. |
Certificate profiles | In Trust Lifecycle Manager, you need one or more certificate profiles that your ACME clients can use to request certificates. Certificate profiles supply the required ACME credentials and set the properties of issued certificates. |
Certificate authority (CA) | You need one or more CAs that can issue certificates for your organization/domains. You can use an issuing CA in DigiCert® Private CA or an external issuing CA linked to your Trust Lifecycle Manager account via a CA connector. |
ACME external account binding (EAB)
ACME EAB credentials
The ACME protocol (RFC 8555) defines an external account binding (EAB) field that ACME clients can use to access a specific account on the certificate authority (CA). DigiCert®'s ACME implementation uses the EAB field to identify both your DigiCert® Trust Lifecycle Manager account and a specific certificate profile there.
Your ACME client must send the following EAB credentials to request certificates:
Key identifier (KID): Identifies your DigiCert ONE account and the automation profile for certificate issuance.
HMAC key: Authenticates the ACME client during account creation on the DigiCert ACME service, proving that the client is authorized to use the selected certificate profile.
ACME automation profiles
In Trust Lifecycle Manager, you create ACME-based certificate profiles to get the required ACME EAB credentials and define the types of certificates that can be issued via ACME.
DigiCert provides base templates to facilitate the creation of profiles. To create an ACME-based certificate profile, you select an available base template and then add your unique business and certificate requirements, selecting 3rd-party ACME client as the certificate enrollment method.
Each ACME-based certificate profile has unique ACME external account binding (EAB) credentials associated with it. Your ACME clients use these credentials to request new certificates from that profile.
ACME-based certificate requests
サーバーで新しい証明書が必要な場合は、ローカル ACME クライアントを使用して要求を開始します。残りのプロセスは以下のように自動化されます。
Trust Lifecycle Manager が要求を認証して処理します。
関連するパブリックまたはプライベート認証局（CA）が証明書を発行します。
ACME クライアントが証明書をサーバーにダウンロードしてインストールします。
 |