Set Up Certificate Authority Connectors

Choose the connector and save the target

1. Open Deployment targets and create or edit the intended target. Select the Certificate authority adapter.
2. Use the connector section below to obtain the exact account credentials and provider settings. Keep credential values out of ticket messages and documentation.
3. Save the target, run Test connection for the destination, then Test CA for its authority configuration. These test different connections.
4. Request a controlled certificate for an approved hostname and review issuance, deployment and verification separately.

See connector health and target testing.

Let’s Encrypt

1. No CA API key or portal password is needed. Enter an operational Account email and choose Production or Staging.
2. SSLNexus creates and keeps the ACME account key locally. Its existing HTTP-01 workflow performs validation and automated renewal.

This connector uses HTTP-01: public DNS and inbound TCP 80 must reach the challenge server. Linux Nginx/Apache targets use the existing remote HTTP-01 flow; other supported flows serve validation from SSLNexus. Wildcard issuance needs DNS-01 and is not supported by this HTTP-01 connector.

Google Trust Services · free Public CA certificates

1. Open Google Cloud Console → Cloud Shell and select your project. Your user needs Public CA External Account Key Creator; enabling the API also needs Service Usage permissions.
2. Run the setup commands below. Paste keyId into EAB key ID and b64MacKey into EAB MAC key, unchanged. Enter your operational Account email.
3. Save the target, then request its certificate through SSLNexus. Use a new EAB pair for each target/account and register within seven days. SSLNexus retains the account key for subsequent operations.

gcloud config set project YOUR_PROJECT_ID
gcloud services enable publicca.googleapis.com
gcloud publicca external-account-keys create

Google charges no certificate issuance fee. SSLNexus licence requirements still apply. Certificates are short-lived; SSLNexus uses their returned expiry to schedule renewal. This connector uses HTTP-01 and cannot issue wildcards. Keep the Google project and SSLNexus account key: deleting either can prevent renewal.

DigiCert CertCentral API

1. In CertCentral, open Automation → API Keys. Create an API key for an authorised user or service user and copy it when displayed.
2. Choose a permitted certificate product and division. Use the product ID and container/division ID from your CertCentral account or its product/container API responses.

An ACME EAB key is not a CertCentral REST API key. A view-only API key cannot issue certificates. Use the actual product, validity and validation settings allowed by your contract.

DigiCert ACME

1. In CertCentral, open Automation → ACME Directory URLs (or the ACME credentials page for your subscription). Create credentials for the intended certificate profile.
2. Copy the assigned directory URL, EAB KID and HMAC key into the corresponding SSLNexus fields. Use the URL for your account’s region; do not assume the example URL applies.

These are ACME credentials, not the CertCentral REST API key. SSLNexus handles HTTP-01 validation and renewal; the selected profile must permit the requested names.

Sectigo SCM Enterprise

1. For Enrollment REST, open SCM → Enrollment → REST, select the SSL Certificates endpoint and open Accounts. Create an account for the correct organisation, profile and term; copy its Client ID and Client Secret.
2. Copy the endpoint URL shown by your SCM instance, including your region and tenant. Obtain the OAuth token endpoint for that REST account. SSLNexus requests short-lived tokens itself; enter the client secret, not an access token.

SCM Enterprise Enrollment and Admin REST v2 have different URLs and credentials. Use the interface enabled for your account. If REST access is absent, ask your SCM administrator or Sectigo account manager. External requester identifies the certificate requester, usually an email address approved by your SCM administrator; it is not a password or file path.

For Admin REST v2, select that interface and its authentication method. Supply the Admin REST base URL, customer URI, organisation and profile details from your SCM administrator. OAuth uses the registered client and authentication endpoint; password authentication uses the authorised administrator account; certificate authentication uses the registered authentication certificate and its matching key. Enrollment REST credentials are not interchangeable with Admin REST credentials.

GoDaddy certificate API

1. Sign in to GoDaddy’s Classic Developer Keys page and create or obtain a key/secret pair authorised for the Certificates API. Choose Production for live certificates.
2. Paste the key into API key and its paired secret into API secret. Populate the purchased certificate product and contact details in Provider settings.

This SSLNexus connector uses the existing sso-key certificate API. Do not paste a newer Domains API personal access token here. Confirm your account has certificate API access.

The SSL Store

1. Sign in to your reseller account and open API Token Generation. Obtain the PartnerCode and AuthToken for the intended Live or Sandbox environment.
2. Paste AuthToken into Auth token. Put PartnerCode in partner_code and select an available product_code from your reseller product catalogue.

Do not mix live and sandbox credentials. Use the required applicant contact and approval settings from the product you selected.

Custom ACME

1. Ask the CA administrator for its ACME v2 directory URL and whether External Account Binding is required.
2. Enter a Provider name and Account email. If EAB is required, enter the issued KID and its matching HMAC secret. For SCM Pro, use only ACME credentials supplied by that plan.

This connector uses HTTP-01. The CA must support that challenge and the requested certificate names. A REST API token cannot substitute for an EAB MAC key.

HashiCorp Vault PKI

1. Ask your Vault administrator for the Vault HTTPS address, PKI mount, signing role and namespace if applicable.
2. Obtain a Vault token with permission to sign CSRs through that role. Paste it into Vault token and set a TTL within the role’s policy.

The role must permit the requested names. The certificate private key stays in SSLNexus/customer infrastructure. Keep the token renewable or replace it before expiry.

Microsoft AD CS

1. Ask your Windows PKI administrator for the published CES HTTPS UsernamePassword endpoint, CA identity and certificate template’s internal name.
2. Use a dedicated enrollment account allowed to enroll in that template. Obtain the approved issuing CA chain and, if necessary, the CES HTTPS trust chain as PEM from your PKI administrator.

This connector uses CES HTTPS with UsernameToken, not WinRM. Template policy controls EKUs, validity and allowed SANs. Pending approvals keep the original request ID.

Customer SSLNexus channel

1. Pair the customer under MSP HUB and complete customer policy configuration. Use an active channel assigned to the selected customer estate.
2. Copy Channel ID and the approved CA Profile ID from MSP HUB. CA credentials are configured by the customer on their Relay or SSLNexus installation.

Do not enter the customer’s CA password here. Customer policy and MSP entitlement control requests. Relay provides issuance only; customer-site provisioning requires the licensed Nexus-to-Nexus lifecycle.

Generic REST provider

1. Obtain the HTTPS request, status and download endpoints and response-field mappings from the CA’s API administrator.
2. Request an API credential scoped to certificate issuance. Enter it in API credential; configure its header name and non-secret static fields in Provider settings.

Keep credentials out of Provider settings JSON. This connector needs the documented CSR and pending-request API contract; an arbitrary webhook is insufficient.