Certificate Authority Connections

SSLNexus is designed to work across certificate authorities rather than locking certificate operations to one vendor. Configure only the connectors your organisation needs.

Connect A Certificate Authority

1. Open Deployment targets and create or edit the target that will own the certificate.
2. Select the CA adapter for that target.
3. Enter the account details and credentials requested by the selected adapter.
4. Save the target and run Test CA. Run Test connection separately for the server/appliance management path.

Multiple CAs

Where your licence permits it, configure more than one CA and choose the required provider when creating or renewing certificate work. This allows different teams, domains or certificate types to remain with the vendors that fit them best.

Connector Health

The configured-targets view shows the CA adapter and CA health independently from management-channel health. Test CA runs a non-mutating provider check. Where the provider exposes a safe authentication/account endpoint SSLNexus validates the credential directly. Where it does not, SSLNexus reports reachability separately from credential verification instead of treating a network response as proof of authentication.

Editing a target keeps its existing encrypted CA secret when the credential field is left blank and the adapter is unchanged. Changing adapters requires credentials appropriate to the new authority.

Credential Handling

Use a dedicated API or automation credential where your CA offers one. Grant only the certificate-management permissions SSLNexus requires, rotate credentials according to your organisation's policy and update the connector when credentials change.

Vendor-Neutral Operation

A CA connector is an integration point, not a product dependency. SSLNexus can operate with the supported CA connections configured for your organisation, and the connector model is intended to accommodate additional CAs without changing the way operators manage certificates.

Let’s Encrypt

SSLNexus includes a native Let’s Encrypt ACME v2 adapter. When creating or editing a deployment target, select Let's Encrypt as its CA adapter, enter the account email and choose the required production or staging ACME directory.

The current adapter uses HTTP-01 validation. For managed remote targets, SSLNexus can originate the private key, CSR and ACME transaction on the target server that actually receives traffic, then retrieve the issued material into central lifecycle management. The built-in /.well-known/acme-challenge/ path remains available where validation is intentionally served by the SSLNexus host itself. Wildcard certificates require DNS-01 and are not available through this HTTP-01 implementation yet.

Protect The SSLNexus UI

The same adapter can issue the certificate used by the SSLNexus administration interface:

sudo ssl-nexus-admin ui-cert --domain nexus.example.org --email [email protected]

Use --staging first when validating DNS, NAT or firewall reachability. SSLNexus installs the certificate only after ACME issuance succeeds, validates the Nginx configuration, and then reloads Nginx.

Certificate Revocation

SSLNexus uses provider-native revocation where the configured CA exposes a supported operation. Sectigo, DigiCert and Let’s Encrypt support revocation in this release. Revocation is permanent: SSLNexus only marks a certificate revoked after the CA confirms the request, then disables its automatic renewal schedule and records the action in Activity & audit.

DigiCert uses the single-certificate revoke endpoint with the certificate identifier retained at issuance, so revoking one managed certificate does not intentionally revoke every certificate on the order. Sectigo uses the certificate ID returned at issuance. Let’s Encrypt uses the ACME revokeCert operation.