DigiCert ONE PKI

Prerequisites

  • The DigiCert ONE certificate profile identifier (UUID).

  • A DigiCert ONE service user with access to Trust Lifecycle is required. The connector authenticates with its API key. See DigiCert ONE authentication.

    • On DigiCert ONE certificate profile, it needs the following Trust Lifecycle permissions:

      • CREATE_EM_CERTIFICATE to enroll certificates.

      • RENEW_EM_CERTIFICATE to renew certificates.

      • REVOKE_EM_CERTIFICATE to revoke certificates.

      • MANAGE_EM_SEAT to create seats, only with a dynamic seat.

  • Seat:

    • Static seat: the seat must already exist in DigiCert ONE. Fetch its technical id (UUID).

    • Dynamic seat: fetch the technical id (UUID) of the business unit in which the seats are created.

  • Identify the DigiCert ONE base URL matching the target environment. The available base URLs are listed here.

Limitations

  • Only the following subject elements are sent to DigiCert ONE: CN, O, OU, L, ST, C and E.

  • Only the following SAN types are sent to DigiCert ONE: DNS names, IP addresses, emails (RFC822), URIs, UPNs and registered IDs.

Create the PKI connector

1. Log in to Horizon Administration Interface.

2. Access PKI from the drawer or card: PKI  PKI Connectors.

3. Click on Add icon.

4. Select the correct PKI type.

5. Click on the next button

General tab

6. Fill in the common mandatory fields:

  • Connector Name* (string input):
    Choose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.

  • Proxy (string select):
    If the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.

  • PKI Queue (string select):
    The PKI Queue used to manage the PKI Requests (enrollment, revocation).

  • Timeout (finite duration):
    Represents a predefined interval of time without a PKI response, when the time has passed "Horizon" will cease trying to establish the communication. Must be a valid finite duration.

7. Click on the next button

Details tab

8. Fill in all mandatory fields:

  • DigiCert ONE API baseUrl* (string input):
    Base URL of the DigiCert ONE API. Example: https://one.digicert.com/

  • Profile ID* (string input):
    Identifier (UUID) of the DigiCert ONE certificate profile used to issue certificates.

  • Interval before retrying to retrieve certificate* (finite duration):
    Interval at which pending requests are polled during the enrollment process. See Asynchronous certificate lifecycle.

  • Validity (finite duration):
    Overrides the validity of the certificates issued through this connector. When not set, the validity defined by the DigiCert ONE certificate profile is used. The profile must allow overriding its default validity. The value is sent to DigiCert ONE in minutes, so any precision below the minute is truncated.

  • Seat mode* (select):
    Every DigiCert ONE enrollment references a seat, the licensed identity (server, device, user) a certificate is issued for. Select one of the following modes:

    • Static: all certificates are enrolled on a single existing seat. This is the recommended mode.

      • Seat ID* (string input):
        Technical identifier (UUID) of the existing DigiCert ONE seat. Example: 3f8c2a1e-7b4d-4e9a-9c6f-1d2e5a8b0c47

    • Dynamic: the connector creates a seat for each certificate, named after the requested common name, and reuses it if it already exists.

      • Business unit ID* (string input):
        Technical identifier (UUID) of the DigiCert ONE business unit in which the seats are created. It must be the business unit the certificate profile belongs to, otherwise enrollment and revocation fail. Example: 3f8c2a1e-7b4d-4e9a-9c6f-1d2e5a8b0c47

      • Seat type* (select):
        Type of the created seats: USER_SEAT, DEVICE_SEAT, CERTIFICATE_MANAGEMENT_SEAT, ORGANIZATION_SEAT or SERVER_SEAT.

9. Click on the next button.

Authentication tab

10. Fill in the PKI-authentication fields:

  • DigiCert ONE API Key* (select):
    Select API Token credentials containing the API key of the DigiCert ONE service user.

11. Click on the save button.

You can edit Edit PKI, duplicate Duplicate PKI or delete Delete PKI the DigiCert ONE PKI connector.