Deploying Certificates from Certify Management Hub

Question
1

Good morning,

I am evaluating the Certify Management Hub and want to see if I can accomplish this workflow. I have multiple instances servers to the management hub, one Window server with Certify the Web installed, and one Linux server with the Certify the Web agent installed. I want to generate the certificates on the management hub, which I have currently done with a staging test using let’s encrypt with the dns-persist-01 challenge. How can I deploy the certificates to the servers registered with management hub? I haven’t really figured that part out.

Thanks,

Adam Brousseau

2

It sounds like Certificate Subscriptions would meet your requirements, where the hub renews the cert and the instances pull that cert to deploy it:

You can of course manage your certs in lots of ways:

  • Have each instance be in charge of it’s own renewals, with an ACME account on the local instance, renewing it’s own certs either via http or DNS domain validation, the hub is just acting as an admin UI.

  • Same as above but use the hub Managed Challenges option to centralize DNS challenges. The hub performs the DNS validation steps on behalf of the instance.

  • Hub Managed ACME - use any ACME client on any server but point it to the hub acme api, which in turn performs the order using managed (dns) challenges and the acme finalize step uses the CSR from the original acme client. So the original acme client keeps it’s own local private key etc. This does rely on a quirk of the ACME protocol (authorizations always appear already valid to the ACME client, finalize step is allowed to take time to complete while the hub completes challenges).

  • Use Certificate Subscriptions, where the hub renews the cert for itself, but CCM/Agent instances can pull and deploy.

  • Use the hub to renew certs, and use the hub api to download the cert to authorized clients on your network. This is like a more free-form version of certificate subscriptions.

  • Use the hub to renew certs, deploy to a secrets vault (Azure Keyvault etc), pull from the secrets vault periodically on your target servers.