Integration with ZeroSSL

Key Manager Plus facilitates integration with ZeroSSL — the certificate authority (CA) that uses the Automatic Certificate Management Environment (ACME) protocol to provide secure SSL certificates free of cost. This integration helps you achieve an end-to-end life cycle management of ZeroSSL certificates installed on your domains from a single interface. This document discusses the steps you should follow to establish  a connection with your ZeroSSL account, acquire, deploy, renew and perform all certificate management related operations from Key Manager Plus.

Before you proceed with the integration, complete the following step as a prerequisite:

Follow the step-by-step procedure below to integrate ZeroSSL with Key Manager Plus:

1. Create a ZeroSSL Account
2. Raise a Certificate Request
3. ZeroSSL Challenge Verification
4. Procure and Save the Certificate
5. Renew Certificates
6. Revoke Certificates
7. Delete Certificates

1. Create a ZeroSSL Account

To begin the process of requesting SSL certificates from ZeroSSL, you must create an account. This is a one-time process and can be done directly from the Key Manager Plus interface.

1. To create a ZeroSSL account, Navigate to Integrations >> ACME Integrations >> ZeroSSL.
2. Click Manage. Under the Account tab, click New Registration.
3. In the pop-up, enter an account name and a valid e-mail address. Enter your EAB KID and EAB HMAC Key. Click here to generate EAB KID and HMAC Key for your account, if you don't have one already.
4. Click the checkbox to accept the ZeroSSL Subscriber Agreement.
5. Click Register. Now, an account with ZeroSSL is created.

Once your account is created, you can update the account email address, delete it from Key Manager Plus, or deactivate the account entirely. Please note that deleting the account only removes it from Key Manager Plus. Even if you delete the account here, it will still be active in the ZeroSSL portal. To add the same account back to Key Manager Plus, export the key and use the Add Account option with the same details used before. However, if you select the Deactivate option while deleting the account, then the ZeroSSL account will be removed completely and you cannot add it back to Key Manager Plus with the same details.

2. Raise a Certificate Request

Once your ZeroSSL account is registered, you can proceed with raising certificate requests to the CA. To complete a certificate request, you will be presented with a challenge verification to fulfill in order to validate your domain and issue the certificate you have requested.

1. Navigate to Integrations >> ACME Integrations >> ZeroSSL.
2. Click Certificate Request. Fill in the domain name, select the challenge type, choose the key algorithm, algorithm length, signature algorithm, keystore type, enter the keystore password and click Create.
3. For dns-01 challenge type, you can choose and assign a DNS account from the drop-down if you have already configured your DNS credentials. This will be used for automatic challenge verification for all the domains specified in the request.
4. Also, you have options to change the private key whenever the certificate is renewed. 
   1. If you need to change the key, use New Key. This option will generate a new key every time the certificate is renewed.
   2. If you want to retain the same key on renewal, use the Same Key option.
   3. To use your own key, use the Import Key option. This key will be used for the first time when the certificate is generated and also for subsequent renewals.

To configure your DNS account, follow the below steps:

1. Navigate to ZeroSSL >> Manage. Switch to the DNS tab.
2. Here, you can add a maximum of one DNS account for each DNS provider supported. Key Manager Plus currently supports automatic challenge verification for Azure DNS, CloudFlare DNS, and Amazon Route 53 DNS, RFC2136 DNS update (nsupdate), GoDaddy DNS, and ClouDNS. Click Add.
3. In the pop-up that opens, choose the DNS provider.

2.1 Azure DNS

1. Provide the Subscription ID, which is available in the Overview page of the Azure DNS zone.
2. Provide the Directory ID, which is available in Azure Active Directory >> Properties.
3. If you have an already existing Azure application, provide its Application ID and Key.
4. If not, follow the steps mentioned in this document to create the Azure application and key, and give the application access to the DNS zones for making API calls.
5. Finally, enter the Resource Group Name, which is the group name in which you have created the DNS zone and click Save.
6. Your DNS account details are saved and listed under Manage >> DNS.

2.2 Cloudflare DNS

1. In the Email Address field, specify the email address associated with the Cloudflare account.
2. For Global API Key, use the Generate API key option in the domain overview page of the Cloudflare DNS to generate the key and paste the value in this field. Click Save.
3. Your DNS account details are saved and listed under Manage >> DNS.

2.3 AWS Route 53 DNS

Generate and specify the Access Key ID and Secret associated with your AWS account. If you do not have an AWS account, create one and generate the Access Key ID and Secret by following the steps given below:

1. Login to the AWS console and navigate to IAM Services >> Users. Click Add user.
2. Provide the user name and select the access type as Programmatic access.
3. Switch to the next tab, click Attach existing policies directly under Set Permissions and search for "AmazonRoute53FullAccess".
4. Assign the policy that is listed and switch to the next tab. In the tags section, add appropriate tags (optional) and switch to the next tab.
5. Review all the information entered and click Create user.
6. The user account is created and subsequently, an access key ID and a secret is generated. Copy and save the key ID and secret in a secure location for it will not be displayed again.
7. If you already have an AWS user account, you have to grant "AmazonRoute53FullAccess" permission to the user and generate the access key if the user doesn't have one. if the user account has an access key associated already, it is just enough to ensure the required permission is granted.

To grant the required permissions:

1. Navigate to the Permissions tab, select the required user account and click Add Permission.
2. Click Attach existing policies directly under Set Permissions and search for "AmazonRoute53FullAccess".
3. Assign the listed policy and hit Save.
4. To generate the access key,
5. Select the particular user account and navigate to the Security Credentials tab.
6. In the window that opens, click Create access key.
7. An access key ID and a secret is generated. Copy and save the key ID and secret in a secure location as it will not be displayed again.

2.4 RFC2136 DNS Update

If you are using open source DNS servers such as Bind, PowerDNS etc., that support RFC2136 DNS update, follow the steps below to automate DNS-based domain control validation procedure using Key Manager Plus.

1. Mention the DNS Server IP / Hostname represents the server name / IP address in which the DNS server is installed or running.
2. These details are usually found in the server installation directory. For instance, in the case of Bind9 DNS server, you can find these in the file named.local.conf in the server installation directory.
3. Provide the Key Secret, which is nothing but the key content found in the server installation directory.
4. Provide a name for the key in the Key Name field, and choose the signature algorithm.
5. Click Save.

2.5 GoDaddy DNS

If you are using GoDaddy DNS for DNS validation, follow the steps below to automate DNS-based domain control validation procedure using Key Manager Plus:

Steps to Obtain GoDaddy API Credentials:

1. Go to the GoDaddy developer portal and switch to the API keys tab.
2. Log in to your GoDaddy account if you aren't logged in already.
3. Once you log in, you will be redirected to the API keys page where you can create and manage API keys.
4. Click Create New API key.
5. Provide your application name, choose the environment type as Production and click Next.
6. The API key and its secret is generated. Copy and save the secret in a secure location, as it will not be displayed again.

Now, in Key Manager Plus interface, follow the below steps to add GoDaddy DNS to ZeroSSL CA:

1. Navigate to Integrations >> ACME Integrations >> ZeroSSL and click Manage from the right most corner.
2. Switch to the DNS tab and click Add. Choose GoDaddy from the DNS Provider drop-down.
3. Enter the Key and Secret that was previously generated from the GoDaddy portal.
4. Click Save.

2.6 ClouDNS

If you are using ClouDNS for DNS validation, follow the steps below to automate the DNS-based domain control validation procedure using Key Manager Plus:
Steps to Obtain ClouDNS API Credentials:

1. Login to your ClouDNS account and go to Reseller API.
2. If you have already created an API user id, you will find it under API Users. If not, click Create API to generate a new one.
3. Click here to learn more about ClouDNS API Auth IDs.

Now, in the Key Manager Plus interface, follow the below steps to add ClouDNS to ZeroSSL CA:

1. Navigate to SSL >> Acme >> ZeroSSL and click Manage from the right most corner.
2. Switch to the DNS tab and click Add.
3. Choose ClouDNS from the DNS Provider drop-down.
4. Choose one of the following options: Auth ID, Sub Auth ID, Sub Auth User.
5. Enter the chosen ClouDNS Auth ID, its respective Auth Password, and click Save.

2.7 DNS Made Easy

1. Enter the name of your choice in the Name field.
2. The Key and the Secret will be available in the DNS Made Easy webpage under Config >> Account Information. Enter those details in the respective fields.
3. Now, click Save to save your DNS account details. The saved DNS details will be listed under Manage >>DNS.
   

3. ZeroSSL Challenge Verification

Key Manager Plus expedites domain validation through automatic verification of HTTP-01 and DNS-01 challenges (currently Azure, Cloudflare, Amazon Route 53, RFC2136 DNS update, GoDaddy DNS, ClouDNS). For the automation to take effect, you have to initially map the end-server details to Key Manager Plus, which is a one-time process.

3.1 Domain Validation through HTTP-01 Challenge Verification

For domain validation through http-01 challenge,

1. A window opens displaying the challenge to be fulfilled.
2. Click the Agent mapping icon.
3. A pop up will open. If the domain server is a Linux machine, fill in the required details and click Save.

If the domain server is a Windows machine, download and install the Key Manager Plus agent for Windows server using the steps mentioned below:

1. Downloading Key Manager Plus agent for Windows servers:
2. The Key Manager Plus agent package is a zip file comprising of the necessary executables, configuration files required for automatic verification of ZeroSSL challenges through automatic domain validation. Unzip the folder and install the agent on your Windows domain server after download. To download the agent,
3. Navigate to Integrations >> ACME Integrations >> ZeroSSL tab, and click Manage button in the top right corner.
4. Switch to the Windows agents tab.
5. Download the Key Manager Plus agent from the top right corner of the window based on your server compatibility (32 bit or 64 bit).

Installing Key Manager Plus agents for Windows server:

1. Open the command prompt and navigate to the Key Manager Plus installation directory.
2. Execute the command 'AgentInstaller.exe start.'

To stop the agent and uninstall the Windows service,

1. Open the command prompt and navigate to the Key Manager Plus installation directory..
2. Execute the command 'AgentInstaller.exe stop.'
3. If the domain server is a Windows machine, download and install the Windows agent on the domain server. Navigate to Manage >> Windows Agents, download and install the agent on the domain server.
4. Once, the above agent mapping settings are configured (agent mapping is a one-time configuration), Key Manager Plus automatically handles the verification of challenges presented by ZeroSSL.

After configuring agent mapping, click Pending on the pending requests and click Verify. The challenge is verified and certificate request is submitted to ZeroSSL CA.

3.2 Domain Validation through DNS-01 Challenge Verification

For DNS-01 challenge verification from Key Manager Plus,

1. Go to the ZeroSSL window and click on the request status (Pending) corresponding to the certificate request.
2. You'll be directed to a window that displays the DNS challenge value and TXT record.
3. If you have already configured your DNS account details and have opted for DNS while creating the certificate request, you can assign the DNS account to the request.
4. Select the request, choose Assign DNS from More top menu and select the required DNS account.
5. In cases where you do not have a DNS account configured or have not opted for it when raising the certificate request, Key Manager Plus provides an option for automating DNS-01 challenge verification through Agent Mapping.
6. Click on the Agent Mapping icon available to the left side of the request. Agent mapping is a one-time configuration.

Agent Mapping

1. In the Deploy window that opens, carry out the following operations to map and save your end-server details in Key Manager Plus.
2. Choose your DNS provider. For Azure DNS, provide the required details—subscription ID, directory ID, application ID, application key and resource group name.
3. For Cloudflare DNS, enter the email address associated with your Cloudflare account and the Global API key.
4. For Amazon Route 53 DNS, enter the Access Key ID and Secret associated with your AWS account.
5. Enable the Deploy Certificate check-box to automate deployment of the certificate to their corresponding end-servers after domain validation and after successive renewals.
6. For Linux end-servers provide the required details, while for Windows end-servers download and install the Windows agent using the same procedure as mentioned for http-01 challenge.
7. After filling in the details, click Save. The end-server details are successfully mapped and stored in Key Manager Plus, which you can view or edit from Manage >> Deploy tab.

 

4. Procure and Save the Certificate

On successful verification, ZeroSSL issues the requested certificate.

1. The window automatically redirects to a page which displays the certificate and its status (status is marked Available, if the challenge verification is successful and Failed if the challenge verification fails).
2. Click the Available button to save the certificate in Key Manager Plus repository, e-mail or export it.
3. If the challenge fails, click New challenge to obtain another set of challenges and repeat the above process.
4. On saving, the certificate gets added to the Key Manager Plus repository which can be viewed from the SSL >> Certificates tab.

5. Renew Certificates

Certificates issued by ZeroSSL have a life-time of 90 days after which they are not valid.
Certificate renewals can be carried out manually or automatically through automatic domain validation. To renew a certificate manually,

1. Navigate to Integrations >> ACME Integrations >> ZeroSSL.
2. Select the certificate that you want to renew and click Renew Certificate button.
3. The certificate is renewed and the Certificate Status bar displays Renewed.
4. Click on it to save the renewed version of the certificate to KMP certificate repository.

Automatic Renewals through Automatic Domain Validation

If agent mapping had been configured, the certificate renewal process is done automatically without manual intervention. All the certificates in your organization procured from ZeroSSL is automatically renewed 15 days before its expiry and a notification is sent to the account holder's e-mail address.

6. Revoke Certificates

Revoking a certificate renders the certificate invalid and immediately removes the HTTPS from the website.
To revoke a certificate,

1. Navigate to Integrations >> ACME Integrations >> ZeroSSL tab.
2. Select a certificate you want to revoke and click Revoke Certificate.
3. The certificate is revoked and is no longer valid.

7. Delete Certificates

Deleting a certificate removes the certificate from Key Manager Plus repository, but the certificate still remains valid.
To delete a certificate,

1. Navigate to SSL >> Acme >> ZeroSSL tab.
2. Select the certificate you want to delete and click More >> Delete.
3. The certificate is deleted from the KMP database.