Request certificates using ACME automated DNS challenge flow
Request a new certificate and automatically retrieve the certificates for an application using an Automated Certificate Management Environment (ACME) automated flow of DNS challenge.
Before you begin
Ensure that a credential has been set up.
Note: The GoDaddy credential is provided with the base system inside the credential page.
The Certificate Management catalog has been enabled.
A routing policy with a DNS challenge action exists.
Role required: Certificate requester, PKI admin, PKI user, flow_designer, action_designer, or admin
Note:
A certificate requester is a user who doesn’t have the PKI admin or PKI user role.
Procedure
Access the automated flow.
Navigate to All > Service Catalog.
Select Certificate Management.
Select Automated Flow.
Select Request New Certificate (Automated).
On the form, fill in the fields.
| Field | Description |
|---|---|
| Certificate Purpose | Indicates whether the request is for an internal or external certificate.For CAs such as Let's Encrypt, select External. |
| Certificate Signing Request \(CSR\) | CSR containing certificate information. |
| Validity Period for Certificate \(In Days\) | Number of days the certificate is valid.For Let's Encrypt, the maximum validity period is 90 days. |
| Certificate Owner Group | Group for which the certificate tasks are generated. |
| Certificate Owner | Name or role of the person who will own the certificate. |
The following CSR attributes are matched and auto-populated based on the certificate information from CSR:
- Subject Common Name
- Subject Alternative Name
- Organization
- Organizational Unit
- Locality/City
- Province
- Country
- Email Address
Select Submit.
Once the request is submitted, a task is created for completing the DNS challenge. The task is completed automatically.
Result
Once DNS record propagation has completed after two minutes, the DNS challenge is completed automatically and the automated flow sends a request to the CA to get the certificate.
Admins can change this duration by modifying the sn_disco_certmgmt.wait_time_for_dns_record_propagation system property.
The certificate is attached to the New certificate task.
- The request certificate task status changes to Completed.