Create a GlobalSign Atlas certificate authority¶

Before you begin¶

You're going to need a few things to complete the CA configuration.

A GlobalSign account. If you don't have an account yet, go here to get started.
Your GlobalSign credentials file.

How do I create the GlobalSign credentials file?

Log into the GlobalSign Atlas web portal.
Navigate to Access Credentials > API Credentials, and click Generate an API Credential (the button, upper right).
Select Encrypted File and click Continue.

Paste in the following public key (which corresponds to the private key Certificate Manager - SaaS will use to decrypt the .enc file), and click Continue.

Select the Atlas server to which the credential will be linked, and click Continue.
Select the identity to which the credential will be linked, and click Continue.
Enter a name for the API credential, and click Continue.
Click the DOWNLOAD KEY & SECRET AS .enc button, and save the file (this is the file you upload into Certificate Manager - SaaS when creating a GlobalSign Atlas CA Account).

Sign in to Certificate Manager - SaaS.
Click Integrations > Certificate Authorities.
Click New > GlobalSign.
Enter a Name that this CA should be called in Certificate Manager - SaaS.
Browse to your Credentials File.

See the Before You Begin section at the top of this page for details on how to get this file.
Click Validate.

After you authenticate, we'll show you GlobalSign's validation policy. This is a list of requirements that your certificate request must comply with before GlobalSign will issue a certificate for you. We'll also display this information in a more readable form when you start setting up policies for your organization.

Example validation policy¶

{

'validity': {'secondsmin': 60, 'secondsmax': 7776000, 'notBeforeNegativeSkew': 200, 'notBeforePositiveSkew': 200},

'subjectDn': {

  'commonName': {

    'presence': 'REQUIRED',

    'format': '^([a-z0-9-_]+\\.)*(venafi\\.io|vfidev\\.com|thehotelcook\\.com)$'

  },

  'organization': {'presence': 'STATIC', 'format': 'Venafi, Inc.'},

  'organizationalUnit': {'isStatic': false, 'list': ['^.*$'], 'mincount': 0, 'maxcount': 3},

  'country': {'presence': 'STATIC', 'format': 'US'},

  'state': {'presence': 'STATIC', 'format': 'UT'},

  'locality': {'presence': 'STATIC', 'format': 'Salt Lake City'},

  'streetAddress': {'presence': 'FORBIDDEN', 'format': ''},

  'email': {'presence': 'FORBIDDEN', 'format': ''},

  'joiLocalityName': {'presence': 'FORBIDDEN', 'format': ''},

  'joiStateOrProvinceName': {'presence': 'FORBIDDEN', 'format': ''},

  'joiCountryName': {'presence': 'FORBIDDEN', 'format': ''},

  'businessCategory': {'presence': 'FORBIDDEN', 'format': ''}

},

'extendedKeyUsages': {

  'ekus': {

    'isStatic': true,

    'list': ['1.3.6.1.5.5.7.3.2', '1.3.6.1.5.5.7.3.1'],

    'mincount': 2,

    'maxcount': 2

  }, 'critical': false

},

'publicKey': {'keyType': 'RSA', 'allowedLengths': [4096, 3072, 2048], 'keyFormat': 'PKCS10'},

'publicKeySignature': 'FORBIDDEN'

}

Authorized Domains¶

This CA supports the Authorized Domains table, which shows the domains registered with your CA account and the current Domain Control Validation (DCV) status of each one. For details on where to find the table, what each column means, and how validation statuses are normalized across CAs, see Authorized Domains.

What's Next¶

This CA is now ready to be added to one or more certificate issuing templates. To do this, select this CA when creating certificate issuing templates.