Skip to content

Create an SSL.com certificate authority

CyberArk Certificate Manager - SaaS supports cloud-native integration with SSL.com, allowing you to request, renew, revoke, and import certificates through your SSL.com team without leaving Certificate Manager - SaaS.

Note

The SSL.com CA connector runs natively in Certificate Manager - SaaS and does not require a VSatellite.

Before you begin

Before configuring the SSL.com CA account in Certificate Manager - SaaS, ensure you have the following:

  • An SSL.com account with access to the team whose certificates you want to manage.
  • An SSL.com API token for that account. At a minimum, the token must have:
    • Read access to certificate types, domains, organizations, and team details
    • Read and write access to certificate requests
    • Read access to the certificate inventory (for import)
  • The Team ID (UUID) of the SSL.com team the connector will manage. Each connection is scoped to one team; managing multiple teams requires multiple connections.
  • At least one endorsed (DCV-complete) domain on the SSL.com team for certificates you plan to issue. Issuance for a non-endorsed domain fails.
  • For OV or EV issuance, an SSL.com Organization with an active OV or EV endorsement and its Organization ID (UUID).
  • In Certificate Manager - SaaS, administrative access via the Platform Administrator, PKI Administrator, or System Administrator role.

For details on API tokens and team management, see the SSL.com documentation.

Add an SSL.com CA account

  1. Sign in to Certificate Manager - SaaS.

  2. Click Integrations > Certificate Authorities.

  3. Click New, then click Add Certificate Authority connector.

  4. On the Connection page:

    1. Enter a Name that will be used as the display name for the CA account.
    2. Select SSL.com as the Certificate Authority Type.
    3. Click Next.

  5. On the Information page, provide the connection details for your SSL.com account:

    1. In API Base URL, enter the SSL.com API endpoint.

      Example

      • Production: https://api.ssl.com/api/v1
      • Staging: https://api.staging.ssl.com/api/v1

    2. Enter the Team ID (UUID) of the SSL.com team you want to manage.

    3. Enter your API Token. The value is masked and stored encrypted.

    4. Click Test Connection to verify your credentials and team access.

      If the token or Team ID is invalid, Certificate Manager - SaaS reports an authentication error and the connector is not saved.

    5. Click Next.

  6. On the Issuance page, specify the SSL.com certificate profiles to make available for certificate issuing templates:

    1. In Product Options, select one or more SSL.com profiles retrieved from your team, such as SSL.com DV TLS - RSA, SSL.com OV TLS - ECC, or SSL.com EV TLS - RSA. The profile determines the validation level (DV, OV, or EV) and key algorithm (RSA or ECC).

      How do I know which product options to select?

      Select every profile you might want to use with Certificate Manager - SaaS. You can restrict which profiles are available to specific users when you create the issuing template. You can modify this selection later by editing the CA account settings.

    2. Click Add to include additional profiles as needed.

    3. Click Next.

  7. (Optional) On the Import page, configure settings to import existing certificates from your SSL.com team.

    If you don't want to set up certificate import, click Create to finish.

    1. (Optional) Enable one or both Import options:
      • Include Expired Certificates — When enabled, expired certificates are included in the import. Off by default.
      • Include Revoked Certificates — When enabled, revoked certificates are included in the import. Off by default.

    2. (Optional) Enable Scheduled import, then configure the schedule.

    3. Click Create.

Your new SSL.com CA account appears in the Certificate Authorities list. Imported certificates, including the full certificate chain, appear in your Certificate Manager - SaaS inventory.

About SSL.com issuance and lifecycle behavior

The SSL.com connector has a few behaviors that differ from other CA connectors. Review them before creating issuing templates or requesting certificates.

  • Issuance is always asynchronous. After you submit a request, the certificate does not appear immediately. Certificate Manager - SaaS polls SSL.com until the certificate is issued. Domain-validated (DV) certificates backed by an endorsed domain typically complete in a few minutes. Organization-validated (OV) and extended-validation (EV) certificates can take longer while SSL.com completes manual approval. A Requested state that transitions to Issued is expected.

  • Certificate requests are CSR-based only. In the certificate request wizard, the Service automated certificate request option is disabled for the SSL.com connector. You must select Generate CSR and private key myself and paste a PEM-encoded certificate signing request (CSR).

  • The CSR must include a DNS Subject Alternative Name (SAN). A CSR with only a Common Name is rejected with a policy violation. Include at least one subjectAltName=DNS:... entry in the CSR; the connector reads the domain list from the CSR.

  • OV and EV issuance requires an Organization ID. When you create the issuing template, set Organization ID to the UUID of an SSL.com Organization that holds an active OV or EV endorsement. Leave Organization ID empty for DV templates.

  • Renewal submits a new request. SSL.com has no dedicated renew endpoint, so renewing a certificate through the connector re-submits a fresh certificate request against the original profile and organization. Only certificates originally issued through this connector can be renewed. Imported certificates cannot be renewed because they have no originating SSL.com order; re-issue them instead.

  • Revoked certificates display as Failed in Certificate Manager - SaaS. After a successful revocation, the connector reports Submitted, and the certificate transitions to Failed in Certificate Manager - SaaS. SSL.com still shows the certificate as revoked in its portal. This is expected — Certificate Manager - SaaS folds terminal states into Failed.

What's next

This CA is now ready to be added to one or more certificate issuing templates. To do this, select this CA when creating certificate issuing templates.