Creating a SwissSign connector¶

This topic explains how to set up a SwissSign certificate authority (CA) connector in Certificate Manager - SaaS using the Venafi CA Connector Framework. The connector issues, revokes, and imports certificates through your SwissSign Managed PKI (MPKI) account.

Before you begin¶

Before you set up the CA connector:

• You must have the Superuser role in Certificate Manager - SaaS to create CA connectors.
• Your SwissSign connector must already be deployed to Certificate Manager - SaaS using the Dev Central API. It won't appear in the Certificate Authority Type list until it has been deployed.

As a SwissSign MPKI administrator, prepare the following in the MPKI portal:

• An RA service account, of the form MPKI0000000.AutoRAO, that is scoped to the Client you want to manage and has permission to issue, revoke, and search certificates. Find it under My account > Service API keys.
• A service API key for that service account, generated on the same page. Copy it when you generate it; it's shown only once.
• The Client reference of the MPKI account. It takes the form cli- followed by a UUID.

Create a SwissSign CA connector in Certificate Manager - SaaS¶

Before you complete these steps, review Create a custom CA connector, including the prerequisites and notes.

1. Sign in to Certificate Manager - SaaS.

2. Click Integrations > Certificate Authorities.

3. Click New > Add Certificate Authority connector.

4. Under Connection, add the following.

   1. Enter a Name for the CA connector to use as its display name.

   2. Select SwissSign as the Certificate Authority Type.

      Note

      Your custom CA won't appear in this list until you have deployed your custom CA connector using the Dev Central API.

   3. Click Next.

5. Under Information, add the connection details for your SwissSign account.

   1. Enter the Server URL.

      This is the base URL of the SwissSign RA API. Use https://api.ra.swisssign.ch for production, or https://api.ra.pre.swisssign.ch for pre-production.

   2. Enter the Client Reference.

      This is the reference of the SwissSign Client (Managed PKI account) that this connector issues for, in the form cli- followed by a UUID. Copy it from the MPKI portal exactly as shown.

   3. Enter the Service Account Name.

      This is the login of the RA service account, in the form MPKI0000000.AutoRAO. Find it in the MPKI portal under My account > Service API keys.

   4. Enter the Service API Key.

      This is the service API key of that RA service account, from the same page in the MPKI portal.

      Warning

      Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

   5. Click Test Connection.

      A successful test confirms both that the credentials are valid and that the service account can see the Client you entered. If the connection isn't successful, resolve all issues and ensure you have a successful connection before continuing.

   6. Click Next.

6. Under Issuance, set the following options.

   1. In Product Options, select the products you want to make available to request policies.

      The list shows the TLS products assigned to your SwissSign Client. Products that generate the key pair at the CA, that require registration documents, that have expired, or that aren't TLS products don't appear. For more information, see Products missing from the list.

   2. Click Next.

7. (Optional) Under Import, set the following options to configure certificate import.

   1. In Import options, select All certificates.

      SwissSign offers a single import option, which covers every certificate on the Client this CA connector is configured for.

   2. To import certificates whose validity has already ended, turn on Expired certificates. This option is off by default.

   3. To import certificates that have been revoked at SwissSign, turn on Revoked certificates. This option is off by default.
   4. To schedule certificate import, enable Scheduled import and choose a schedule.

8. Click Create. The new SwissSign CA appears on the Certificate Authorities page.

Set the issuance options on your request policy¶

The SwissSign connector adds one field to every request policy that uses this CA connector:

• Tags - Comma-separated labels that are stored on the certificate order at SwissSign. For example, use them to mark orders as issued by Certificate Manager - SaaS.

For the remaining settings, see Create a request policy.

What to expect from SwissSign¶

• Issuance is asynchronous. SwissSign processes orders in the background. OV orders typically take one to two working days, and EV orders take five to ten. A request that stays pending for days is normal.
• Domains must be pre-validated. An OV or EV request for a domain that isn't already pre-validated on your Client waits for domain control validation. Start and complete validation in the MPKI portal. Certificate Manager - SaaS shows a domain's validation state, but it can't start a validation.
• The requested validity must match the product. Each SwissSign product offers a fixed set of validity periods. Set the validity on your request policy to one of them; other values are rejected.
• Revocation is confirmed later. Certificate Manager - SaaS reports the revocation as submitted as soon as SwissSign accepts it. SwissSign then runs a revocation job, and products that require authorization also need an approver. The certificate's status updates on a later status check or import.
• Five revocation reasons are supported. SwissSign accepts Unspecified, Key Compromise, Affiliation Changed, Superseded, and Cessation of Operation. No other reason can be sent.
• Renewal is a new issuance. SwissSign has no renewal operation, so renewing a certificate issues a new one against the same product.
• The first import takes longer than later ones. On a new CA connector, Certificate Manager - SaaS first has to find where your account's order history begins, and then walks it. Later imports resume from where the last one finished.
• Each import re-reads the last two weeks. This is by design, so that certificates issued after a long delay aren't missed. Duplicates are matched on the SwissSign order reference, so your inventory isn't affected.

Products missing from the list¶

A SwissSign product doesn't appear in Product Options when any of the following is true:

• The product generates the key pair at the CA. Only products that accept a certificate signing request (CSR) are supported.
• The product isn't a TLS product. S/MIME, email ID, and code signing products aren't supported.
• The product has expired at SwissSign.
• The product requires registration documents to be attached to a request. Certificate Manager - SaaS can't supply them.
• The product doesn't publish a validity period.

Depending on your account, a substantial share of your products might not appear. To confirm why a specific product is missing, contact CyberArk Support.

Troubleshooting¶

Connection issues¶

Issuance issues¶

Revocation issues¶

Import issues¶

What's next?¶

This CA is now ready to be added to one or more request policies. To do this, select this CA when creating request policies.

Related Links¶

• CA Connector overview
• Creating a custom CA connector
• Custom CAs in the CA inventory
• Create a request policy