Skip to content

Create a new Oracle Cloud Load Balancer machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Creating a machine enables Certificate Manager - SaaS to connect to Oracle Cloud Infrastructure (OCI) so it can discover the certificate bundles on your load balancers and renew them. After creating the machine, you can discover and provision certificates.

Before you begin

  • An OCI user for Certificate Manager - SaaS to connect as, with an API signing key uploaded to the user. Use a dedicated user that only Certificate Manager - SaaS uses, not a person's account or an administrator. You need the key's RSA private key in PEM format and, if the key is encrypted, its passphrase.

  • An OCI policy for a group that contains the user, with one statement for each compartment that holds load balancers you want to manage:

    • For discovery and provisioning:

      Allow group <group> to use load-balancers in compartment <compartment>

    • For discovery only:

      Allow group <group> to read load-balancers in compartment <compartment>

    Certificate Manager - SaaS never creates or deletes load balancers, so don't grant manage load-balancers. Grant access to the whole tenancy (in tenancy) only if discovery must cover the root compartment.

  • The OCID of your tenancy, the OCID of the user, and the OCI region that holds the load balancers, such as us-ashburn-1.

For more information about API signing keys and where to find OCIDs, see Required Keys and OCIDs in the OCI documentation.

Note

No VSatellite is required. Certificate Manager - SaaS connects to OCI directly.

  1. Enter the Tenancy OCID. This is the OCID of your Oracle Cloud tenancy, shown under Tenancy Information in the OCI Console. It starts with ocid1.tenancy..
  2. Enter the User OCID. This is the OCID of the OCI user that owns the API signing key. It starts with ocid1.user..

  3. In API Signing Key, paste the PEM-encoded RSA private key of the API signing key, including the BEGIN and END lines.

    Note

    You don't need to enter the key's fingerprint. Certificate Manager - SaaS calculates it from the private key.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  4. If the API signing key is encrypted, enter its Private Key Passphrase. Otherwise, leave this field empty.

  5. Select the Region of the load balancers, such as us-ashburn-1. A machine covers one region. To manage load balancers in another region, create another machine.

  6. Click Test Access to verify connectivity.

    Note

    The test checks only the credentials. It can't check load balancer permissions, because they depend on the compartment you choose for discovery. If the policy is missing, discovery or provisioning fails.

  7. Click Continue. The Continue button is enabled only after the connection test succeeds.

What's next?