Akeyless supports ZeroSSL, GlobalSign, Venafi, GoDaddy and Sectigo as a Public CA.

The public certificate authority will sign and issue the certificate, while Akeyless will store and manage the certificate lifecycle.

The issuance flow utilizes a Public CA Target with Akeyless PKI Issuer, ensuring full automation and storage of your public certificate while providing real-time expiration notification inside the Event Center to manage the lifecycle of your certificates.

Prerequisites

• An Akeyless Gateway to interact with the Public Certificate Authority.
• Target of the public CA.

PKI Cert issuer with a Target

Run the following command to create a PKI Certificate Issuer with a ZeroSSL or GlobalSign Target:

akeyless create-pki-cert-issuer \ 
--name <PKI Issuer name> \
--ca-target <Path/To/Target/>
--gw-cluster-url https://<Your-Gateway-URL:8000> \
--ttl <7776000> \
--allowed-domains <domain1.com,domain2.com> \
--destination-path </Certificate/Storage/Folder> \
--expiration-event-in <5>

Where:

• name: A unique name for the PKI issuer item. The name can include a path to the virtual folder where you want to create a new PKI cert issuer using the slash / separators. If the folder does not exist, it will be created together with the item.
• ca-target: The name of an existing CA target to attach this PKI Certificate Issuer.
• gw-cluster-url: Akeyless Gateway Configuration Manager URL (port 8000).
• ttl: The maximum requested Time To Live for issued certificates in seconds.
• allowed-domains: A list of domains that will be allowed to issue certificates for using this item.
• destination-path: A path in Akeyless for Certificate Storage, the issued certificate will be stored under this folder.
• expiration-event-in: How many days before the expiration of the certificate would you like to be notified. To specify multiple events, use the argument multiple times: expiration-event-in 10 expiration-event-in 15

👍

Allowed Domains

Due to the nature of some Public CAs e.g. GoDaddy, CN might be sent with the classic www. prefix, it is recommended to check this in advance for future automated renewal.

Issuing a certificate

Run the following command to create a new Certificate Signing Request (CSR):

akeyless generate-csr \
--name <Name/of/New/Classic-Key> \
--generate-key \
--alg <RSA1024> \
--common-name <common name to be included in the CSR certificate> \
--gateway-url <https://Akeyless-Gateway-URL:8000>

👍

Note

The Common Name field (e.g., server FQDN) - Should be listed under the allowed-domains as configured in the PKI Issuer item.

To issue a new certificate, run the following command:

akeyless get-pki-certificate -c <PKI Issuer name> --csr-file-path MyCSR.csr

The output of this command contains the following value:

• display ID - Certificate display ID

To retrieve the certificate, run the following command:

akeyless get-certificate-value -c <Issuer Name>  -d <display ID>

Once the certificate issue request is processed, a validation email will be sent to the email address listed in the Target, and it will be processed automatically by the Akeyless Gateway

The issued Certificate item should be created under the destination-path storage folder inside Akeyless.