Key Manager Plus (KMP) integrates with AWS Certificate Manager (ACM) — an SSL certificate manager and private certificate authority. This integration enables you to request and obtain certificates from AWS-ACM into Key Manager Plus. In addition, you can deploy certificates from Key Manager Plus to the AWS-ACM repository.
It also allows you to renew certificate requests and automate the end-to-end lifecycle management of SSL/TLS certificates issued and managed by ACM, directly from the Key Manager Plus web interface.
Through Key Manager Plus's certificate discovery feature, import AWS-ACM certificates into the KMP repository. Once discovery is done, Key Manager Plus displays all the AWS certificates deployed to all regions under the AWS tab. Click here to learn more about the supported regions in AWS.
There are two types of certificates in AWS-ACM: Public and Private Certificates. AWS-ACM allows you to use public certificates provided by ACM or certificates that are imported into ACM. If you use ACM Private CA to create a CA, ACM can issue certificates and automate certificate renewals from that private CA.
Key Manager Plus allows you to create new certificates and manage them in the product. AWS-ACM does not support the creation of new certificates. However, you can create, request, and import certificates from Key Manager Plus into AWS-ACM and manage them from the AWS Management Console. Click here to learn more about importing certificates into AWS-ACM.
Key Manager Plus enables you to discover, import, and configure expiry notifications for SSL certificates hosted in the following Amazon Web Services: AWS Certificate Manager (ACM) and AWS Identity and Access Management (IAM). Click here for detailed steps on how to discover AWS-ACM certificates.
Note: When you perform any operation on the AWS certificates added before KMP build 6200, Key Manager Plus automatically performs certificate rediscovery and re-populates the data in the table to get the Amazon Resource Name (ARN) ID. Please note that this automatic rediscovery happens only from KMP build 6200 onwards.
In the SSL >> AWS tab, Public Certificates requested from Amazon are marked as Amazon Issued, Private Certificates are marked as Private and certificates are that imported from KMP to AWS-ACM are marked as Imported.
Key Manager Plus's integration with AWS-ACM facilitates you to deploy certificates to the AWS-ACM and manage them from their console.
To deploy certificates to AWS-ACM, follow the below steps:
Certificates can be deployed to all the supported regions provided the private keys are available.
Deploy and replace if the same certificate is found in ACM: If you wish to replace the certificate in ACM after deployment, in case it turns out to be a duplicate, select this option.
Automatically re-deploy the certificate to ACM upon renewal: Select this option to automatically re-deploy the certificate to ACM every time it is renewed so that the certificate in Key Manager Plus and AWS-ACM are always in sync.
If there is a mismatch in the deployed certificates, they will be marked in red in the AWS tab in Key Manager Plus.
Key Manager Plus allows you to request both Public and Private certificates from AWS-ACM and manage them from the KMP interface.
In the page that appears, fill in the following attributes:
Now, click Request Certificate. The certificate matching the credentials you have provided will be imported into Key Manager Plus. Please note that Public Certificates from AWS-ACM do not have a private key.
In the page that appears, fill in the following attributes:
Now, click Request Certificate. The requested certificates will be issued and added to the repository upon validation.
Once you request certificates from AWS-ACM, click the Request Status option from the top menu to view and validate the status of the certificates.
In this page, you can view the request, renewal, and domain validation status of both private and public certificates. Once a certificate request is created, the status of the certificate will appear in this table as Pending Validation.
If you have configured DNS-based challenge verification, click the status to deploy the challenge. The status will change to Deploy Challenge and the validation process will begin.
Once the certificate authority receives your order, you will have to go through a process called domain validation and prove your ownership over the domain upon the completion of which you will receive the certificate. Key Manager Plus supports all the two validation methods:
Click here for more details on certificate deployment.
The entire challenge verification process can be automated from Key Manager Plus. This can be achieved by configuring the server details under Manage >> Deploy. To automate DNS validation,
Key Manager Plus allows you to renew Private certificates. When a certificate renewal is requested from KMP, the renewed certificate will be retrieved from AWS-ACM. However, if you renew a certificate in AWS-ACM, it is not automatically updated in KMP. To fix the mismatch, rediscover the certificates in Key Manager Plus and re-populate the data.
To renew a certificate:
Please note that only the certificates that satisfy all criteria mentioned here will be renewed. Click here to read about AWS's eligibility criteria for certificate renewal.
To revoke a certificate request:
Please note that the revoke option applies only to Private Certificates in AWS-ACM.
Revoking a certificate request removes the certificate entry from Key Manager Plus only.
To fetch the private key:
To fetch the private key of a Private Certificate, follow the below steps:
This operation fetches the private key of the selected private certificate from AWS-ACM. Please note that is a paid option and might incur costs as per your AWS-ACM license.
To delete a certificate from the KMP interface:
Please note that using the Delete option simply removes the certificate from the KMP interface, you can no longer manage it from the product. However, it does not delete the certificate from AWS-ACM - the certificate can still be viewed and managed from the AWS console.