# Integrating Google Trust Services Certificate Authority with Key Manager Plus

Key Manager Plus integrates with Google Trust Services (GTS) CA through the ACME protocol, enabling organizations to automate the issuance and renewal of publicly trusted SSL/TLS certificates directly from the Key Manager Plus interface. By leveraging this integration, administrators can request certificates, automate domain validation, track certificate expiry, receive renewal notifications, and manage the complete certificate life cycle from a centralized console, thereby reducing administrative effort and ensuring continuous certificate availability.

## 1. Registering Google Trust Services Account in Key Manager Plus

Before you can request certificates from GTS CA, you should register your Google Cloud account in Key Manager Plus. This is a one-time setup process that can be completed from the Key Manager Plus web interface. Follow these steps to register your Google Cloud user account:

1. Log in to your Key Manager Plus account and navigate to **Integrations >> ACME Integrations >> Google Trust Services >> Manage**.
2. On the page that appears, click the **New Registration** button in the top pane under the **Account** tab.
3. On the **Registration** page, specify the following details:

   ![google-trust-services-1](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-1.png)

   - **Name** - Specify the display name for the Google Cloud user account.
   - **Email** - Enter the registered email address associated with the Google Cloud account.
   - **EAB KID** - Enter the **External Account Binding Key ID** provided by GTS.
   - **EAB HMAC Key** - Specify the HMAC key associated with the EAB KID, issued by GTS for secure account binding. Refer to [this](https://docs.cloud.google.com/certificate-manager/docs/public-ca-tutorial#request-key-hmac) page to learn how to request EAB KID and EAB HMAC Key.
4. After entering the necessary details, click on the **Subscriber Agreement** link, read through the specified terms and conditions, enable the **Accept Google Trust Services Subscriber Agreement** checkbox, and click **Register**.
5. When the **Acknowledgment** pop-up appears, click **Confirm**. Your Google Cloud account will be successfully registered.

   ![google-trust-services-2](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-2.png)

After registering your account, you can update the email address, delete your Google Cloud account from Key Manager Plus, or deactivate it if required. To add the same account again in Key Manager Plus, export the key, click the **Add Account** button, and enter the account details as specified above.

**Notes:**

- Only users with administrator privileges can register, add, or manage a Google Cloud account in Key Manager Plus.
- Only one Google Cloud account can be registered and managed from the Key Manager Plus web interface.
- Deleting an account removes it only from the Key Manager Plus database, The account remains active in the GTS CA portal and can be registered again in Key Manager Plus, provided it is not already registered in another Key Manager Plus instance or product.
- If the account is deleted with the **Deactivate** option enabled, it will be permanently deactivated in the GTS CA portal and deleted from the Key Manager Plus database. Once deactivated, the account cannot be registered again in Key Manager Plus.

## 2. Creating a Certificate Request

After registering your Google Cloud account, you can raise certificate requests directly from the Key Manager Plus interface. Once the request is submitted, you will be presented with a domain control validation challenge, which should be completed for GTS to validate your domain and issue the certificate. Follow these steps to raise a certificate request and fulfill the challenge:

1. Navigate to **Integrations >> ACME Integrations >> Google Trust Services** and click the **Certificate Request** button.
2. On the page that appears, specify the **Common Name** and **SAN**, select the Challenge Type, Key Algorithm, Algorithm Length, Signature Algorithm, and Keystore Type, specify the Keystore Password, and click **Create**.

   ![google-trust-services-3](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-3.png)

3. If you have selected DNS-01 as the challenge type, select the DNS account from dropdown for challenge verification. The selected credentials are used to automatically verify the challenge for all domains specified in the certificate request. For information about adding a DNS account, refer to the below sections.
4. Additionally, Key Manager Plus allows you to change the private key whenever the certificate is renewed.

   - Use the **New Key** option if you want to change the key.
   - Use the **Same Key** option if you want to retain the same key received upon renewal.
   - Use the **Import Key** option to use your own key. The provided key will be used for the first time when the certificate is generated and for the subsequent renewals.

**Note:** Key Manager Plus supports wildcard certificate requests for DNS-based challenges. For wildcard certificate requests, enter the common name in the format *.domainname.com.

Follow these steps to configure your DNS account:

1. Navigate to **Integrations >> ACME Integrations >> Google Trust Services >> Manage**, switch to the **DNS** tab, and click the **Add** button. Here, you can add a maximum of one DNS account for each supported DNS provider.

   ![google-trust-services-4](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-4.png)

2. In the pop-up window that appears, choose the desired DNS provider, specify the necessary details as mentioned in this section, and click the **Save** button to add the desired DNS account successfully.

**Note:** Currently, Key Manager Plus supports automatic challenge verification for Azure DNS, CloudFlare DNS, Amazon Route 53 DNS, RFC2136 DNS update, GoDaddy DNS, and ClouDNS.

### 2.1 Azure DNS

Enter the following details to add an Azure DNS account:

1. **Subscription ID** - Enter the Azure subscription ID associated with the DNS zone. The subscription ID is available on the Overview page of the Azure DNS Zone.
2. **Directory ID** - Enter the Azure Active Directory (tenant) ID. The Directory ID is available under Azure Active Directory >> Properties.
3. **Application ID** - Enter the application ID of the Azure AD application with access to the DNS zone.
4. **Key** - Enter the client secret generated for the Azure AD application.
5. **Resource Group Name** - Enter the name of the Azure resource group where the DNS zone is hosted.

If you do not have an existing Azure application, follow the steps mentioned in this link to create the Azure application and key, and assign the required permissions to the DNS zones to enable API calls.

After entering the above details, click the **Save** button. The DNS account will be added successfully, and you can view it under Manage >> DNS.

### 2.2 Cloudflare DNS

Enter the following details to add a Cloudflare DNS account:

1. If you have selected **API Token** as your authentication type:
   1. **Name** - Enter a name for the API.
   2. **API Token** - Enter the API Token that is generated on your Cloudflare dashboard.
2. If you have selected **Global API Key** as your authentication type:
   1. **Email Address** - Enter the email address associated with your Cloudflare account.
   2. **Global API Key** - Enter the Cloudflare Global API key used to authenticate API requests. Use the **Generate API Key** option on the Cloudflare DNS domain overview page to generate the key.
3. After entering the above details, click the **Save** button. The DNS account will be added successfully, and you can view it under Manage >> DNS.

### 2.3 AWS Route 53 DNS

Generate and specify the following details associated with your AWS account in the respective fields and click **Save**.

1. **Access Key ID** - Enter the **AWS Access Key ID** associated with the IAM user.
2. **Secret** - Enter the **Secret Access Key** generated for the IAM user.

The DNS account will be added successfully, and you can view it under **Manage >> DNS**.

If you do not have an AWS Route 53 DNS account, follow these steps to create an account and generate the Access Key ID and Secret:

1. Log in to the AWS console, navigate to **IAM Services >> Users**, and click the **Add User** button.
2. In the window that appears, specify the username and select **Programmatic Access** as the access type.
3. Switch to the next tab, click **Attach existing policies directly** under **Set Permissions**, and search for **AmazonRoute53FullAccess**. Assign the listed policy and switch to the next tab.
4. Under the **Tags** section, add the appropriate tags (optional) and switch to the next tab.
5. Review all the provided information and click **Create user**. Your user account will be created, and subsequently, an access key ID and a secret will be generated.
6. Copy and save the **Access Key ID** and **Secret** in a secure location, as it will not be displayed again.

If you have an AWS user account, grant the **AmazonRoute53FullAccess** permission to the user and generate an access key if the user does not have one. If the user account has an associated access key, ensure that the necessary permissions are granted. Follow these steps to grant the necessary permission to your AWS account:

1. Navigate to the **Permissions** tab, select the required user account, and click **Add Permission**.
2. Click **Attach existing policies directly** under **Set Permissions** and search for **AmazonRoute53FullAccess**.
3. Assign the listed policy and click **Save**.
4. To generate the access key, select the user account and navigate to the **Security Credentials** tab.
5. In the window that appears, click the **Create access key** button. An access key ID and a secret will be generated.
6. Copy and save the **Access Key ID** and **Secret** in a secure location, as it will not be displayed again.

### 2.4 RFC2136 DNS Update

Enter the following details to automate the DNS-based domain control validation procedure in Key Manager Plus if you are using open source DNS servers such as Bind, PowerDNS, etc., that support RFC2136 DNS update. These details are usually found in the server installation directory. For instance, in the case of the Bind9 DNS server, you can find these details in the file named local.conf within the DNS server installation directory.

1. **DNS Server IP/Host Name** - Specify the hostname or IP address of the machine where the DNS server is running.
2. **Key Secret** - Enter the secret key generated for TSIG authentication to approve DNS record updates.
3. **Key Name** - Provide the TSIG key identifier associated with the DNS server configuration.
4. **Algorithm** - Specify the hashing algorithm used for TSIG key generation (e.g., HMAC-MD5, HMAC-SHA1, HMAC-SHA256).

### 2.5 GoDaddy

Enter the following details to add a GoDaddy DNS account:

1. **Key** - Enter the GoDaddy API key used to authenticate API requests.
2. **Secret** - Enter the GoDaddy API secret associated with the above key.

Follow these steps to obtain the GoDaddy API credentials:

1. Go to the GoDaddy developer portal and switch to the API keys tab.
2. Log in to your GoDaddy account if you are not logged in already.
3. Once you log in, you will be redirected to the API keys page, where you can create and manage API keys. Click **Create New API key**.
4. In the window that appears, specify your application name, choose the environment type as **Production**, and click **Next**. The API key and its secret will be generated.
5. Copy and save the secret in a secure location, as it will not be displayed again.

### 2.6 ClouDNS

Choose between one of the following options: Auth ID, Sub Auth ID, or Sub Auth User, and specify its password:

1. **Auth ID / Sub Auth ID / Sub Auth User** - Enter the corresponding authentication identifier obtained from the ClouDNS Reseller API configuration.
2. **Auth Password** - Specify the password associated with the selected authentication ID.

Follow these steps to obtain the ClouDNS API credentials:

1. Log in to your ClouDNS account and go to Reseller API.
2. If you have already created an API user ID, it will be listed under API Users. If not, click the **Create API** button to generate new API credentials.

Refer to the [CloudDNS documentation](https://www.cloudns.net/wiki/article/42/) for more information about API Auth IDs.

### 2.7 DNS Made Easy

Enter the following details to add a DNS Made Easy account:

1. **Name** - Enter a display name for identifying the DNS Made Easy account in Key Manager Plus.
2. **Key** - Enter the DNS Made Easy API key used for authentication.
3. **Secret** - Enter the API secret associated with the specified API key.

### 2.8 Mythic Beasts

Enter the following details to add a Mythic Beasts DNS account:

1. **API Key ID** - Enter the API Key ID generated from your Mythic Beasts account.
2. **API Secret** - Enter the API Secret associated with the specified API Key ID.

   ![mythic-beasts-dns](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/mythic-beasts-dns.png)

Follow these steps to obtain the Mythic Beasts API credentials:

1. Log in to the [Mythic Beasts portal](https://www.mythic-beasts.com/user/login) and authenticate using your Mythic Beasts credentials.
2. Navigate to the **API Keys** section.
3. Click **Create API Key** and select the required API access permissions. Ensure that access to the **Primary DNS API v2** is enabled.
4. Configure the scope for the API key. You can either leave the scope unrestricted or restrict access to specific zones, domains, or hostnames based on your requirements.
5. Generate the API key. Copy and securely store the generated **API Key ID** and **API Secret**. The **API Secret** will not be displayed again.

**Notes:**

- One certificate can secure up to 100 domains. You can enter a maximum of 100 names in the **Domain Name** field, out of which the first name is considered as the common name and the rest are treated as Subject Alternative Names (SAN).
- Key Manager Plus supports HTTP-01 and DNS-01-based domain validations. Choose the challenge type based on your requirements.
- For DNS-01-based domain validation, if you are using your configured DNS account for challenge verification, ensure that the status of the selected DNS account is marked as **Enabled** under **Manage >> DNS**.
- The option to change the private key currently works only for certificates with the RSA key algorithm.

## 3. Google Trust Services Challenge Verification

Key Manager Plus expedites domain validation through automatic verification of **HTTP-01** and **DNS-01** challenges (currently supported for Azure, Cloudflare, Amazon Route 53, RFC2136 DNS update, GoDaddy DNS, ClouDNS). For the automation to take effect, you have to initially map the end-server details to Key Manager Plus, which is a one-time process.

### 3.1 Domain Validation through HTTP-01 Challenge Verification

Upon creating a certificate request, you will be redirected to the domain challenge verification page. To validate your domain using an HTTP-01 challenge, follow the steps below:

1. On the domain control validation page, click the **Agent Mapping** icon beside the HTTP-01 challenge.
2. In the **Deploy** window that appears, ensure that the correct challenge type and domain name are selected.
3. If the certificate to be deployed on a Linux machine, select **Linux** and specify the **Server Name/IP Address, Port, User Name, Password, WebRoot Path**, and select **Certificate** to specify the **Certificate Path**. You can also deploy private key and file store to the Linux server.
4. Upon entering the required details, click **Save**.

   ![google-trust-services-5](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-5.png)

5. If the domain server is a Windows machine, ensure that select the installed Windows agent in the Server Name/IP Address field. If the Windows agent is not yet installed on the target end server, you should download and install the Key Manager Plus agent.

   The Key Manager Plus agent is an .exe file containing the necessary executables and configuration files required to verify the GTS challenges through automatic domain validation. Run the downloaded agent installer file and complete the process.

   To download the Key Manager Plus agent for Windows server from the Key Manager Plus web interface, perform the following actions:

   1. Navigate to **Integrations >> ACME Integrations >> Google Trust Services**, and click the **Manage** button in the top-right corner.
   2. Switch to the **Windows Agents** tab and click **Download Windows Agent** at the top-right corner.
   3. In the window that appears, click the **Download Exe** button. Ensure that you copy the install key before running the installer at the target server.
6. Upon selecting the agent in the **Server Name/IP Address** field, enter the **WebRoot Path**.
7. Select **Certificate** and specify the **Certificate Path**. You can also select **Private Key** and **JKS/PKCS** to deploy to the target server.
8. Click **Save** to complete the agent mapping for HTTP-01 challenge verification.
9. Now, click the **Pending** button on the domain challenge verification page and click Verify. The challenge will be verified, and a certificate request will be submitted to GTS CA.

**Note:** Agent mapping is a one-time configuration and Key Manager Plus automatically handles the verification of challenges through GTS CA.

### 3.2 Domain Validation through DNS-01 Challenge Verification

Follow these steps to validate your domain using a DNS-01 challenge:

1. Navigate to the **Integrations >> ACME Integrations >> Google Trust Services** tab and click on the request status (Pending) corresponding to the certificate request. You will be redirected to a window that displays the DNS challenge value and the TXT record.
2. If you have already configured your DNS account details and have opted for DNS while creating the certificate request, the selected DNS account will be assigned to the request.
3. If you have not selected the DNS account during certificate request, select the certificate order from the list, click **More** in the top menu, choose Assign DNS, and select the required DNS account.
4. Key Manager Plus provides an option for automating DNS-01 challenge verification through agent mapping, which you can use if you do not have a configured global DNS account or opted out of it while raising the certificate request.
5. On the domain challenge verification page, click the **Agent Mapping** icon for the DNS-01 challenge to complete the agent mapping for certificate deployment (Agent mapping is a one-time configuration).
6. In the **Deploy** window that opens, specify the following information to map and save your end-server details in Key Manager Plus.

   1. **Challenge Type** - The challenge type will be auto-selected depending on the DNS challenge you accepted.
   2. **Domain Name** - Check if the correct domain name is selected in this field.
   3. **DNS Provider** - Select the desired DNS provider from the drop-down field and specify the required credentials.
   4. Enable the **Deploy Certificate** checkbox to automate certificate deployment to their corresponding end-servers after domain validation and successive renewals.

      ![google-trust-services-6](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-6.png)

   5. For Linux end-servers, provide the required details, and for Windows end-servers, download and install the Key Manager Plus Windows agent using the same procedure as mentioned for the HTTP-01 challenge.
   6. After entering the necessary deployment details for the domain, click **Save**. The end-server details are successfully mapped and stored in Key Manager Plus, which you can view or edit by navigating to **Integrations >> ACME Integrations >> Google Trust Services >> Manage >> Deploy**.

**Notes:**

- You can request and acquire certificates only for public domains using the GTS integration.
- The handling of challenges can be performed manually without automation. Copy and paste the challenge values/text records manually into your domain server. Then, in the Key Manager Plus server, navigate to the **Pending Requests** page and click **Verify**. The challenge will be verified, and a certificate will be issued.
- Key Manager Plus automates challenge verification using a global DNS account for a certificate request only when Agent mapping is not configured already. To validate the domain through challenge and deploy the certificate, opt for agent mapping.
- Currently, Key Manager Plus agents are only available for Windows servers.
- For RFC2136 DNS update, if you have opted for Global DNS configuration, the domain name itself acts as the zone name (Global DNS configuration is possible only if you are using the same key secret for all zones). Whereas, if you have opted for domain-agent mapping, you should provide the **Zone Name, Key Name**, and **Key Secret** for each domain separately.

## 4. Procuring and Saving Certificates

Follow these steps to procure and save a certificate to the Key Manager Plus repository:

1. On successful verification, GTS issues the requested certificate.
2. The window automatically redirects to a page that displays the certificate and its status. The status is marked **Saved** if the challenge verification is successful, and **Failed** if the challenge verification fails.
3. If the challenge fails, click the **New challenge** button to obtain another set of challenges and repeat the above process.

Upon successful challenge verification, the certificate is added to the Key Manager Plus repository, which can be viewed from the **SSL >> Certificates** tab.

## 5. Renewing Certificates

Certificates issued by GTS have a lifetime of ninety days, after which they are not valid. The domain authentication validity period is sixty days, i.e., the user should fulfill the challenge verification once every sixty days to prove their ownership of the domain. Certificate renewals can be carried out manually or automatically through automatic domain validation.

### 5.1 Certificate Renewal

Follow these steps to renew a certificate:

1. Navigate to **Integrations** >> **ACME Integrations** >> **Google Trust Services**.
2. Select the certificate you want to renew and click **Renew Certificate** in the top menu.

   ![google-trust-services-7](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-7.png)

Once the renewal is complete, the certificate status will be displayed as **Saved** in the **Certificate Status** bar. The renewed version of the certificate will be available in the SSL tab.

### 5.2 Automated Certificate Renewal

Follow these steps to configure the auto-renewal process for the desired certificates:

1. Navigate to **Integrations >> ACME Integrations >> Google Trust Services >> Manage** and click the **Auto-Renewal** button in the top pane.
2. On the page that appears, enable the **Auto-Renew** toggle switch.

   ![google-trust-services-8](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-8.png)

3. Specify the **Recurrence Time** for the auto-renewal of certificates. This is a global setting, and any changes apply to all enabled third-party CA auto-renewal configurations.
4. Enter the number of days before expiry, when the auto-renewal process should be carried out in the respective field.
5. Select the desired certificates you want to auto-renew and click **Save**.

Based on the configured details, the auto-renewal process will be carried out. Click the **Auto-Renewal Audit** to get insights about the certificates renewed through the auto-renewal process. Upon successful auto-renewal, the certificate will be automatically deployed to the respective server based on the system-defined schedule interval. You can view the deployment status for each server in the **Auto-Deployment Audit** section.

![google-trust-services-9](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/google-trust-services-9.png)

### 5.3 Certificate Renewals through Automatic Domain Validation

If agent mapping is configured, the certificate renewal process will be performed automatically without manual intervention. All the certificates in your organization procured from GTS CA are automatically renewed every 75 days, i.e., 15 days before its expiry, and a notification is sent to the account holder's e-mail address.

**Note:** Automatic renewals are applicable only for those certificates saved in the Key Manager Plus repository. i.e., after procuring a certificate from GTS CA, you should save it for the auto-renewal process to take effect.

## 6. Revoking Certificates

Revoking a certificate renders the certificate invalid, and the deployed server or website will no longer support HTTPS communication. Follow these steps to revoke a certificate:

1. Navigate to **Integrations >> ACME Integrations >> Google Trust Services**.
2. Select the certificate you want to revoke and click **Revoke Certificate**. The selected certificate will be revoked and will no longer be valid.

## 7. Deleting Certificates

Deleting a certificate will remove it from the Key Manager Plus repository, but the certificate will remain valid. Follow these steps to delete a certificate:

1. Navigate to **Integrations >> ACME Integrations >> Google Trust Services**.
2. Select the certificate you want to delete and click **More >> Delete**. The certificate will be deleted from the Key Manager Plus repository.