Docs ACME client configuration

ACME client configuration

ACME clients generally need two pieces of information to connect to CertFu:

  • the CertFu Directory URL
  • an Account key

The Directory URL can be found at Directories -> [directory] -> Directory and will be the same for all clients using this directory.

Account keys are a public/private keypair and function like an access key specific to that client. There are several ways to create and provision the Account key, each of which are outlined below.

For clients that support it, an EAB token is usually the right combination of easy and secure.

When EAB tokens aren’t supported, for some other automated provisioning scenarios, and to import existing keys as part of a migration, pre-creating the Account key may be preferable.

Lastly, it’s possible to enable open registration, which allows clients to self-register without needing an EAB token. This can easily be abused, such as by creating large quantities of orders and certs. See the Directory Registration mode setting for more.

With an EAB token

  1. Create an EAB token for each client.
    Go to Directories -> [directory] -> EAB tokens -> Add token.
    Upon Save, the EAB token will be shown here and is needed for the next step.
  2. Configure the client with the Directory URL and the EAB token from step 1.
  3. Some clients may need to be instructed to convert the EAB token into an Account key. Others will do it automatically at launch or upon first use.

With a pre-created Account key

Creating the Account key from CertFu
  1. Create an Account key for each client.
    Go to Directories -> [directory] -> Account keys -> Add Account key.
    Leave Public key blank in this case.
    Upon Save, the Private key will be shown here and is needed for the next step.
  2. Configure the client with the Directory URL and the Private key from step 1.
Creating the Account key from the client

This may also be used to import existing Account keys during a migration to CertFu. However, if practical, it’s preferred to issue new Account keys instead.

  1. Configure the client with the Directory URL.
  2. Create a keypair on the client. This may be a manual process or the client may have a facility to do it for you.
  3. Import the keypair’s public key into an Account key for that client.
    Go to Directories -> [directory] -> Account keys -> Add Account key.
    Copy the keypair’s public key into the Public key field.

With open registration

  1. Configure the client with the Directory URL.
  2. Most clients will auto-register a new Account key. A few clients may require manually initiating this process.