Creating a SecureW2 connector¶

This topic explains how to set up a SecureW2 certificate authority (CA) connector in Certificate Manager - SaaS using the Venafi CA Connector Framework. The connector issues, revokes, and imports certificates through your SecureW2 JoinNow Dynamic PKI. It runs directly in Certificate Manager - SaaS and calls the SecureW2 API over the internet, so you don't need a VSatellite.

Before you begin¶

Before you set up the CA connector:

• You must have the Superuser role in Certificate Manager - SaaS to create CA connectors.
• Your SecureW2 connector must already be deployed to Certificate Manager - SaaS using the Dev Central API. It won't appear in the Certificate Authority Type list until it has been deployed.

As a SecureW2 administrator, prepare the following in the JoinNow Management Portal.

1. Create a Certificate Management API token.

   1. Go to Integrations Hub > Device Management Platforms, and click Add.

   2. Enter a Name and Description, set Type to REST API Certificate Management Token, and click Save.

      A CSV file that contains the API Secret and the Enrollment URL downloads. It downloads only once, so store it securely. You need both values when you create the CA connector.

2. Create a certificate template under Dynamic PKI > Certificate Authorities > Certificate Templates.

   • Map the subject and the subject alternative names (SANs) from the certificate signing request (CSR), for example Subject CN=${/csr/subject/commonname} and SAN > DNS ${/csr/san/dnsname}. Use only /csr/... paths. The /device/... paths shown in the SecureW2 guide make requests from Certificate Manager - SaaS fail.
   • Set the Validity Period here. SecureW2 ignores the validity requested by Certificate Manager - SaaS.
   • Add Server Authentication to Extended Key Usage. The default is Client Authentication only.
   • Click Update to save the template. Changes don't take effect until you do.
3. Create a policy workflow under Policy Management > Policy Workflows. Set Conditions > Core Provider to the API token, click Update, and move the workflow above the default workflows.
4. Create an enrollment policy under Policy Management > Enrollment.
   • Under Conditions, set Role to the policy workflow, and select at least one Device Role.
   • Under Settings, select the issuing CA in Use Certificate Authority and the certificate template in Use Certificate Template. Set Revoke Certificate to Never, so that Certificate Manager - SaaS controls revocation.
   • Click Update, and move the policy above DEFAULT ENROLLMENT POLICY 1. Policies are evaluated from the top down, so if it isn't on top, the default policy handles requests.

Create a SecureW2 CA connector in Certificate Manager - SaaS¶

Before you complete these steps, review Create a custom CA connector, including the prerequisites and notes.

1. Sign in to Certificate Manager - SaaS.

2. Click Integrations > Certificate Authorities.

3. Click New > Add Certificate Authority connector.

4. Under Connection, add the following.

   1. Enter a Name for the CA connector to use as its display name.

   2. Select SecureW2 as the Certificate Authority Type.

      Note

      Your custom CA won't appear in this list until you have deployed your custom CA connector using the Dev Central API.

   3. Click Next.

5. Under Information, add the connection details for your SecureW2 organization.

   1. Enter the Server URL.

      This is the base URL of the SecureW2 API. The default is https://api.securew2.com.

   2. Enter the Enrollment ID.

      This is the last part of the Enrollment URL in the CSV file you downloaded when you created the API token. The URL ends in /v1/enroll/<enrollment ID>. The value is a UUID.

   3. Enter the API Token.

      This is the API Secret from the same CSV file.

      Warning

      Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

   4. Click Test Connection.

      If the connection isn't successful, resolve all issues and ensure you have a successful connection before continuing.

   5. Click Next.

6. Under Issuance, set the following options.

   1. In Product Options, select Default Product.

      This is the only product. The issuing CA, certificate template, signature algorithm, and validity are all set by the SecureW2 enrollment policy, so there's nothing else to select.

   2. Click Next.

7. (Optional) Under Import, set the following options to configure certificate import.

   1. In Import options, select Default Product.

      This option covers every certificate issued through the enrollment policy this CA connector is configured for.

   2. To import certificates whose validity has already ended, turn on Include expired certificates. This option is off by default.

   3. To import certificates that have been revoked at SecureW2, turn on Include revoked certificates. This option is off by default.
   4. To schedule certificate import, enable Scheduled import and choose a schedule.

8. Click Create. The new SecureW2 CA appears on the Certificate Authorities page.

What to expect from SecureW2¶

• Validity comes from the certificate template. SecureW2 ignores the validity set on the request policy.
• Certificates are issued immediately. There's no pending state.
• Issued and imported certificates don't include a chain. SecureW2 returns only the end-entity certificate.
• The revocation reason isn't sent. SecureW2 revokes by serial number only, so the reason you select in Certificate Manager - SaaS isn't recorded at SecureW2.
• Only TLS certificates are supported.
• Every import reads every matching certificate. SecureW2 doesn't return certificates in a stable order, so each import, including scheduled imports, collects all of them to pick up new certificates and status changes. On organizations with many certificates, every import can take a while.

What's next?¶

This CA is now ready to be added to one or more request policies. To do this, select this CA when creating request policies.

Related Links¶

• CA Connector overview
• Creating a custom CA connector
• Custom CAs in the CA inventory