Creating a Tucows OpenSRS connector¶

This topic explains how to set up a Tucows OpenSRS certificate authority (CA) connector in Certificate Manager - SaaS using the Venafi CA Connector Framework. OpenSRS isn't a CA itself. It's a reseller that fronts several CAs, such as Sectigo, DigiCert, GeoTrust, Thawte, and Actalis, so one connector gives you DV, OV, and EV products from all of the CAs enabled on your reseller account. The connector issues and imports certificates through the OpenSRS reseller API.

Before you begin¶

Before you set up the CA connector:

• You must have the Superuser role in Certificate Manager - SaaS to create CA connectors.
• Your Tucows OpenSRS connector must already be deployed to Certificate Manager - SaaS using the Dev Central API. It won't appear in the Certificate Authority Type list until it has been deployed.

As an OpenSRS reseller administrator, prepare the following in the OpenSRS Reseller Control Panel:

• A reseller account with SSL certificate management enabled, including permission to query, order, and revoke certificates.
• The reseller account username.
• The account API key. Go to Account Settings (the gear icon) > API settings, and copy the API key.

Create a Tucows OpenSRS CA connector in Certificate Manager - SaaS¶

Before you complete these steps, review Create a custom CA connector, including the prerequisites and notes.

1. Sign in to Certificate Manager - SaaS.

2. Click Integrations > Certificate Authorities.

3. Click New > Add Certificate Authority connector.

4. Under Connection, add the following.

   1. Enter a Name for the CA connector to use as its display name.

   2. Select Tucows OpenSRS (Preview) as the Certificate Authority Type.

      Note

      Your custom CA won't appear in this list until you have deployed your custom CA connector using the Dev Central API.

   3. Click Next.

5. Under Information, add the connection details for your OpenSRS account.

   1. Enter the Username of your OpenSRS reseller account.

   2. Enter the Base URL of the OpenSRS API.

      Use https://rr-n1-tor.opensrs.net:55443 for production, or https://horizon.opensrs.net:55443 for the OpenSRS test environment. OpenSRS uses port 55443.

   3. Enter the API Key of your OpenSRS account.

      Warning

      Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

   4. Click Test Connection.

      If the connection isn't successful, resolve all issues and ensure you have a successful connection before continuing.

   5. Click Next.

6. Under Issuance, set the following options.

   1. In Product Options, select the products you want to make available to request policies.

      The list shows the SSL products that are enabled on your OpenSRS reseller account. We recommend that you select every product you might want to use. You can restrict which products are available when you create the request policy.

   2. Click Next.

7. (Optional) Under Import, set the following options to configure certificate import.

   1. In Import options, select Import.

      OpenSRS offers a single import option, which covers every SSL certificate on your reseller account.

   2. To import certificates whose validity has already ended, turn on Include Expired Certificates. This option is off by default.

   3. To import certificates that have been revoked, turn on Include Revoked Certificates. This option is off by default.
   4. To schedule certificate import, enable Scheduled import and choose a schedule.

8. Click Create. The new Tucows OpenSRS CA appears on the Certificate Authorities page.

Set the issuance options on your request policy¶

The Tucows OpenSRS connector adds applicant and contact fields to every request policy that uses this CA connector. Which ones you must fill in depends on the validation type of the product you select:

The other contact fields, such as Title, the address fields, Country (a two-letter code, such as US), Phone (in international format, such as +1.4165550123), Fax, and Email, are optional.

For the remaining settings, see Create a request policy.

What to expect from Tucows OpenSRS¶

• Issuance is asynchronous. OpenSRS returns an order first, and the certificate is issued after domain validation completes. A request stays pending until then.
• DV products are validated by email. OpenSRS sends the domain validation request to the Approver Email on the request policy. The approver must act on it before the certificate is issued.
• Revocation can only cancel an order that hasn't completed. The OpenSRS API has no way to revoke an issued certificate, so revoking an issued certificate from Certificate Manager - SaaS fails. Revocation also works only for certificates that were issued through this CA connector.
• Renewal reissues against the existing order. Renewing a certificate submits a new CSR against its existing OpenSRS order instead of placing a new order.
• The product list is fixed. The connector offers a built-in list of OpenSRS SSL products, filtered to the ones enabled on your account. A product that OpenSRS adds later doesn't appear until the connector is updated.
• The first import can take a while. Certificate Manager - SaaS walks your whole reseller portfolio by expiry date. Large accounts are imported across several runs, and later imports pick up only newly issued certificates.

Troubleshooting¶

What's next?¶

This CA is now ready to be added to one or more request policies. To do this, select this CA when creating request policies.

Related Links¶

• CA Connector overview
• Creating a custom CA connector
• Custom CAs in the CA inventory
• Create a request policy