Skip to content

Provision a certificate to a Cloud Keystore

Before you begin

  • You need to add a cloud provider first. If you still need to do this, see the following integrations page and choose the appropriate cloud provider Welcome to integrations.

  1. Click the more-options button to the right of the new cloud keystore you just created and select Provision.

    Tip

    Here you also have the option to delete certificates if needed.

  2. From the dropdown, search for the certificate you want, select it, and click Provision. This creates a new certificate (new installation on the keystore).

  3. (Optional) Here, you also can re-provision, replace, or delete a certificate. These options modify an existing machine installation.

    • Select your Cloud Keystore, and a details panel will appear on the right.
    • Click on the ellipsis button to the right of your certificate.
    • Choose the appropriate action: Re-provision, Replace, or Delete, and proceed through the user interface steps until the process is complete.

    Info

    • Re-provision - This action re-provisions your current certificate.
    • Replace - Choose this option to substitute your current certificate with a different one.
    • Delete - This action removes the selected certificate from the table.

    Note

    If using Google Cloud Platform, go to your Google service account, under Certificate Manager, and select Certificates. Click the Refresh button. You should now see your certificate in the list with an active status.

At this point you have successfully connected Certificate Manager - SaaS to your cloud provider and successfully provisioned a certificate.

Control which service accounts can provision to a cloud keystore

By default, any service account with the Certificate Issuance scope can provision certificates to any cloud keystore in your tenant. You can limit a cloud keystore to specific service accounts. This works like Authorized Teams does for users.

Each cloud keystore has two settings:

  • All Service Accounts Access: When this setting is on, any service account with the Certificate Issuance scope can provision to the cloud keystore. It's on by default for new and existing cloud keystores.
  • Authorized Service Accounts: Appears when All Service Accounts Access is off. Only the service accounts you select can provision to the cloud keystore. If you leave the list empty, no service account can.

These settings apply when a service account provisions, re-provisions, or replaces a certificate on the cloud keystore. Changes take effect immediately.

To change service account access on a cloud keystore

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Cloud Keystores.
  3. Click the cloud keystore, and then click the Properties tab.
  4. Turn All Service Accounts Access on or off. If you turn it off, select the service accounts that can provision in Authorized Service Accounts.
  5. Click Save.

Note

  • Only enabled service accounts appear in Authorized Service Accounts.
  • Select service accounts that have the Certificate Issuance scope. Service accounts without this scope can't provision to cloud keystores.
  • When you turn on All Service Accounts Access, the Authorized Service Accounts list is cleared.

Who can change service account access

Anyone who can edit the cloud keystore can change these settings. That includes System Administrators and PKI Administrators. It also includes Resource Owners who belong to the cloud keystore's Owning Team and to one of the cloud provider's teams.

Track changes in the Event Log

The Event Log records these events:

  • Cloud Keystore Service Account Access Set: A user creates a cloud keystore. The event shows which service accounts can provision to it.
  • Cloud Keystore Service Account Access Changed: A user changes service account access. The event shows the access before and after the change.
  • Cloud Keystore Service Account Access Denied: A user tries to authorize a service account that doesn't exist. The change isn't saved.
  • Cloud Keystore Provisioning Denied: Someone who isn't authorized tries to provision a certificate to the cloud keystore. This includes a service account that isn't in Authorized Service Accounts.

Use the API

The createCloudKeystore and updateCloudKeystore GraphQL mutations accept two fields:

  • allServiceAccountsAccess: true or false. If you leave it out when you create a cloud keystore, it's set to true.
  • authorizedServiceAccounts: a list of service account IDs. To get the IDs, use the Service Account API endpoint.

When you update a cloud keystore, any field you leave out keeps its current value. To clear the list, send an empty list ([]). Setting allServiceAccountsAccess to true doesn't clear authorizedServiceAccounts. The list is ignored while allServiceAccountsAccess is true, and it applies again if you set it back to false.

Troubleshooting

  • A service account can't provision to a cloud keystore: The request fails with "Forbidden. User has no access to the resource". Add the service account to Authorized Service Accounts, or turn on All Service Accounts Access. Also check that the service account has the Certificate Issuance scope.
  • Saving fails with "One or more of the provided Authorized Service Accounts are not valid": The list includes a service account that no longer exists. Remove it and save again.
  • A service account is missing from the list: Only enabled service accounts appear in the list. Enable the service account first.