This document provides information on how to integrate with a Let's Encrypt certificate authority. For more information about the Let's Encrypt certificate authority fields, see Certificate authorities.
Integrate with a Let's Encrypt CA
- On Segura™, in the navigation bar, hover over the Products menu and select Certificate Manager.
- In the side menu, select Management > Authorities > Certificate authorities.
- In the top right corner, click Add, and select Let's Encrypt.
- In the Name * field, enter a name to identify the CA.
- Select the button Status to activate or deactivate the CA.
- In the Use Network Connector? field, select Yes or No. The default is Yes.
- If the value of the Use Network Connector? field is Yes, in the Network Connector field, select the Network Connector to be used. Leave it empty to use the default Network Connector.
- In the Emails (comma separated) * field, enter the email address used to register the Let's Encrypt account.
- In the Private key password field, enter the Let's Encrypt password.
- If applicable, tick the Use existing account checkbox to use an existing account.
- In the Private key field, enter the private key. This field will only be available if the checkbox Use existing account is ticked.
- In the Public key field, enter the public key. This field will only be available if the checkbox Use existing account is ticked.
- Click Save.
Network Connector behavior
When Use Network Connector? is set to No, the CA does not show any Network Connector information when you request a certificate, and it communicates with Let's Encrypt directly.
When Use Network Connector? is set to Yes, the certificate request shows Uses Network Connector: <agent> next to Choose CA: the name of the connector you selected, or default connector if you left the Network Connector field empty. The following traffic routes through that connector:
- The communication with the Let's Encrypt API, including certificate revocation.
- For file validation (http-01), the upload of the domain-validation file to the web server over SFTP, FTP, or FTPS.
- For DNS validation (dns-01), the lookup of the DNS TXT record.
Before Let's Encrypt validates the domain, Segura® checks the published validation file over HTTPS directly from the Segura® appliance, without the Network Connector.
If the Network Connector agent is unreachable, the tunnel fails, or no agent and no default connector are available, Segura® never falls back to a direct connection:
- Signing: the certificate request stays in Waiting signature status with the reason, and Segura® retries it on the next execution.
- Revocation: the revocation ends in error.
Through a Network Connector, FTP uploads use the agent's SOCKS5 proxy in passive mode. If the FTP server does not accept passive mode (PASV), the validation fails with a message saying that passive mode is required. FTPS uploads do not verify the FTP server's certificate.
Rate limits
Let's Encrypt limits issuance to 50 certificates per registered domain every 7 days. When the limit is reached, Segura® processes the request again after the wait time that Let's Encrypt returns.
The Uses Network Connector: <agent> text and the Validation type field both appear on the certificate-request screen. See How to sign a request.