Sign a certificate with GlobalSign

This document provides information on how to sign an OV or EV certificate with GlobalSign in the Segura® Platform, using GlobalSign's Managed SSL (MSSL) API, from the creation of the certificate authority until the revocation of the certificate.

Requirements

• A GlobalSign account enrolled in Managed SSL (MSSL), with an MSSL profile.
• An organization with a phone number and a complete address. For EV certificates, the organization also needs a trade name, a business category, and a CNPJ.
• Optional: the domains to be certified already validated in your MSSL profile. This is the fastest path. Otherwise, Segura® adds the domain to the profile and the request waits for domain validation. See Validate the domain.

Create a certificate authority in the Segura® Platform

For information on how to create a GlobalSign CA in the Segura® Platform, see How to integrate with a GlobalSign CA.

In the Type * field, select Managed MSSL. Without it, the MSSL flow does not run.

Create an organization in the Segura® Platform

For information on how to create an organization in the Segura® Platform, see How to configure organizations.

Fill in the organization's phone number and complete address. For EV certificates, also fill in the trade name, business category, and CNPJ.

Generate a Certificate Signing Request (CSR)

1. On Segura® Platform, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Requests > SSL/TLS.
3. In the top right corner, click Add.
4. Enter the following certificate information:
   1. Certificate type *: Select OV SSL - Organization SSL, or the EV option for an EV certificate.
   2. Domain type *.
   3. Organizations *: Select the organization created previously.
   4. Common name *: Enter the domain to be protected by the certificate. (For example: www.yourdomain.com).
   5. Expiration (in days) *. GlobalSign MSSL orders always have a 12-month validity, regardless of this value.
   6. Encryption algorithm *: Choose between RSA and DSA.
   7. Encryption key size *: Choose between 4096, 2048, and 1024.
   8. Certificate signature algorithm *: Choose between SHA256, SHA384, and SHA512.
   9. Additional configuration: Select the option to use the previously created CA.
5. Save all configurations.

Sign a CSR

1. On Segura® Platform, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Requests > SSL/TLS.
3. In the desired request, click Actions > Request signature.
   1. In the General tab, enter the system data.
   2. In the Contact tab, enter the contact information for the GlobalSign order.
   3. In the Profile field, select your MSSL profile. This field is required for an MSSL CA, and Segura® validates the profile when it signs the request.
   4. Click Save.

After you request the signature, Segura® checks the domain in your MSSL profile:

• If the domain is already validated, Segura® orders the certificate. The status can pass through Waiting signature before it changes to Signed.
• If the domain is not in the profile, Segura® adds it, and the request waits for domain validation.
• If the domain validation has expired, Segura® renews it, and the request waits for domain validation.

Validate the domain

While the request waits for domain validation, get the validation file from your GlobalSign account and publish it on the web server of the domain, at:

https://<domain>/.well-known/pki-validation/gsdv.txt

HTTP file validation is the only method for MSSL. On the next execution, Segura® asks GlobalSign to verify the domain and continues with the order.

Errors

The signature also fails if you request a DV certificate through an MSSL CA, or if the MSSL profile is not available or cannot be validated.

Renew the certificate

GlobalSign MSSL certificates can be renewed the same way as other certificates in the Segura® Platform. For information on the renewal flow, see About certificate renewal.

Revoke the certificate (if necessary)

1. On Segura® Platform, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Certificates > SSL/TLS.
3. In the desired certificate, click Actions > Revoke certificate.
4. Click Yes to confirm the revocation.
5. A request is sent to GlobalSign and the status of the certificate in the Segura® Platform changes to Revoked.