How-To: Assign Domain Ownership for Certificate Management

EZCA enables full accountability for certificate ownership by assigning owners to each domain registered in EZCA. To register a new domain follow these steps.

Prerequisites

  1. The Keytos application is registered in your tenant
  2. You have an active EZCA plan
  3. You have a Root CA
  4. (optional) You have an Issuing CA

How To Assign Domain Ownership for SSL Certificate Management - Video Version

Overview - How To Distribute SSL Certificate Responsibilities Across Your Organization

To help you run your PKI at scale, domain owners must be set in order to request SSL Certificates. This enables PKI administrators to keep a record of domain ownership, while allowing domain owners to manage approved users or applications that can request certificates for that domain.

How to Register a Domain in EZCA

A domain must be registered in EZCA before SSL certificates can be requested for that domain. Follow these steps to register a domain:

  1. Go to your EZCA portal, such as https://portal.ezca.io.

  2. From the left-hand menu, navigate to My Domains.

  3. Click Register Domain.

    EZCA Cloud PKI My Domains page listing registered domains with Register Domain button highlighted

  4. From the Issuing CA dropdown, select the CA that will issue certificates for this domain.

    EZCA Cloud PKI Register New Domain form with Issuing CA dropdown highlighted showing Internal SSL Certs selected

  5. In the Domain field, enter the domain name or IP address you want to register, such as app.example.com.

    EZCA Cloud PKI Register New Domain form with Domain field highlighted and filled in as 'app.example.com'

  6. Under Domain Owners, search for and add the users or groups who are responsible for this domain. Domain Owners can change the domain and manage who can request certificates for it, but they can’t request certificates themselves unless you also add them in one of the next two fields. Applications can’t be Domain Owners.

    EZCA Cloud PKI Register New Domain form with Domain Owners field highlighted and the PKI Admins group added

  7. Under Domain Certificate Administrators, search for and add the users, groups, or service principals that can request and revoke certificates for this domain. You must add at least one.

    EZCA Cloud PKI Register New Domain form with Domain Certificate Administrators field highlighted and a service principal added

  8. (optional) Under Domain Requesters, add the users, groups, or service principals that can request certificates for this domain but can’t revoke them.

  9. Click Register Domain.

    EZCA Cloud PKI Register New Domain form with Register Domain button highlighted to complete domain registration

Now that the domain is registered, create your first certificate.

How Does Domain Registration Approval Work?

If domain registration approval is set in CA, a domain creation request will be sent to the approvers for them to approve. Dual key approval is enforced, meaning that if you are an approver, someone else will have to approve your request.

Additional Guides

How-To: Restore Access to an Orphaned Domain

If a domain owner leaves your organization without transferring domain ownership, the domain becomes orphaned. This guide provides steps to restore access to an orphaned domain in EZCA.