Acquire & Register a Digital Certificate
Add a certificate to your account to increase security and reliability.
Certificate Manager are essential to provide your infrastructure with reliability and compliance with data protection regulations. At Azion, you have several options to secure your domains with TLS certificates. Aside from registering a certificate and private key that you already own, you can also request a Let’s Encrypt certificate for your domain.
If you don’t own a certificate, you can issue a request through Azion and submit it to a certificate authority. This guide will describe how you can generate a Certificate Singing Request (CSR) through Azion.
A CSR is an encrypted request to a Certificate Authority (CA) for issuance of a digital certificate. You can provide Azion with your business details to automatically generate the CSR for you. After it’s created, you can submit it to any CA of your choosing. They’ll review your request and, if approved, issue an authenticated certificate. You then use the certificate provided by the CA to register it with Azion and associate it with a domain.
Step 1. Create a Certificate Singing Request (CSR)
- Access Azion Console > Certificate Manager.
- Click the + Digital Certificate button.
- Give your CSR an easy-to-remember name.
- Select the option Request a certificate.
- Fill in the requested information.
- Subject Name: the apex domain address that will be bound to the certificate. Example:
domain.org. - Country/Region: the two-letter country code of where your organization is based. Example:
BRfor Brazil. - State/Province: the state or province where your organization is based. Example:
Distrito Federal. - City/Locality: the city or county where your organization is based. Example:
Brasília. - Organization: your organization’s name. Example:
Company Name Inc. - Organization Unit: the department or body responsible for managing the certificate. Example:
IT Department. - Email: the email of the body responsible for managing the certificate. Example:
it@companyinc.org. - Private Key Type: the type of private key generated. Azion currently only works with RSA 2048 encryption.
- Subject Alternative Names (SAN): list of other names or records to be associated with the certificate as SANs. Separate each SAN by a new line. Example:
domain.net.
- Click the Save button.
- Copy the value in the Certificate Singing Request (CSR) field.
- Run the following
POSTrequest in your terminal, replacing[TOKEN VALUE]with your personal token and the placeholders in the body with the desired values:
| Key | Description |
|---|---|
name | Name of the CSR |
common_name | Accepts a string that should contain the apex domain address that’ll be bound to the certificate |
country | Accepts a two-character string that should contain the country code of where your organization is based |
state | Accepts a string that should contain the state or province where your organization is based |
locality | Accepts a string that should contain the city or county where your organization is based |
organization | Accepts a string that should contain your organization’s name |
organization unit | Accepts a string that should contain the department or body responsible for managing the certificate |
email | Accepts a string that should contain the email of the body responsible for managing the certificate |
private_key_type | Enum that should contain the type of private key generated. Accepts only the value rsa_2048 |
sans | Accepts an array. List of other names or records to be associated with the certificate as SANs. Optional |
- You’ll receive a response similar to this:
| Key | Description |
|---|---|
id | Digital certificate ID |
issuer | Stores the information on the CA that’ll issue the certificate |
subject_name | Array that lists the records associated with the certificate and confirmed by the CA |
validity | Expiration date of the certificate |
status | Enum that indicates the status of the certificate. Returns Pending when the certificate hasn’t yet been generated by the CA. Returns Active when the certificate has been registered with Azion |
certificate_type | Enum that indicates the type of the certificate. CSR certificates are assigned the value edge_certificates |
managed | Boolean that flags whether the certificate is managed by Azion’s certificate tool. Not applicable to CSR certificates |
azion_information | String that updates the status of certificates managed by Azion’s certificate tool. Not applicable to CSR certificates |
csr | String that holds the certificate signing request to be submitted to a CA for issuance. Includes the escape sequence \n that may require conversion to a line feed upon submission to a CA |
certificate_content | Key that should be updated via PATCH with the certificate generated by the CA |
- Copy and store the CSR value in the
csrproperty.
Step 2. Submit the CSR to a Certificate Authority
Once you’ve generated your CSR with Azion, the next step is to submit it to a Certificate Authority (CA). This can usually be done online. You’ll need to begin by choosing a CA that suits the needs and standards of your organization. Some popular choices are:
Whichever CA you choose will validate the information in the CSR generated against an agreed standard. Once validated, the CA will issue a TLS certificate for your application, which can then be registered to Azion and associated with a domain.
Step 3. Register the issued certificate with Azion
Once you receive a certificate issued by your CA, you must associate it with the CSR entry you created. After your certificate is active with Azion, you may associate the certificate to a domain.
- Access Azion Console > Certificate Manager.
- Select the CSR you created.
- Paste the certificate code, including the begin and end tags, into the Certificate field.
- Click the Save button.
- Run the following
PATCHrequest in your terminal, replacing[TOKEN VALUE]with your personal token, the<digital_certificate_id>with the ID you got in the previous response and the certificate in thecertificate_contentkey:
- You should receive a response with the updated value and the
Activestatus: