(DC/SC) Requesting Groups
CERTInext Groups control which users and automated accounts (ACME or REST API) are authorized to request certificates for specific domains. Domains are assigned or permitted to particular Groups, creating a boundary around who can issue certificates for those domains. A logged-in user must have access to the appropriate Group, in addition to the necessary permissions, before they can perform certificate operations against domains controlled by that Group.
This same Group-based control applies to automated certificate issuance. REST API and ACME accounts are associated with authorized Groups, which limits the domains they can request certificates for. This allows CERTInext administrators to delegate certificate management to specific teams or applications without giving them authority to issue certificates for every domain managed by the organization.
When to Request an Account and Group
ISO (security@utexas.edu) is the only group capable of creating groups.
If your department needs to create or issue certificates for a set of UT domains, request an account and access to an appropriate group from ISO. A group may already exist that covers the domains you need, so include the domains or FQDNs you need to manage in your request.
When identifying the domains, choose a scope that reflects the department’s responsibilities. A scope that is too narrow may require several unnecessary groups, while one that is too broad may provide access to domains the department should not manage.
Requesting an Account and/or Group
Always important to perform this task for the end-user, so you can stay informed and answer any follow-up questions from ISO, if any.
Once the account and groups are associated, explain they should be using automation, and refer them to https://cloud.wikis.utexas.edu/wiki/spaces/digitalcertificates/pages/1721073730 to assist with setup and configuration of that automation.
Obtain a list of the various hostnames, FQDNs, and domains that the department or group manages and will want to issue certificates.
Send an email to
security@utexas.edu. Copy the customer on the email.
Explain to the customer you will coordinate the setup and you need to know when they receive and accept the account invitation. Encourage them to store those credentials in 1Password. They do not need to share them with you.Use the following template:
ISO Team:
The department or group group name needs to have an account created for them to create and issue certificates for the following domains:
domain
FQDN
hostname
…
…
There may or may not be a group already associated with these domains, please associate the account with these groups or create a new group.
Please respond back to me (your name) and copy the customer.
Please create invites directly to the customer.
Thank you.
From here you will need to explain to the customer what a group is, what their account is, and how groups are the restricting factor for what domains, FQDNs, and hostnames they can create certificates.
Show them the dashboard and explain what they see. See https://cloud.wikis.utexas.edu/wiki/spaces/digitalcertificates/pages/1598980177.