/
(DC) BeyondTrust (ACME Setup)

(DC) BeyondTrust (ACME Setup)

This guide describes configuring the built-in ACME client in BeyondTrust Remote Support to request a TLS certificate using UT's CERTInext service.
Screens and menu labels may vary by appliance release.

Prerequisites

  • Administrator access to the BeyondTrust appliance security settings.

  • A CERTInext Account

  • Authorized External Account Binding (EAB) credentials (explanation found below)

  • The FQDN or hostname for the Beyond Trust appliance. The BeyondTrust interface notes that the hostname must resolve to the appliance.

  • Authorization to request and issue a certificate for the above FQDN/hostname.

CERTINext Account

Your team or yourself must have access to the CERTInext dashboard utilizing a CERTInext account.

  1. Visit: Login | CERTInext

  2. When successfully logged in, your should be at the CERTInext Dashboard (https://us.certinext.io/dashboard)

    certinext_dashboard.png

ACME (or EAB) Credentials

  1. Expand “Integrations” and click “cogs.png APIs”.

  2. In the upper-right, click create_api_credentials.png button.

  3. Fill out the form:

    • API Type: ACME

    • CA Connector: emSign

    • Identifier: A name for the credential. Recommend you use OV, DV, OV_wildcard, or DV_wildcard, based on the profile you will select below.

    • User: Any user will work. We recommend that you have a user created that is a service account, not tied to a person, and use that account.

    • Group: Should only be one, but if more than one, choose the correct one.

    • Product: Choose one of the following,

      • If you are requesting certificates where the domain ends in *.utexas.edu, choose “InCommon OV SSL Certificate UCC”.

      • If you are requesting wildcard certificates that end in *.utexas.edu, choose “InCommon OV SSL Certificate Wildcard UCC”.

      • If you are requesting certificates where the domain is NOT *.utexas.edu, chose “InCommon DV SSL Certificate UCC”

      • If you are requesting wildcard certificates where the domain is NOT *.utexas.edu, choose “InCommon DV SSL Certificate Wildcard UCC

    • Organizations: Should only be one, but if more than one, choose the correct one.

  4. Click generate_button.png button. Wait for the screen to refresh, and your newly minted ACME account will appear.

  5. Click “View” link to expose your ACME credentials. You need only the URL, Key ID, and Mac Key.

A single ACME account can create certificates that are either OV, DV, OV Wildcard, or DV Wildcard. Create separate accounts for each time of certificate that you may need to generate.

 

Setting up the BeyondTrust Appliance

Follow these steps to register a new acme server within the BeyondTrust appliance with the CERTInext ACME account.

Register/Create ACME server (Other)

  1. Sign in to the BeyondTrust appliance administrative interface and navigate to the Security certificate/ACME configuration area.

    register new acme server.png

  2. Click the button register new acme server_button.png.

  3. Add an ACME server and select Other for the provider.

  4. Enter the organization's CERTInext directory URL: https://acme-us.certinext.io/v1/directory.

  5. Supply the assigned EAB credentials in the fields presented by the appliance. Do not record or paste EAB secrets into this wiki.

  6. Save/register the server. Confirm that the ACME Server section shows Other and the expected directory URL.

Request a certificate for an FQDN

  1. Under ACME Server :: Other, locate Request New Certificate.

  2. In Hostname, enter the complete DNS name, for example support.its.utexas.edu.

  3. Select an appropriate key algorithm/size; the example screenshot shows RSA-4096.

  4. Select Request. Check the appliance for the issuance result and any validation errors.

  5. Under Security :: Other Certificates, inspect the resulting certificate's subject, issuer, expiration date, and alternative names. Confirm that the intended certificate is selected for the appropriate appliance service before considering the deployment complete.

Screenshot: request interface and existing certificate

The example screenshot supplied for this guide shows the custom CERTInext directory, the single Hostname field, RSA-4096 selection, and an existing certificate listing with two DNS alternative names. The screenshot is illustrative; it does not demonstrate that a multi-SAN certificate was issued through this ACME form.

Screenshot status: The supplied appliance screenshot could not be attached automatically. The vendor references below contain illustrated Security/Certificates interfaces; screenshots from older product versions may differ.

BeyondTrust illustrated Security page: registering an ACME server, EAB fields, and certificate management

BeyondTrust Remote Support B Series Appliance Interface PDF: certificate-request screen examples (older interface)

Open question: certificates with multiple SANs

Status: Unknown / pending BeyondTrust Support response (October 2026). The built-in request form exposes only one Hostname field. We have not confirmed a supported method for requesting or automatically renewing a certificate with additional DNS Subject Alternative Names (SANs), or whether an existing certificate's SANs are preserved on renewal.

Example requirement: support.its.utexas.edu plus user-bot-s01.its.utexas.edu. The currently installed certificate displays both DNS names, but this does not establish the behavior of the built-in ACME client. Do not assume renewal will preserve both names; do not replace a production multi-SAN certificate without verifying the result. A BeyondTrust support request has been submitted to clarify this behavior. Update this section once vendor guidance is received.

References and support

Last reviewed: October 15, 2026. Validate product-version-specific details against vendor guidance before production changes.