Link Your UltraDNS Account to DigiCert CertCentral

Overview

This article explains how to link your UltraDNS account to DigiCert CertCentral for automated Domain Control Validation (DCV). DCV confirms control of a domain before a certificate can be issued.

The integration allows CertCentral to manage the DNS TXT records required for validation. After linking the accounts, you must make the required domains visible to CertCentral and import them into CertCentral to start automated validation.

When to Use This Article

• You want to connect UltraDNS to an existing CertCentral account.
• You want CertCentral to automate DNS-based domain validation.
• You need to reset or remove an existing connection.

Before You Begin

• You need an UltraDNS account and a DigiCert CertCentral account.
• Your UltraDNS user must have permission to manage account connections.
• A CertCentral administrator must complete the CertCentral portion of the setup.
• The DigiCert CertCentral Connection feature must be available in UltraDNS, and Integrate with UltraDNS must be enabled in CertCentral.
• Domains used for this automated validation workflow must be delegated to UltraDNS authoritative name servers.

If the connection option is not visible in UltraDNS, contact UltraDNS Support and provide your DigiCert CertCentral Account ID.

If Integrate with UltraDNS is missing from the Automation menu in CertCentral, contact your account manager or DigiCert Support to enable the feature.

CertCentral can connect to one UltraDNS account at a time. Connecting a different UltraDNS account disconnects the existing account and disables automated validation for domains linked to that account.

Start the Connection in UltraDNS

1. Sign in to the UltraDNS portal.
2. Select Accounts, select your account, and open Account Info.
3. Locate DigiCert CertCentral Connection and click Link.
4. In the connection window, use Click to Copy to copy the displayed Account ID and Secret key. Store both values securely.
5. Click Ok, saved after saving the connection details.

The Secret key is entered as the API secret in CertCentral. The secret is displayed only once and cannot be retrieved later. Generating a replacement secret invalidates the previous secret.

If another administrator will complete the CertCentral setup, securely provide that administrator with the connection details.

Complete the Connection in CertCentral

1. Sign in to CertCentral as an administrator.
2. Go to Automation > Integrate with UltraDNS.
3. Under Link account, enter the connection details copied from UltraDNS into UltraDNS Account ID and API secret.
4. Select Link.
5. Return to DigiCert CertCentral Connection in UltraDNS and check the connection status. The UltraDNS Managed Services Portal User Guide describes the status changing from Pending to Established when the connection is complete.

Make Domains Available for Automated Validation

An established account connection does not confirm that a domain has completed validation. Domain visibility and import are separate setup steps.

1. In UltraDNS, select Domains.
2. Locate the domain and turn Visible to CertCentral On.
3. Follow DigiCert's Import domains and automate domain validation instructions to import the domain into CertCentral and assign it to an organization.

DigiCert recommends testing with one domain before importing multiple domains.

To make multiple domains visible in UltraDNS, select the domains, open the Visible to CertCentral menu, and select Enable Visibility.

Expected Outcome

The accounts are connected, and the domains you import into CertCentral are submitted for DNS TXT record validation. Review the domain validation status in CertCentral to confirm the result.

DigiCert documents the first automated validation run at the top of the hour after import. This schedule is not a guarantee that validation will complete within one hour of linking the accounts.

Reset the Connection

Use Reset when you need a replacement Secret key. Resetting temporarily suspends the connection.

1. In UltraDNS, open Accounts > Account Name > Account Info.
2. In DigiCert CertCentral Connection, click Reset and securely save the new connection details.
3. In CertCentral, go to Automation > Integrate with UltraDNS.
4. Under Link account, enter the new value in API secret and select Link.

The new secret must be entered in CertCentral to reactivate the connection. See DigiCert's API secret update instructions for the complete workflow.

Remove the Connection

In the UltraDNS DigiCert CertCentral Connection section, click Unlink to remove the connection. This stops CertCentral from automatically managing domain validation through that connection.

To use the integration again, reestablish the connection and designate the domains again in CertCentral.

Important Notes

• Visible to CertCentral remains disabled until the UltraDNS account is linked to CertCentral.
• If you have access to multiple UltraDNS accounts, each domain must belong to an account linked to CertCentral before you enable its visibility.
• Manually created _dnsauth TXT records can block automated validation. The automation does not delete user-generated _dnsauth TXT records.
• Domains using legacy Static Signing cannot be made visible to CertCentral. Review the UltraDNS Visible to CertCentral documentation if this limitation applies.

Related Documentation

• Connect UltraDNS to CertCentral
• Check Whether the UltraDNS and CertCentral Integration Is Working for Automatic DCV Revalidation