What is a DCA?

This is the local UC Berkeley campus name for what is referred to as a DRAO (Department Registration Authority Officer) in other Sectigo documentation.

What is expected of a DCA?

1. The primary responsibility of a DCA when issuing or renewing a certificate is to verify that certificate requests are legitimate. If the DCA does not personally know the person making the certificate request or their business need for the certificate, due diligence would be expected to track down a responsible person within the DCA's unit who can vouch for the legitimacy of the request.
2. Another requirement is to learn to use the Sectigo Certificate Manager (SCM) tool for managing certificates as documented in the Sectigo Admin Guide. 

What are some policies and best practices for a DCA?

1. Do not issue wildcard certs without first requesting a review from the CalNetIdM team.
   Note that the Information Security Office (ISO) has designated the use of a wildcard cert for the root domain (*.berkeley.edu) as requiring UC P4 data classification of the host.
   We will consult with Security Operations to ensure there is a good reason to use a wildcard cert rather than a SAN certificate. For customers with a handful of certs, Multi-Domain/SAN certs might be the best approach. For services with multiple instances across many clustered hosts, wildcard certs might work best, though there is greater risk if the private key is compromised.
   Our expectation is that any cert be issued with a new private key at each renewal.
2. Document all steps performed for the validation of requests for certs, such as checking with the Network team on hostname ownership, checking with DNS data, etc. 
3. Some tips for generating CSRs
   1. For hosts that may have domain components that start with a number, for example, host.1918.berkeley.edu, the Java keytool may complain when generating keypairs. Use OpenSSL-based techniques instead.
   2. Multi-Domain/SAN certs: use the gencert script (modified for your environment) to simplify the use of OpenSSL.
4. Train any new backup DCAs for your department. 

How many DCAs should a department have?

This will vary depending on the volume of requests for certificates or renewals. If a unit has a request volume that would impact business needs if the primary DCA were unavailable to fulfill these requests, having a designated backup DCA would be appropriate.

How can I sign up to become a DCA?

If you are interested in performing the DCA function for your unit, please forward your request along with the contact information for a person responsible for your department's or unit's business functions, for example, a departmental manager or MSO or chairperson, to calnet-admin@berkeley.edu for consideration and also to schedule a training session.

If you already have an existing DCA in your unit and would like to request to be added as a backup DCA, contact calnet-admin@berkeley.edu for consideration. The existing DCA for your department should train the backup DCAs.

How are DNS domains assigned to a DCA?

When you apply for becoming a DCA, please also list the DNS domains and hostnames for which you would like to be responsible for issuing certificates. It is possible to request additional domains via the Sectigo Certificate Manager (SCM) Admin tool, but the initial setup will be smoother if we can provision most of these up front. Examples of UC Berkeley DNS domains and hostnames you might request are: *.mysubdom.berkeley.edu, myhost1.berkeley.edu, etc. The wildcard names represent subdomains which you can claim as being responsible for the identity of all of the hosts.

How do I use the Sectigo Certificate Manager (SCM) to request a new hostname or domain for my department?

Starting at the Settings tab, select the Departments menu item. Now click the Domains button in the Controls column for your department. Finally, click the Add button to request a new hostname or domain to be added to the list for your department (the name appears in red text while pending approval). This request will generate an e-mail notice to the appropriate administrator for approval. When the approval step has been completed you will be able to provision certificates for the newly delegated domain.

What to put in the External requester field?

This depends on whether you want the person listed to receive the notices generated at the various stages of certificate provisioning.

Is there an API that I might use to automate some tasks?

We suggest using ACME for automated SSL/TLS certificate management. Otherwise, API Documentation, Sectigo has documented the REST APIs for the Certificate Manager which underlies the Sectigo Certificate Manager (SCM) web application used by the TLS Certificate Service.

What is Certificate Discovery?

This feature allows you to scan a subset of the network to create an inventory of certificates and their expiration dates. Be sure to create a Discovery Scan Summary notification before running the scan to ensure that the report is delivered correctly. See Understanding network discovery tasks

How can I create a wildcard certificate containing non-wildcard names?

To create a certificate containing both a wildcard name and a non-wildcard name, use the Multi Domain SSL certificate type and enter the non-wildcard name as the CN and the wildcard name as one in the SAN field.