Uploading ACME CA Account Credentials

Before an ACME-compliant Certificate Authority (CA) can issue a certificate, the device must have a registered ACME account with that CA.

By default, when a TLS Context is configured to use ACME, it automatically registers a new ACME account with the CA the first time a certificate is requested. This can occur when you manually initiate certificate issuance (seeManually Triggering ACME Certificate Issuance) or when the device automatically renews a certificate according to the configured renewal schedule.

Instead of the device registering a new ACME account, you can upload the credentials of an existing ACME account. This causes the TLS Context to reuse the uploaded account for all future interactions with the CA.

When an ACME account is registered, the device generates an account key pair and registers the account with the CA. The resulting account credentials uniquely identify the account and are used to authenticate future requests to the CA.

Uploading existing ACME account credentials is useful in the following scenarios:

■ Migrating an ACME account from one device to another.
■ Reusing the same ACME account across multiple device.
■ Pre-provisioning ACME account registration before deployment.
■ Avoiding the creation of additional ACME accounts with the CA.

The account credentials file must be in JSON format. The following example shows the structure of a registered ACME account file:

Copy 
{
  "account_key": "-----BEGIN EC PRIVATE KEY-----\nM********\n*******/M*****\n*****==\n-----END EC PRIVATE KEY-----\n",
  "ca_conf": {
    "CA_EMAIL": "admin@example.com",
    "ACCOUNT_URL": "https://acme-v02.api.exampleCA.org/acme/acct/12345678",
    "CA_KEY_HASH": "8FjO*****g=",
    "CA_EAB_KEY_ID": "",
    "CA_EAB_HMAC_KEY": ""
  }
}

The account_key field contains the private key associated with the ACME account. Protect this file carefully. Anyone with access to these credentials can use the associated ACME account when communicating with the CA.

➢ To upload ACME CA account credentials for a TLS Context:
1. Open the TLS Contexts table (see Configuring TLS Contexts).
2. Select the TLS Context.
3. Click the Action button, and then from the drop-down menu, choose Upload ACME Account Credentials; a confirmation message appears.
4. Click Yes to confirm.
5. Browse to and select the ACME account credentials JSON file (.json); a message appears displaying the file upload progress and indicates if the file (credentials) was uploaded successfully.

The device now uses the uploaded ACME account for all subsequent certificate issuance and renewal operations for the TLS Context with the CA. The 'ACME Registration Status' read-only field in the TLS Contexts table displays "Registered".