salt.runners.digicertapi¶

Support for Digicert. Heavily based on the Venafi runner by Joseph Hall (jphall@saltstack.com).

Before using this module you need to register an account with Digicert's CertCentral.

Login to CertCentral, ensure you have a payment method configured and/or there are adequate funds attached to your account. Click the Account item in the left sidebar, and select Account Access. The right hand pane should show "Account Access" and a link to create an API key. Create a new API key and assign it to the user that should be attached to requests coming from Salt.

NOTE CertCentral will not show the API key again after revealing it the first time. Make sure you copy it right away or you will have to revoke it and generate a new one.

Now open /etc/salt/master and add the API key as shown below.

digicert:
  api_key: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABC

Restart your Salt Master.

You can also include default values of the following variables to help with creating CSRs:

digicert:
  api_key: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABC
  shatype: sha256

This API currently only supports RSA key types. Support for other key types will be added if interest warrants.

salt.runners.digicertapi.del_cached_domain(domains)¶

Delete cached domains from the master

CLI Example:

salt-run digicert.del_cached_domain domain1.example.com,domain2.example.com

salt.runners.digicertapi.gen_csr(minion_id, dns_name, organization_id, ou_name=None, key_len=2048, shatype='sha256', password=None)¶

CLI Example:

salt-run digicert.gen_csr <minion_id> <dns_name>

salt.runners.digicertapi.gen_key(minion_id, dns_name=None, password=None, key_len=2048)¶

Generate and return a private_key. If a dns_name is passed in, the private_key will be cached under that name.

CLI Example:

salt-run digicert.gen_key <minion_id> [dns_name] [password]

salt.runners.digicertapi.get_certificate(order_id=None, certificate_id=None, minion_id=None, cert_format='pem_all', filename=None)¶

Retrieve a certificate by order_id or certificate_id and write it to stdout or a filename.

A list of permissible cert_formats is here:

https://www.digicert.com/services/v2/documentation/appendix-certificate-formats

CLI Example:

salt-run digicert.get_certificate order_id=48929454 cert_format=apache

Including a 'filename' will write the certificate to the desired file. Note that some cert formats are zipped files, and some are binary.

If the certificate has not been issued, this function will return the order details inside of which will be a status (one of pending, rejected, processing, issued, revoked, canceled, needs_csr, and needs_approval)

If for some reason you want to pipe the output of this command to a file or other command you will want to leave off the filename argument and make sure to include --no-color so there will be no terminal ANSI escape sequences.

salt.runners.digicertapi.get_org_details(organization_id)¶

Return the details for an organization

CLI Example:

salt-run digicert.get_org_details 34

Returns a dictionary with the org details, or with 'error' and 'status' keys.

salt.runners.digicertapi.list_domain_cache()¶

List domains that have been cached

CLI Example:

salt-run digicert.list_domain_cache

salt.runners.digicertapi.list_domains(container_id=None)¶

List domains that CertCentral knows about. You can filter by container_id (also known as "Division") by passing a container_id.

CLI Example:

salt-run digicert.list_domains

salt.runners.digicertapi.list_orders(status=None)¶

List certificate orders made to CertCentral.

CLI Example:

salt-run digicert.list_orders

salt.runners.digicertapi.list_organizations(container_id=None, include_validation=True)¶

List organizations that CertCentral knows about. You can filter by container_id (also known as "Division") by passing a container_id. This function returns validation information by default; pass include_validation=False to turn it off.

CLI Example:

salt-run digicert.list_organizations

salt.runners.digicertapi.list_requests(status=None)¶

List certificate requests made to CertCentral. You can filter by status: pending, approved, rejected

CLI Example:

salt-run digicert.list_requests pending

salt.runners.digicertapi.order_certificate(minion_id, common_name, organization_id, validity_years, cert_key_passphrase=None, signature_hash=None, key_len=2048, dns_names=None, organization_units=None, server_platform=None, custom_expiration_date=None, comments=None, disable_renewal_notifications=False, product_type_hint=None, renewal_of_order_id=None)¶

Order a certificate. Requires that an Organization has been created inside Digicert's CertCentral.

See here for API documentation: https://www.digicert.com/services/v2/documentation/order/order-ssl-determinator

CLI Example:

salt-run digicert.order_certificate my_minionid my.domain.com 10             3 signature_hash=sha256             dns_names=['this.domain.com', 'that.domain.com']             organization_units='My Domain Org Unit'             comments='Comment goes here for the approver'

This runner can also be used to renew a certificate by passing renewal_of_order_id. Previous order details can be retrieved with digicertapi.list_orders.

salt.runners.digicertapi.show_csrs()¶

Show certificate requests for this API key

CLI Example:

salt-run digicert.show_csrs

salt.runners.digicertapi.show_organization(domain)¶

Show organization information, especially the company id

CLI Example:

salt-run digicert.show_company example.com

salt.runners.digicertapi.show_rsa(minion_id, dns_name)¶

Show a private RSA key

CLI Example:

salt-run digicert.show_rsa myminion domain.example.com