Available in Classic and VPC
This guide explains preliminary tasks required in all environments. Be sure to complete the tasks before proceeding with the environment-specific guide.
Before you start
Before you start the environment-specific guide, make sure you have all of the following items ready.
- EAB credentials: Prepare the EAB key ID and EAB HMAC key issued by the Certificate Manager console.
- The EAB key is single-use. Keep this in a safe place immediately after it is issued, as it cannot be reused once account registration is complete.
- Determination of the domain validation method: Determine in advance which domain validation method you will use.
- Organization pre-registration (OV certificates only): If you are using an OV certificate, organization validation must be completed in advance under Certificate Manager > Organization.
- Register a DNS TXT record (pre-validation method only): If you are using the pre-validation method, complete the registration and validation of the TXT record in Certificate Manager > Domains.
When requesting an OV certificate through ACME, the pre-validation for the organization must be completed in advance under Certificate Manager > Organization. If you submit a request to an unverified organization, the issuance will fail.
Step 1: Organization pre-registration (OV certificates only)
This step is required only when using an OV certificate. If you are using a DV certificate, skip this step and proceed to Step 2: Issue EAB credentials.
- From NAVER Cloud Platform console, navigate to Menu > Services > Security > Certificate Manager.
- Click Organization.
- Click [Add organization], then enter the contact information, organization name, address, and other details.
- Wait until the validation is complete. Once validation is complete, the certificate will be issued immediately upon an ACME request.
For more information on how to register and validate your organization, see Add and validate organization.
Step 2: Issue EAB credentials
EAB (External Account Binding) credentials are the authentication credentials used when registering an ACME account.
- From NAVER Cloud Platform console, navigate to Menu > Services > Security > Certificate Manager.
- Click ACME.
- Click [Issue EAB].
- Verify the information on the issued credentials.
| Item | Description |
|---|---|
| EAB Key ID (KID) | Key identifier used when registering an ACME account |
| EAB HMAC Key | Signing key used when registering an ACME account |
The EAB key is single-use. Keep this in a safe place immediately after it is issued, as it will be used up and cannot be reused when you register your account. If you lose it, you can have it reissued at the console.
Step 3: Register DNS TXT record (pre-validation method only)
This step is required only when using the pre-validation method. Register the TXT record and complete the validation in Certificate Manager > Domains. Once registered, it will be reused for all future renewals.
If you are using the DNS-01 dynamic validation method (such as the Ncloud Global DNS hook script or the cert-manager webhook), this step is not necessary. TXT records are automatically created and deleted.
Comparison of domain validation methods
There are two types of domain validation methods, depending on the EAB settings. Choose the validation method before you start the environment-specific guide.
DNS-01 dynamic validation method
| Item | Contents |
|---|---|
| Description | Perform dynamic domain validation via the ACME protocol upon each issuance and renewal. |
| Characteristics | Use the ACME standard protocol as is. |
| Automation conditions | Require the Ncloud Global DNS API integration script or the Certbot DNS plugin. |
| Wildcard support | Supported |
Pre-validation method
| Item | Contents |
|---|---|
| Description | Reuse previously completed DNS TXT validation information in the Domains of Certificate Manager. |
| Characteristics | Certificate Manager automatically processes this using its own validation data. |
| Automation conditions | Handled automatically by the client without the need to modify any DNS records. |
| Wildcard support | Supported |
To achieve full automation in the DNS-01 dynamic validation method, you must either use the Certbot DNS plugin provided by your DNS service or write a script that calls the DNS API to integrate with the Certbot client. This allows you to automate the process of creating and deleting DNS TXT records.
ACME Directory URL
When following the environment-specific guides, use the URL below as the ACME directory address.
| Type | URL |
|---|---|
| Operating environment | https://acme.navercloudtrust.com/acme/directory |