Available in Classic and VPC
This guide explains preliminary tasks required in all environments. Be sure to complete the tasks before proceeding with the environment-specific guide.
Before getting started
Before you start the environment-specific guide, make sure you have all of the following items ready.
- External Account Binding (EAB) credentials: Prepare the EAB Key ID and EAB HMAC Key issued in the Certificate Manager console.
- The EAB key is single-use. Keep this in a safe place immediately after it is issued, as it cannot be reused once account registration is complete.
- Domain validation method: Decide in advance which method to use.
- Organization pre-registration (OV certificates only): If you are using an OV certificate, organization validation must be completed in advance under Certificate Manager > Organization.
- DNS TXT record registration (prevalidation only): If you use prevalidation, register and validate the TXT record in Certificate Manager > Domains.
Before requesting an OV certificate through ACME, complete validation of the organization under Certificate Manager > Organization. Issuance fails if you request a certificate for an unvalidated organization.
Step 1: Register an organization (OV certificates only)
This step is required only when using an OV certificate. If you use DV certificates, skip this step and proceed to Step 2: Issue EAB credentials.
- In the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Certificate Manager > Enterprise Certificate > ACME Automation.
- Click the Organization menu.
- Click [Add organization], then enter the contact information, organization name, address, and other details.
- Wait until the validation is complete. Once validation is complete, the certificate will be issued immediately upon an ACME request.
For details about registering and validating an organization, see Add and validate an organization.
Step 2: Issue EAB credentials
EAB credentials authenticate you when registering an ACME account.
- In the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Certificate Manager > Enterprise Certificate > ACME Automation.
- Click the ACME menu.
- Click [Issue EAB].
- Verify the information on the issued credentials.
| Item | Description |
|---|---|
| EAB Key ID (KID) | Key identifier used when registering an ACME account |
| EAB HMAC Key | Signing key used when registering an ACME account |
The EAB key is single-use. Keep this in a safe place immediately after it is issued, as it will be used up and cannot be reused when you register your account. If you lose it, you can have it reissued at the console.
Step 3: Register a DNS TXT record (prevalidation only)
This step is required only when using prevalidation. Register the TXT record and complete the validation in Certificate Manager > Domains. Once registered, it will be reused for all future renewals.
If you are using the DNS-01 dynamic validation method (such as the Ncloud Global DNS hook script or the cert-manager webhook), this step is not necessary. TXT records are automatically created and deleted.
Compare domain validation methods
There are 2 domain validation methods, depending on the EAB settings. Choose the validation method before you start the environment-specific guide.
DNS-01 dynamic validation
| Item | Details |
|---|---|
| Description | Performs dynamic domain validation through the ACME protocol for each issuance and renewal. |
| Characteristics | Uses the standard ACME protocol without modification. |
| Automation conditions | Requires an Ncloud Global DNS API integration script or a Certbot DNS plugin. |
| Wildcard support | Supported |
Prevalidation
| Item | Details |
|---|---|
| Description | Reuses DNS TXT validation completed in advance in the Domains menu of Certificate Manager. |
| Characteristics | Certificate Manager automatically processes this using its own validation data. |
| Automation conditions | Handled automatically by the client without the need to modify any DNS records. |
| Wildcard support | Supported |
To achieve full automation in the DNS-01 dynamic validation method, you must either use the Certbot DNS plugin provided by your DNS service or write a script that calls the DNS API to integrate with the Certbot client. This allows you to automate the process of creating and deleting DNS TXT records.
ACME Directory URL
When following the environment-specific guides, use the URL below as the ACME directory address.
| Type | URL |
|---|---|
| Production environment | https://acme.navercloudtrust.com/acme/directory |