I'm an absolute newbie in the enterprise CSR and certificate generation process. So kindly point out any obvious silliness in the question.

Is it possible to completely automate the process of CSR generation + certificate signing by a CA and installation of signed certificate with? From my basic understanding, I believe the CSR submission and certificate signing by the CA has a turnaround time to the tune of days and would also require some manual intervention. Has anyone managed to automate that step? Do CAs expose signing as a web service?

  • Technically it is possible and Let's Encrypt is on his way to propose exactly such feature (with also certificate update you did not mentioned in your question) but it is not ready yet. Practically, I do not have crossed it yet with traditional CAs. – WhiteWinterWolf May 7 '15 at 16:48
  • @WhiteWinterWolf - "Technically it is possible" with traditional CAs? – Krishter May 7 '15 at 17:04

While thinking about it, I can now definitively answer that some CA offers Web API allowing to automate part or all of the certificate generation / signature.

Some concrete example of this are Digicert, GlobalSign, Gandi.

Some other CA may therefore offer the same services, however you need to check:

  • The available functionality, not all functions available from the graphical web interface may be available from the Web API,
  • This may also be a paid option. An API key is always required for such operation, and getting such this key may be subject to some fees.

Perhaps relevant is OpenSSL Certificate Authority Setup . I use this in development environments all the time -- but this is a completely untrustworthy CA. On the other hand, it means that developers who need certs for testing can get them immediately. I've even got a web front end, and a script for an OCSP, again because they are useful for testing.

But that doesn't help if you want trustworthy certificates. The CA has a process for validating the things they are going to sign. The process may have automated components, but ultimately they have to take enough time to validate you are whom you are asserting in the signature request, or else be exactly as useful as my little development CA.


The reason that this is not usually fully automated is that CAs want to protect their own reputation and ensure that the person they are issuing the cert to is the actual owner of the domain (often by speaking on the phone with the applicant). There are different levels of validation / background checking that a CA can perform when issuing, the two main ones being Domain Validated (DV) and Extended Validation (EV) for SSL certificates. If you (and your customers) are ok with the lower security, DV certificate validation could be fully automated, but I am not aware of any that currently do, which is why Let's Encrypt is making waves.

  • Thank you for highlighting the EV vs DV aspect. It shows that the consequence of making it fully automated is on how secure I want the cert to be. – Krishter May 8 '15 at 1:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.