Certificate Management :: GlobalSign Atlas Documentation

Certificate Management

Domain Management

The Domain Management sections in TLS Connect allow you to validate ownership of domains before certificates can be issued. You can view and manage domains associated with either your GCC Managed SSL profiles or Atlas accounts, depending on the issuing platform you are using. For Atlas Accounts, follow the steps below:

Open the TLS Connect application and navigating to the Atlas > Domain Mgmt tab.
To create a domain claim:
1. Select Add New Domain.
2. Enter the domain name IP address in the Domain/IP field.
3. Click Claim Domain.
To request a new domain verification code (DVC):
1. Click Reassert next to a domain claim in the claims table.
To verify a domain:
1. Click Verify next to the domain claim in the claims table.
2. Select the validation method and, if applicable, configure a CNAME record.
3. Once the validation requirement is satisfied, click Verify to complete the validation process.

Request and Issue Certificates

You can manually request a TLS certificate at any time using the TLS Connect application.

Open the TLS Connect application and navigate to the Atlas > Issue / Reissue tab.
Choose how the Certificate Signing Request (CSR) will be provided:

Manual CSR (upload/paste)
Auto-generate CSR in MMC

Select Manual CSR (upload/paste).
Browse or paste the CSR in the box.
If this request is intended to replace a valid, unrevoked certificate, tick the Reissue checkbox. This option is available only when a prior order is associated with the certificate.
1. Enter the serial number of the certificate you intend to replace and click the search button to allow TLS Connect to locate the certificate in the MMC.
Tick the checkbox if you want to add any required Subject Alternative Names (SANs) to the certificate request.
Click Next.
On the following screen, select:
1. The certificate export format.
2. An export password (if applicable).
3. Browse the file location where the certificate will be saved.
Click Next.
On the last screen, enter a friendly name for the certificate.
NOTE: The friendly name is a required identifier used by Windows to distinguish certificates in the Windows Certificate Store.
Review the certificate request details. When ready, click Issue Certificate.
Your certificate has been issued.

Select Auto-generate CSR in MMC.
Enter the domain name in the Domain (DN) field.
Select the key type and key size from the corresponding dropdown menus.
If this request is intended to replace a valid, unrevoked certificate, select Reissue. This option is available only when a prior order is associated with the certificate.
1. Enter the serial number of the certificate you intend to replace and click the search button to allow TLS Connect to locate the certificate in the MMC.
Tick the checkbox if you want to add any required Subject Alternative Names (SANs) to the certificate request.
Click Next.
On the following screen, select:
1. The certificate export format.
2. An export password (if applicable).
3. Browse the file location where the certificate will be saved.
  
  NOTE: JDK is required to support the JKS file format.
Click Next.
On the last screen, enter a friendly name for the certificate.
NOTE: The friendly name is a required identifier used by Windows to distinguish certificates in the Windows Certificate Store.
Review the certificate request details. When ready, click Issue Certificate.
Your certificate has been issued.

ACME Service

You can use TLS Connect to request, issue, and deploy public‑trust TLS certificates from Atlas using the ACME protocol. To use this feature, an Atlas ACME account and credentials must already be configured in TLS Connect.

Open the TLS Connect application and navigate to the ACME tab.
Select the validation method you want to use for the certificate request.
1. DNS Validation method: DNS validation requires the ability to create or update DNS records for the requested domain.
  1. Enter the fully qualified domain name (FQDN) for the certificate.
  2. Enter a friendly name for the certificate. The friendly name is a required identifier used by Windows to distinguish certificates in the Windows Certificate Store.
  3. Enter your email address.
  4. Add any required Subject Alternative Names (SANs).
  5. Select your Atlas ACME account from the Account drop‑down menu.
  6. Select the appropriate DNS controller from the DNS Validation drop‑down menu.
  7. Click Next.
2. HTTP Validation method: HTTP validation requires the selected IIS site to be publicly reachable.
  1. Select the IIS site that will be used for HTTP validation.
  2. Enter a friendly name for the certificate. The friendly name is a required identifier used by Windows to distinguish certificates in the Windows Certificate Store.
  3. Enter your email address.
  4. Select your Atlas ACME account from the Account drop‑down menu.
  5. Click Next.
On the following screen, choose:
1. The certificate export format
2. The file location where the certificate will be saved.
3. An export password (if applicable).
  
  NOTE: JDK is required to support the JKS file format.
  
  For advanced use cases: Always request a new certificate - Requests a new certificate from the ACME server instead of reusing cached issuance data. Use this option only when a new certificate is explicitly required. This option bypasses simpleacme’s issuance cache and may increase the number of ACME requests sent to the issuing service.
Click Next.
On the final screen, you can select optional automation tasks to run once the certificate is issued.
1. Store in Azure Key Vault: Deploys the certificate to an integrated Azure Key Vault account. To use this option, configure an AKV profile in Settings > Integrations > Azure Credentials.
  
  NOTE: The simple-acme Azure Key Vault store plugin needs to be installed in order to use this feature.
2. Run a post‑issuance script: Executes a custom script after issuance. You may upload an existing script or create one directly in the UI.
3. Install to IIS automatically: Installs the certificate to the selected IIS site after issuance.
Review the certificate request details. When ready, click Issue Certificate.

A confirmation message is displayed once the certificate has been successfully issued.

Inventory

This inventory reflects certificates issued through GlobalSign platforms, not certificates discovered via network scanning. Your issued certificates will appear in an inventory associated with your GlobalSign issuance platform (GCC or Atlas). From this view, you can:

See certificates that are valid, expiring, or nearing expiration

Sort and filter the inventory using multiple criteria

View detailed certificate information

Download individual certificates.
Revoke individual certificates.

Sync Database

Use this option to fetch new or modified certificates within the specified sync window (Atlas is 30 days, GCC is 365 days).

Export CSV

Use this option to export the certificate inventory to a CSV file for offline review or reporting.

Deploy Certificate

The Deployment tab displays all IIS sites bound on the local Windows server, along with certificates available in the Windows Certificate Store. From this tab, you can deploy certificates to IIS sites, deploy certificates to remote targets, or export certificates for use elsewhere.

Use this option to bind a certificate to one or more IIS sites on the local server.

Select a certificate from the inventory list.
Select one or more IIS sites to which the certificate should be deployed.
Click Bind Certificate.
Once deployed, the certificate appears next to the IIS site(s) it is bound to.

Use this option to deploy a certificate to a remote endpoint.

Select a certificate from the inventory and click Deploy Remote.
Select the deployment target.
Enter your Server Address and click Connect.
Once connected, select a deployment option and the IIS site(s) for deployment.
Click Deploy Certificate.

Use this option to export a certificate from the Windows Certificate Store.

Select a certificate from the inventory and click the export (yellow folder) icon.
Choose the export format.
NOTE: JDK is required to support JKS file formats.
Depending on the selected format, choose a file location and enter a password.

Use this option to import a certificate from the Windows Certificate Store.

Click Import Certificate.
Browse the certificate to import.
Enter password, if needed.
Click Import Certificate.

Use this option to quickly verify that a TLS certificate is present and active for a specific URL and port. This check confirms that the deployed certificate is being served correctly by the target endpoint.

Click SSL Checker.
Enter the URL and click Go to display the scanned results.
Scan results are displayed in the Logs window at the bottom of the screen.

Renew Certificates

Atlas

Setting up renewal tasks in TLS Connect requires a Premium license. For more information on this feature, refer to the Automation↗ page.

ACME Service

The ACME service in TLS Connect automatically renews certificates every 55 days by default. You can view renewal status in ACME > Manage Renewals, where you may also manually renew a certificate at any time.

If you need to adjust the default renewal interval, you can do so by updating the simple-acme configuration.

Navigate to the installation directory for the wacs simple-acme client and open the settings.json file in a text editor.
Update the value of the ScheduledTask > RenewalDays to the desired number of days.
Save and close the settings.json file.

The updated renewal interval is applied the next time the ACME renewal task runs.

Revoke Certificates

You can manually revoke a certificate at any time using the TLS Connect application. Revoking a certificate is a permanent change to a certificate's status and cannot be undone.

Open the TLS Connect application and navigate to Atlas > Inventory.
Locate the certificate you want to revoke from the table and select Revoke.
Select Yes on the confirmation modal to confirm revocation.

The certificate will be revoked and its status will be logged in its Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP).

On this page