{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":29753,"path":"it-operations-management/discovery/request-new-certificate-using-acme-automated-flow-dns.md","title":"Request certificates using ACME automated DNS challenge flow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Request certificates using ACME automated DNS challenge flow\n\nRequest a new certificate and automatically retrieve the certificates for an application using an Automated Certificate Management Environment \\(ACME\\) automated flow of DNS challenge.\n\n## Before you begin\n\n- Ensure that a credential has been set up. For more information, see [Create credentials for ACME certificate authority](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/discovery/create-credential-for-acme-ca.md)\n- The Certificate Management catalog has been enabled.\n- A routing policy with a DNS challenge action exists. For more information, see [Set up routing policies for ACME](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/discovery/set-up-routing-policy-for-acme.md).\n- Role required: Certificate requester \\[sn\\_disco\\_certmgmt.certificate\\_requester\\], certificate administrator \\[sn\\_disco\\_certmgmt.pki\\_admin\\], certificate user \\[sn\\_disco\\_certmgmt.pki\\_user\\], flow\\_designer, action\\_designer, or admin.\n\n## Procedure\n\n1. Navigate to **All** > **Self-Service** > **Service Catalog**.\n\n2. Access the form for requesting a new certificate.\n\n 1. Select **Certificate Management**.\n\n 2. Select **Automated Flow**.\n\n 3. Select **Request New Certificate \\(Automated\\)**.\n\n3. For the **Select how to manage your certificate** value, select **ServiceNow**.\n\n4. On the form, fill in the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nCertificate Purpose\n\n\n\nDetermines whether the Certificate is internal or external.- Internal: Requires a completed form\n- External: Requires importing the CSR and private key from an external source\n\n\n
\n\nEnvironment\n\n\n\nEnvironment where the certificate must be deployed or installed. The available options are Development, Disaster recovery, Production, or Sub-Production.\n\n
\n\nCertificate Format\n\n\n\nFormat in which the certificate is generated. The available options are: PEM, DER, and PKCS12. The default value is PEM.**Note:** The format must match the Certificate Format configured on the routing policy that handles your request. If the formats don't match with the routing policy, you're notified that manual intervention is required\n\n
\n\nValidity Period for Certificate \\(In Days\\)\n\n\n\nThe number of days the certificate is valid. This field appears only when External is selected from the Certificate Purpose field.\n\n
\n\nCertificate Signing Request \\(CSR\\)\n\n\n\nDetails about the CSR containing certificate information.\n\n
\n\nValidity Period for Certificate \\(In Days\\)\n\n\n\nThe number of days the certificate is valid. This field appears only when External is selected in the Certificate Purpose field.\n\n
\n\nCertificate Owner Group\n\n\n\nOwner group for the certificate.\n\n
\n\nCertificate Owner\n\n\n\nName or role of the person who owns the certificate.\n\n
The following CSR attributes are matched and auto-populated based on the certificate information from CSR:\n\n - Subject Common Name\n - Subject Alternative Name\n - Organization\n - Organizational Unit\n - Locality/City\n - Province\n - Country\n - Email Address\n5. Select **Submit**.\n\n After the request is submitted, a task is created for completing the DNS challenge. The task is completed automatically.\n\n\n## Result\n\n- The certificate is attached to the certificate task in the format you selected.\n - For PEM, the server, intermediate, and root certificates are each attached as separate PEM files.\n - For DER, the same three certificates are attached in DER format. If conversion to DER fails, the certificates are attached in PEM format and a warning is recorded in the work notes of the certificate task. The certificate has already been issued by the certificate authority, so no certificate data is lost.\n - For PKCS12, the server certificate is attached as a key store that contains the server, intermediate, and root certificates together with the private key, encrypted with the password you stored in your external vault. The intermediate and root certificates are also attached separately in PEM format, because no private key exists for them.\n- If a value is selected in the DNS Challenge Action field in the routing policy, the system creates the required DNS record automatically through the configured DNS provider. After DNS record propagation is complete \\(two minutes by default\\), the DNS challenge is completed. The automated flow sends a request to the CA to get the certificate. Admins can change this duration by modifying the **sn\\_disco\\_certmgmt.wait\\_time\\_for\\_dns\\_record\\_propagation** system property.\n- If no value is selected in the DNS Challenge Action field and the domain is already validated with the CA, the DNS challenge task completes without additional action.\n- If no value is selected in the DNS Challenge Action field and the domain is not validated, you must manually add the required DNS TXT record to complete the validation. The certificate is attached to a certificate task. The request certificate task status changes to Completed.\n\n"}}