What to consider for each issuer

Once you have chosen an issuer, check the following requirements and limitations before creating your first certificate.

Public ACME providers

• Requirements: Requires proof of domain control through an ACME challenge (DNS-01, HTTP-01 or TLS-ALPN-01).
• Wildcard certificates: Require the DNS-01 challenge, which is the default challenge type. For wildcard names, TLSPilot rejects other challenge types with Wildcards need DNS-01. Not every ACME provider issues wildcard certificates; in this case TLSPilot shows This ACME provider does not support wildcard names.
• Testing: Start with the staging environment if the provider offers one.

Enterprise CA (AD CS)

• Requirements: Requires a domain-joined management host and an available AD CS with certificate templates that support Server Authentication.
• Availability: Can only be enabled if TLSPilot detects an AD CS in the domain or forest.

Built-in Private CA

• Requirements: Certificates can be issued immediately. Clients that need to trust these certificates require the certificate of the Private CA as a trusted root certificate.
• Structure: Consists of a single root CA on the management host that issues certificates directly.
• Limitations: Runs as a standalone CA on the management host and is not redundant. Revocation information is only available while the management host is reachable.
• IP addresses: Can include IP addresses as SANs in addition to DNS names, for example for internal devices that are accessed by their IP address.

You turn the issuers on and off in the settings on the tab Certification Authorities, see Figure Tab Certification Authorities in the settings. For the Private CA, the tab shows the CA certificate with its validity, CDP and OCSP addresses and the actions Renew CA…, Export CA (.cer)… to distribute the CA certificate as trusted root, Export CRL… and Take out of service….