sectigoinc/orchestrationgateway repository overview

⁠Sectigo orchestration gateway

Sectigo orchestration gateway enables automated SSL certificate lifecycle management through integration with Sectigo certificate manager (SCM). It can generate CSRs, retrieve issued certificates, and facilitate certificate deployment to local and remote endpoints within your network.

This page provides installation instructions for the Sectigo orchestration gateway docker image.

⁠Quick reference

Complete Installation Instructions⁠

⁠How to use this image

⁠Prerequisites

• Docker is installed.
• Your user account has permission to run Docker commands.
• You have a valid orchestration gateway registration token. To obtain a registration token, see Add an orchestration gateway to SCM⁠.

⁠Create a persistent base directory

Run the following command to create a dedicated directory to persist configuration, identity, and logs. This ensures your data survives even if the container is removed or updated.

mkdir -p ~/sog_data/log

cd ~/sog_data

⁠Generate a machine identity

The agent uses a 32-character hexadecimal string to derive encryption keys.

Run the following command to generate a unique machine identity.

# Generates a random 32-char hex string and saves it locally
cat /proc/sys/kernel/random/uuid | tr -d '-' > machine-key

⁠Initialize the configuration

Run the following command to extract the default config.json configuration file from the image. This gives you a template to modify if you need to change agent behavior later.

docker run -ti --rm \
--entrypoint sh \
sectigoinc/orchestrationgateway:latest \
-c "cat /opt/sectigo-orchestration-gateway/config/config.json" > config.json

⁠Register the Gateway

Register the agent with the Sectigo backend. The machine-id file created in the previous step is bind-mounted to the container's /etc/machine-id path so it can be used by the agent for key generation.

Run the following command and replace <token> with the registration token obtained from SCM.

docker run -ti --rm \
-v <sog-data-dir>:/opt/sectigo-orchestration-gateway/config \
-v <sog-data-dir>/machine-key:/etc/machine-id \
-v <sog-data-dir>/log:/var/log/sectigo-orchestration-gateway \
sectigoinc/orchestrationgateway:latest register --token "<token>"

⁠Run the container

Run the following command to start the gateway in the detached mode.

docker run -d \
--name sog \
-v <sog-data-dir>:/opt/sectigo-orchestration-gateway/config \
-v <sog-data-dir>/machine-key:/etc/machine-id \
-v <sog-data-dir>/log:/var/log/sectigo-orchestration-gateway \
sectigoinc/orchestrationgateway:latest

⁠Add a keystore

Once the container is running, use docker exec to add a keystore.

⁠(Optional) List Keystores

Run the following command to list any existing keystores.

docker exec sog ./bin/sectigo-og keystore list

⁠Add a keystore

Run the following command to add a keystore. Replace <type> with one of the following keystore types and <password> with your password:

• jks -- for a JKS keystore
• p12 -- for a PKCS#12 keystore

docker exec sog ./bin/sectigo-og keystore add <type> \
--name "dev-store" \
--password "<password>"