Skip to content

Quick start

This page takes a freshly installed PKIFactor to its first issued certificate. It assumes the platform is installed (see Appliance or Docker Compose) and reachable at https://clm.example.com.

The interface has three workspaces, chosen with the selector at the top of the sidebar: RA (day-to-day certificate work), Oversight (following the estate and compliance) and Administration (configuration). Administrators see all three. Steps 2 to 6 below take place in the Administration workspace, step 7 in RA. See Find your way in the interface.

1. Sign in for the first time

At the very first start, PKIFactor creates the administrator account admin@zetacert.com (or the address set in DEFAULT_ADMIN_EMAIL).

On the appliance, the setup wizard asks for this account: you either typed its password, or left it empty and the wizard showed the generated password once, in its final summary (Appliance installation).

With Docker Compose on your own host or on Kubernetes, when DEFAULT_ADMIN_PASSWORD is not set, the password is random and printed once in the backend log:

docker compose logs backend | grep -A8 "INITIAL ADMIN PASSWORD"

==================================================================
  PKIFactor — INITIAL ADMIN PASSWORD (first start)
              MOT DE PASSE ADMIN INITIAL (premier démarrage)
==================================================================
  login    : admin@zetacert.com
  password : <random value>

  >> Shown ONCE. You MUST change it at first sign-in. <<
  >> Visible UNE SEULE FOIS. Changement OBLIGATOIRE au 1er login. <<
==================================================================

On Kubernetes or OpenShift, read the same banner with oc logs (or kubectl logs) on the backend container.

Sign in with this password. PKIFactor immediately asks for a new one; nothing else is available until it is changed. Passwords must have between 12 and 128 characters, with at least one upper-case letter, one lower-case letter, one digit and one special character.

Choosing the password yourself

Setting DEFAULT_ADMIN_PASSWORD before the first start uses that value instead of a random one, and no banner is printed. It must still be changed at first sign-in, and PKIFactor logs a security warning while the variable remains set. Leave it empty in production (the appliance wizard empties it once the account exists).

2. Activate the license

Open System > License.

  • A new installation runs a local evaluation of 30 days, with every function, without any file. The page shows the days left.
  • To obtain your license, copy the Licence request block shown on the page (Copy request) and send it to ZetaCert. No data leaves the platform by itself.
  • Paste the signed license key you receive (it starts with ZETA-) under Activate a license, then click Activate.

Administrators are warned before the limits of the license. Once the contracted volume is reached, a new name is refused; above it, after the end date, or without a license once the evaluation is over, issuance and renewal are refused. Revocation and discovery are never suspended. See License.

3. Create the first users

Open Governance > Users and click Add User to create at least:

  • one user with the Approver role (validator), who will approve requests;
  • the users who will request certificates (role User).

If your users sign in through single sign-on, configure it first (Single sign-on): accounts are then created at first sign-in.

4. Create an organization

Open Governance > Organizations and click Create Organization. Give it a name and, under Approvers, add at least one user who has the Approver role. On the organization page you can then:

  • link directory groups, so that members are attached automatically (see Directory sources);
  • add members by hand, or prepare access for someone who has not signed in yet;
  • appoint organization managers.

5. Connect a certification authority

A connector needs the server of the authority (its address and credentials). Declare it first in Infrastructure > Servers; only a public ACME authority (Let's Encrypt, for example) needs no server.

Then open Infrastructure > PKI Connectors, click Add PKI Connector, choose the server and the type of your authority (Vault, Microsoft AD CS, EJBCA, ZetaCA, DigiCert, Sectigo, an ACME authority...). Each type has its own form; see Certificate authorities.

Then:

  1. Check the Status column of the list of connectors: Connected, or the cause of the last failure, with its date (Not tested until PKIFactor has tested the connection).
  2. Synchronize the templates of the authority: in the actions menu of the connector, open its templates (the Certificate Templates page) and click Sync From PKI. They become the PKI templates that profiles rely on.

6. Create a certificate profile

Open Infrastructure > Certificate Profiles and click New Profile:

  1. choose the PKI connector and one of its templates;
  2. restrict the allowed key algorithms;
  3. define the subject fields (required, optional, fixed);
  4. decide whether requests need approval;
  5. choose the organizations that may use the profile.

See Certificate profiles.

7. Request a certificate

Sign in as a requester (or stay administrator and switch to the RA workspace) and open Requests > New Request. The form has five steps:

  1. Template: choose the profile;
  2. Mode: Generate Key Pair (PKIFactor produces the key and returns a PKCS#12 file protected by a password you choose) or Upload CSR (your own certificate request, as a file or pasted in PEM);
  3. Algorithm: one of the key algorithms the profile allows;
  4. Subject: the subject fields, the subject alternative names and the organization;
  5. Submit: review, then Submit Request.

The request is listed under Requests > My requests. If the profile requires approval, it appears for the organization's approvers under Approver Inbox > Pending. Once approved (or immediately without approval), the certificate is issued and listed under My certificates, ready to download.

Next steps