Register your first agent

Prerequisites

• Domain name ownership: Prepare the host address for the agent. This address must be a Fully Qualified Domain Name (FQDN) that you control.

• Server certificate: Prepare a server certificate. The certificate must be issued by a public Certificate Authority (CA), or you can bring your own certificate (BYOC).

Workflow

Step 1: Identity verification

Before you can register an agent, you must complete identity verification for at least one registrant.

1. Go to the Identity Verification page in the ATS console and click Submit Identity Verification.

2. Fill in the registrant information, including the name, certificate type, certificate number, and certificate image, and then submit it for review. The certificate image must be clear and complete. Otherwise, the review process may be delayed.

3. Wait for the manual review. Once approved, the registrant's status changes to Approved.

For more information, see Identity verification.

Step 2: Register the agent

1. On the My Agents page, click Register Agent.

2. In the Agent Registration Request step, enter the agent's basic information and endpoint configuration, such as the protocol and URL. Select an approved registrant. Click Next.

3. In the ACME Pre-check step, complete the domain name ownership validation:

   1. Copy the host record and record value of the TXT record displayed on the page.

   2. Log on to the console of your DNS provider and manually add the TXT record.

   3. Return to the ATS console and click Trigger ACME Dry Run. After the validation is successful, the wizard automatically proceeds to the next step.

4. In the Submit Registration step, submit the certificate materials:

   1. In the Identity Certificate area, paste the locally generated Identity Certificate Signing Request (CSR) in PEM format. The identity certificate is issued by CNNIC Private CA and does not require a separate request.

      Important

      The key pair for the identity certificate must be generated locally. Store the private key securely and never upload it to the platform or any third party. The Alibaba Cloud Registration Authority (RA) accepts only the CSR, which contains the public key. The RA does not generate, process, or access the agent's private key.

      If you have not yet generated a CSR, click View Generation Guide and follow the instructions.

   2. In the Server Certificate area, paste the public key of the server certificate obtained from a public Certificate Authority (CA) in PEM format.

   3. Click Submit Registration. After a successful submission, the agent enters the Pending Issuance by Private CA state and waits for CNNIC to review and issue the identity certificate. Check the agent's status to monitor the issuance progress.

For more information about each step, see My agents.

Step 3: Configure DNS records

DNS records make an agent discoverable on the internet. ATS generates a set of standard DNS records for each agent for identity discovery, trust validation, and secure communication. If the DNS records are not configured after CNNIC approves the agent, the agent's status changes to DNS Pending Validation.

1. On the My Agents page, find the target agent, and in the Actions column, click DNS Record to view the system-generated DNS records.

2. Log on to the console of your DNS provider and add these records.

3. Return to the ATS console and click Verify DNS. After successful validation, the status of the record changes to Verified.

For a detailed description of DNS records, see Configure DNS records.

Step 4: View the certificate

When the CNNIC Private CA issues the identity certificate and you complete the DNS record configuration, the agent status changes to Active. You can choose one of the following connection types based on your business scenario and security compliance needs: