My agents

Prerequisites

• Registrant identity verification: Complete identity verification in the ATS console, and ensure the registrant status is "Approved".

• Domain ownership: The host address (FQDN) bound to the agent must be a domain under your control.

Step 1: Fill out form

1. Log on to the ATS console. In the left navigation pane, choose My Agents.

2. Click Register Agent.

3. In the Register Agent panel, fill in the basic information:

   Parameter	Description
   Display Name	A human-readable display name for the agent.
   Domain Mode	Determines the relationship between the agent's Access Hostname and Identity Hostname: Independent Domain Mode: The agent uses a dedicated domain. The Access Hostname and Identity Hostname are the same, serving as the unique identity of the agent. Shared Domain Mode: Multiple agents share the same parent domain as the Access Hostname. An additional subdomain is required as the Identity Hostname to uniquely identify the agent.
   Host Address	The fully qualified domain name (FQDN) of the agent, for example agent.example.com. Must be a domain under your control. In Independent Domain Mode, this value is the agent's complete endpoint domain. In Shared Domain Mode, this value is the parent domain shared by multiple agents.
   Endpoint Subdomain Name	Required only in Shared Domain Mode. Used to uniquely identify the agent. Must meet the following requirements: Must be a first-level subdomain of the parent domain specified in Host Address. For example, if the parent domain is example.com, abc.example.com is valid, but a.b.example.com is not. Must be globally unique and cannot be shared with other agents. One subdomain corresponds to one agent. Must be publicly resolvable.
   Version	Semantic version number in the format X.Y.Z, for example 1.0.0.
   Associated Registrant	Select an approved registrant. The dropdown list only shows registrants with "Approved" status.
   Description	A description of the agent's capabilities, up to 150 characters.

4. In the Endpoint Configuration section, fill in the agent's service endpoint information. At least one endpoint must be configured. Multiple protocol endpoints are supported.

   Parameter	Description
   Protocol	The endpoint communication protocol. Options: MCP, A2A, OpenAPI.
   Agent URL	The access URL of the agent service.
   Transport Protocol	The data transport method. Options are updated based on the selected protocol: MCP/A2A: STREAMABLE-HTTP, SSE OpenAPI: REST, HTTP
   Metadata URL	The URL of the agent metadata descriptor file.

   To add more endpoints, click Add Endpoint. Each endpoint supports independent protocol and transport configuration.

5. Click Next to proceed to the ACME pre-check step.

   The system automatically generates an ATI Name as the globally unique trust identifier for the Agent. Format:

   • Independent Domain Mode: ati://v{version}.{host address}

   • Shared Domain Mode: ati://v{version}.{endpoint subdomain}

Step 2: ACME pre-check

After submitting the basic information, the system automatically generates the TXT record required for ACME DNS-01 verification. You need to manually add the record at your DNS provider, then trigger the pre-check to complete domain control verification.

1. In the ACME DNS-01 Authentication Configuration section, view and copy the TXT record information to be added (record type, hostname, and record value).

   The number of TXT records to add depends on the domain mode selected in Step 1:

   • In Independent Domain Mode, one TXT record is generated to verify control of the domain corresponding to the host address.

   • In Shared Domain Mode, two TXT records are generated. The parent domain verification is for certificate issuance, and the subdomain verification proves ownership of the Identity Hostname. Both records must be configured on their respective domains and take effect before the pre-check can pass.

2. Log in to your DNS provider's console and manually add the TXT record(s) listed above.

   Regardless of which DNS provider hosts your domain, you must manually add the records. Ensure the TXT records have taken effect before proceeding. Propagation times may vary across DNS providers.

3. Return to the ATS console and click Trigger ACME Dry Run. The system performs ACME DNS-01 verification. Once passed, the request is submitted to CNNIC for final review.

   If the pre-check fails, verify that the TXT records are correctly added and have taken effect, then click Trigger ACME Dry Run again.

Step 3: Submit registration

After passing the ACME pre-check, fill in the Identity Certificate Signing Request (Identity CSR) and the Server Certificate public key, then submit the registration.

1. Configure the Identity Certificate

   The Identity Certificate is issued by CNNIC Private CA through Alibaba Cloud RA proxy and is used for agent identity authentication. Generate an Identity CSR (PEM format) locally and paste the CSR content into the Identity CSR (PEM) input box.

   Important

   The key pair for the Identity Certificate must be generated locally. Keep the private key safe and never upload the private key to the platform or any third party. Alibaba Cloud RA only receives the CSR (containing the public key portion) and does not generate, process, or access the agent's private key.

   If you do not have a CSR yet, click View Generation Guide and follow these steps to generate one locally using OpenSSL:

   1. Generate a key pair.

      # Method A: RSA 2048
      openssl genrsa -out identity.key.pem 2048
      
      # Method B: EC P-256
      openssl ecparam -genkey -name prime256v1 -noout -out identity.key.pem

   2. Generate the Identity CSR. The console automatically generates the command based on your configuration. You can copy and execute it directly:

      openssl req -new -key identity.key.pem -out identity.csr.pem -sha256 -utf8 \
        -subj "/C={country_code}/O={registrant_name}/CN={display_name}" \
        -addext "subjectAltName=URI:ati://v{version}.{endpoint_domain}"

      The value of {endpoint domain} depends on the domain mode:

      In Exclusive Domain Mode, it is the host address entered in Step 1.

      In Shared Domain Mode, it is the Endpoint Subdomain entered in Step 1.

      It is recommended to copy and execute the command generated by the console to avoid SAN mismatches caused by manual placeholder replacement, which may result in issuance failure.

      The above command uses the -addext parameter, which requires OpenSSL 3.0+ (built into macOS / Ubuntu 22.04+ / CentOS 9+). If you are using OpenSSL 1.x, upgrade first.

   3. Copy the CSR content.

      cat identity.csr.pem

   4. Paste the CSR content

      Paste the content of identity.csr.pem into the Identity CSR (PEM) input box above. Do not paste the private key.

2. Configure the server certificate

   In the Server Certificate Public Key (PEM) input box, paste the public key of the Server Certificate issued by a Public CA (such as Let's Encrypt, DigiCert, etc.) in X.509 PEM format. Only the leaf certificate is required; the intermediate CA chain is not needed.

   The system automatically extracts the SPKI fingerprint from the certificate for generating DANE/TLSA records.

3. Submit registration information

   After confirming that both the Identity CSR and the Server Certificate public key are filled in, click Submit Registration.

   After successful submission, the agent enters the Pending Private CA Issuance status. Alibaba Cloud submits the Identity CSR to CNNIC for Identity Certificate issuance and generates DANE/TLSA records for the Server Certificate. The subsequent review and issuance process is completed automatically by the system. You can monitor the status changes in the agent list.

DNS record types

The system automatically generates a set of DNS records for each registered agent, consisting of TXT and TLSA record types.

• In Independent Domain Mode, {host} is the host address entered during registration.

• In Shared Domain Mode, {host} is the Endpoint Subdomain entered during registration.

The records to configure depend on the authentication level you want the agent to achieve:

• Basic authentication: Verify the _ati TXT record.

• Enhanced authentication: Verify the _ati TXT + _ati-badge TXT records.

• Advanced authentication: Verify all records (including both TLSA records).

Verify DNS records

When the agent status is DNS Pending Verification, configure the DNS records in your DNS provider's console, then trigger verification. You can use One-Click Configuration or manually add DNS records depending on where your domain is hosted.

Agent status descriptions

Agents have the following statuses during registration and use, corresponding to different lifecycle stages:

Operations

After registration, you can manage agents on the My Agentspage. The available operation buttons depend on the agent's status: