My agents

Prerequisites

• Registrant identity verification: Complete the identity verification (registrant review) in the ATS console. Your registrant status must be "Approved".

• Domain name ownership: The host address (fully qualified domain name (FQDN)) for the agent must be a domain name that you control.

Step 1: Fill out the registration form

1. Log on to the ATS console. In the navigation pane on the left, choose My Agents.

2. Click Register Agent.

3. In the Register Agent panel, fill in the basic information:

   Parameter	Description
   Display Name	An easy-to-read display name for the agent.
   Host Address	The FQDN of the agent, such as agent.example.com. This must be a domain name that you control.
   Version	The semantic version number in the X.Y.Z format, such as 1.0.0.
   Associated Registrant	Select an identity-verified registrant that has been approved. The drop-down list shows only registrants with an "Approved" status.
   Description	A description of the agent's capabilities, up to 150 characters.

4. In the Endpoint Configuration section, fill in the agent's server endpoint information. Configure at least one endpoint. Multiple protocol endpoints are supported.

   Parameter	Description
   Protocol	The communication protocol for the endpoint. Options: MCP, A2A, OpenAPI.
   Agent URL	The endpoint for the agent service.
   Transport Method	The data transport method. The options update automatically based on the selected protocol: MPC/A2A: Supports STREAMABLE-HTTP, SSE OpenAPI: Supports REST, HTTP
   Metadata URL	The URL of the agent's metadata description file.

   To add multiple endpoints, click Add Endpoint. You can configure the protocol and transport method for each endpoint independently.

5. Click Next.

   The system automatically generates an ATI Name in the format `ati://v{version}.{host_address}` and proceeds to the ACME pre-check step.

Step 2: ACME pre-check

After you submit the basic information, the system generates the TXT record for ACME DNS-01 validation. Manually add this record at your DNS provider, and then trigger the pre-check to complete the domain ownership validation.

1. In the ACME DNS-01 Authentication Configuration section, view and copy the TXT record information to add: Record Type, Host Record, and Record Value.

2. Log on to your DNS provider's console and manually add the TXT record.

   Note

   Regardless of which DNS provider hosts your domain name, you must go to the corresponding console to add the record manually. Ensure that the TXT record is effective before you proceed. The time it takes for a record to become effective varies among DNS providers.

3. Return to the ATS console and click Trigger ACME Dry Run. The system performs the ACME DNS-01 domain ownership validation. If the validation is successful, the request is submitted to CNNIC for final review.

   If the pre-check fails, check that the TXT record was added correctly and has taken effect. After you confirm, click Trigger ACME Dry Run again.

Step 3: Submit registration

After the ACME pre-check is successful, fill in the identity certificate signing request (CSR) and the server certificate public key, and then submit the registration.

1. Configure the identity certificate

   The identity certificate is issued by the CNNIC Private Certificate Authority (CA) through the Alibaba Cloud Registration Authority (RA) agent and is used for agent identity authentication. Generate an identity CSR in PEM format on your local machine. Paste the CSR content into the Identity CSR (PEM) input box.

   Important

   The key pair for the identity certificate must be generated locally. Keep the private key secure. Do not upload the private key to the platform or any third party. The Alibaba Cloud RA only accepts the CSR (which includes the public key) and does not generate, process, or access the agent's private key.

   If you do not have a CSR, click View Generation Guide and follow these steps to generate one locally using OpenSSL:

   1. Generate a key pair.

      # Method A: RSA 2048
      openssl genrsa -out identity.key.pem 2048
      
      # Method B: EC P-256
      openssl ecparam -genkey -name prime256v1 -noout -out identity.key.pem

   2. Generate the identity CSR. The console automatically generates the command based on your configuration. You can copy and run the command:

      openssl req -new -key identity.key.pem -out identity.csr.pem -sha256 -utf8 \
        -subj "/C={country_code}/O={registrant_name}/CN={display_name}" \
        -addext "subjectAltName=URI:ati://v{version}.{host_address}"

      The command above uses the -addext parameter, which requires OpenSSL 3.0 or later (built-in on macOS, Ubuntu 22.04+, and CentOS 9+). If you are using OpenSSL 1.x, upgrade it first.

   3. Copy the CSR content.

      cat identity.csr.pem

   4. Paste the CSR content

      Paste the content of identity.csr.pem into the Identity CSR (PEM) input box above. Do not paste the private key.

2. Configure the server certificate

   In the Server Certificate Public Key (PEM) input box, paste the public key of the server certificate issued by a public CA, such as Let's Encrypt or DigiCert. The certificate must be in X.509 PEM format and include only the leaf certificate, not the intermediate CA chain.

   The system automatically extracts the certificate's SPKI fingerprint to generate DANE/TLSA records.

3. Submit the registration information

   After you confirm that both the identity CSR and the server certificate public key are filled in, click Submit Registration.

   After a successful submission, the agent's status changes to Pending Private CA Issuance. Alibaba Cloud submits the identity CSR to CNNIC to issue the identity certificate and generates DANE/TLSA records for the server certificate. The subsequent review and issuance process is completed automatically by the system. You can view the status changes in the agent list.

DNS record types

The system automatically generates a set of DNS records for each successfully registered agent. These records are of two types: TXT and TLSA. In the following table, {host} represents the host address (FQDN) that you specified during agent registration.

View DNS records

1. Log on to the ATS console. In the navigation pane on the left, choose My Agents.

2. Find the target agent. In the Operation column, click DNS Record.

   Note

   This option is available only if the agent status is DNS pending validation, TL pending archival, Active, or Expired.

3. In the panel that appears, you can view the DNS records for the agent. The records include the record type, host record, full domain name, record value, purpose, and validation status.

Verify DNS records

If the agent status is DNS pending validation, you must configure all DNS records in your DNS provider's console. After you complete the configuration, trigger the validation.

1. Log on to the ATS console. In the navigation pane on the left, choose My Agents.

2. Find the target agent whose status is DNS pending validation. In the Operation column, click DNS Record.

3. In the panel that appears, view the DNS records that you need to configure.

4. Log on to your DNS provider's console and add each of the preceding records.

5. After you confirm that all DNS records are configured correctly, return to the ATS console and click Verify DNS.

6. Check the validation result:

   • All passed and archival is complete: If CNNIC has approved and completed the transparent log archival, the agent status changes to Active. The agent can then be discovered and its trust can be validated across the network.

   • All passed but archival is incomplete: If CNNIC has not yet completed the transparent log archival, the agent status changes to TL pending archival (CNNIC). No further action is required. The agent status automatically changes to Active after the archival is complete.

   • Some records failed validation: The Validation Status column is updated to Verified or Validation Failed based on the result. Check the DNS configuration for the records that failed validation. After you correct the configuration, click Verify DNS again.

Agent status descriptions

An agent has nine possible statuses throughout its lifecycle. Each status corresponds to a different stage of the registration and usage process:

Operation instructions

After registration, you can manage agents on the My Agents page. The available operation buttons depend on the agent's status: