CSR — Certificate Requests
The CSR screen centralizes all certificate issuance requests for the tenant, letting you track the status of each request and create new ones.
Request Listing
Go to CSR in the sidebar menu to see the history of all requests.
| Column | Description |
|---|---|
| Certificate Name | Name of the request |
| Type | Type: ssl_tls (new issuance), renew (renewal), reissue (reissue) |
| Domain / CN | Main domain of the certificate |
| Requested By | User who created the request |
| Requested On | Date and time of the request |
| Status | Current status of the request |
| Actions | Actions available depending on the status |
Possible statuses
| Status | Description |
|---|---|
| issued | Certificate successfully issued |
| rejected | Request rejected by the CA or a validation error |
| Pending Validation | Awaiting domain validation (DCV) |
Actions by status
| Action | When it appears |
|---|---|
| View Certificate | Status issued — opens the issued certificate |
| View Order | DigiCert requests — opens the order status |
| 👁 (icon) | Views the request's details |
New Request
Click + New Request to open the 3-step wizard.
Step 1 — Identification
| Field | Description |
|---|---|
| Certificate Name | Name to identify the certificate in the CLM |
| Certificate Type | SSL/TLS (filled automatically) |
| Domain / Common Name | Main domain, e.g. app.yourcompany.com |
| Alternative Names / SANs | Additional domains separated by commas (optional) |
| Key Size | Key size — 2048, 3072, or 4096 bits |
Step 2 — CA and Configuration
Select the Certificate Authority and configure its specific parameters:
- Let's Encrypt
- DigiCert
- Microsoft AD CS
Free, automated issuance via the ACME v2 protocol.
| Field | Description |
|---|---|
| Let's Encrypt Account | Let's Encrypt account registered in Integrations |
| Validation Method | Domain validation method (see options below) |
| AWS Integration | Route 53 integration — only for DNS Auto-Validation |
| Hosted Zone | DNS zone of the domain in Route 53 |
| Notes | Optional notes |
Available validation methods:
| Method | How it works |
|---|---|
| HTTP Challenge | Creates a file at /.well-known/acme-challenge/ on the web server |
| DNS Challenge (Manual) | You add a TXT record to the DNS zone manually |
| DNS Auto-Validation — Manual | You have a Route 53 integration, but create the record manually |
| DNS Auto-Validation — Automatic | The CLM creates and removes the DNS record automatically in Route 53 |
If the domain is on Route 53, use DNS Auto-Validation — Automatic. The CLM handles the entire process with no manual action.
Issuance of commercial DV SSL certificates with domain validation.
| Field | Description |
|---|---|
| DigiCert Integration | DigiCert integration registered in Integrations |
| Organization | Organization registered on the DigiCert account |
| DV Product | DV product available on the account |
| Technical Contact | Technical contact registered with DigiCert |
| Organization Contact | Organization contact registered with DigiCert |
| Locality (L) | City |
| State (ST) | State or province |
| Country (C) | 2-letter country code, e.g. BR |
| Order Validity | Order validity in Years or Days |
| Notes | Optional notes |
Domain validation methods (DCV):
| Method | How it works |
|---|---|
| Email Validation | Sends a validation email to the domain owner |
| DNS CNAME Token | You add a CNAME record to the DNS zone manually |
| HTTP CSR Hash | You upload a hash file to the web server |
| DNS Auto-Validation — Manual | You have a Route 53 integration, but create the record manually |
| DNS Auto-Validation — Automatic | The CLM creates the DNS records automatically in Route 53 |
Issuance consumes balance from the DigiCert account. Confirm that balance is available before submitting.
Issuance of internal certificates via an on-premises Enterprise CA.
| Field | Description |
|---|---|
| Certificate Authority | AD CS integration registered in Integrations |
| Certificate Template | Certificate template available on the CA |
| Organization (O) | Legal name of the organization (required) |
| Organizational Unit (OU) | Department or division (optional) |
| City/Locality (L) | City (required) |
| State/Province (ST) | State or province (required) |
| Country (C) | 2-letter country code, e.g. BR (required) |
| Notes | Optional notes |
AD CS requires a CLM Windows agent installed and online with access to the CA server. See the Install the Agent — Windows guide.
If the template requires approval from the CA Manager, the status will remain pending_approval until the administrator approves it in the AD CS console.
Step 3 — Review
Check all the settings from the previous steps. Use Edit to go back and correct any section. Click Submit request to send the request to the CA.
Track the validation
For Let's Encrypt and DigiCert, after submitting you may need to complete domain validation. The screen shows the DNS record status and lets you Force validation to trigger an immediate check.
See the detailed guides per CA: