Managing SSL Certificates for Tracking Domains

MessageGears supports two methods for managing SSL certificates for the tracking domains.

The Automated method, which uses the DNS-01 challenge, grants MessageGears the DNS control needed to prove ownership of the tracking domain, allowing the renewal of certificates automatically with no customer involvement after the initial setup. That control can be granted in either of two ways by our preferred method of Delegation or CNAMES.

Self-managed method, the customer obtains their own certificate and provides it to MessageGears, and MessageGears install it manually for the customers tracking domain. The customer is responsible for supplying a replacement certificate ahead of every expiry, so each renewal is a manual handover.

Automated Process - Delegation

Customers create NS records at their DNS provider that delegate the tracking subdomain to MessageGears, making MessageGears authoritative for that sub domain and everything beneath it. MessageGears then create and maintain every record the tracking domain needs, and issue and renew the certificate indefinitely until retirement notice. Once the NS records are in place, no further DNS change is ever required from the customer.

• Contact Customer/App support for the tracking domain you want to use.

• MessageGears creates the DNS zone for that domain and provides you with four nameservers.

• At your DNS provider, create NS records for the tracking subdomain pointing at those four nameservers.

• Notify MessageGears once the records are live. We confirm the delegation has propagated.

• MessageGears issues the certificate and manages all future renewals. No further action is required from you.
  

Automated Process - CNAME

Customers retain control of their own DNS and create two CNAME records: one pointing the tracking domain at MessageGears infrastructure to carry the link traffic, and one pointing the _acme-challenge hostname at MessageGears to prove domain ownership. MessageGears issue and renew the certificate automatically for as long as both records remain in place. This grants MessageGears the minimum access needed, but leaves two records on the customer's side that must survive any future DNS work.

• Contact Customer/App support for the tracking domain you want to use

• MessageGears provides you with the two CNAME targets.

• At your DNS provider, create both records and CNAME to the targets provided.

Self-Managed Process

Customers obtain a certificate for the tracking domain from their own certificate authority and provide it, together with the private key, to MessageGears. MessageGears will process the certificate and install it manually. MessageGears is given no DNS access and therefore no ability to renew on the customer's behalf, it is the responsibility of the customer to supply a replacement certificate ahead of every expiry. Each renewal is a manual handover that has to be scheduled and completed before the current certificate lapses, and a missed renewal breaks tracking links.

• Certificates must contain the full chain, including leaf certificate, intermediary certificate, cross certificate ( If certificate is a cross-signed ) and correct private key.

• Certificates are expected to be in PEM or PFX format.

• Certificates are expected to be RSA or ECDSA ( Please notify Customer/ App Support which certificate type is used)