Knowledge Base
Sectigo Orchestration Gateway (SOG) installation guide for Ubuntu
Overview
By the end of this guide, you will have a Sectigo Orchestration Gateway (SOG) installed on Ubuntu, registered with Sectigo Certificate Manager (SCM), and confirmed as Connected. The guide covers the prerequisites and required network ports, creating the gateway in the SCM user interface (UI), downloading the Debian (DEB) installation package, installing it with the Advanced Package Tool (APT), registering the gateway with a token, verifying the installation, restarting the service, and the required post-installation steps. Outbound access uses Transmission Control Protocol (TCP) port 443; remote endpoint management may also use Secure Shell (SSH) on TCP 22 or a Representational State Transfer (REST) connection on TCP 443.
1. Prerequisites
-
Access to your Sectigo Certificate Manager (SCM) account.
-
An Ubuntu machine where you can run commands with sudo.
-
Outbound network access from the Ubuntu machine to your SCM instance on TCP port 443.
-
If you plan to manage remote endpoints later, additional ports may be required depending on the connection type, such as TCP 22 for SSH or TCP 443 for REST.
2. Create the gateway in SCM
-
Sign in to Sectigo Certificate Manager (SCM).
-
Go to Integrations > Orchestration Gateways.
Figure 1. Sectigo Certificate Manager navigation with Integrations expanded and Orchestration Gateways selected.
-
Click the Add icon to create a new orchestration gateway.
Figure 2. Orchestration Gateways list in SCM; gateway names and identifiers are redacted.
-
Enter a name for the gateway, then click Next.
Figure 3. Add Orchestration Gateway dialog with the gateway Name field.
-
Copy the registration token shown in the Add Orchestration Gateway dialog. You will need this token during installation.
-
Click Save. The gateway is listed with the status of Pending.
3. Download the Ubuntu installation package
-
On the Integrations > Orchestration Gateways page, select the gateway you created and open its Edit dialog. The Edit dialog manages gateway properties, connected endpoints, and downloads.
-
In the downloads area, download the Linux installation package (for example, sectigo-orchestration-gateway_1.0-428_amd64.deb) and save it on your Ubuntu machine.
Figure 4. Gateway details showing the Windows MSI, Linux RPM, and Linux DEB download links; the installation token is redacted.
-
Install the package with the Advanced Package Tool (APT):
sudo apt install <path-to-directory>/sectigo-orchestration-gateway_1.0-428_amd64.deb
Linux packages are provided in Debian (DEB) and Red Hat (RPM) formats and can be installed with native package managers such as the Advanced Package Tool (APT) or Dandified YUM (DNF), or downloaded from SCM for manual installation.
4. Register the gateway
-
Sign in to the Ubuntu server and open the Terminal application.
-
Run the registration command below, replacing <token> with the registration token you copied from SCM:
sudo /opt/sectigo-orchestration-gateway/bin/sectigo-og register --token <token>
5. Verify the installation
-
Run the following command to view gateway information:
sudo /opt/sectigo-orchestration-gateway/bin/sectigo-og info
If the command returns gateway information without errors and the status is connected, registration was successful.
Figure 5. Ubuntu terminal output of sectigo-og info showing status connected; username and hostname are redacted.
6. Restart the service
-
Run the following command to restart the orchestration gateway service:
sudo systemctl restart sectigo-orchestration-gateway
7. Required next steps after installation
Add at least one keystore. A keystore is required after installation before the gateway can manage certificates. Run the command below, replacing <type> with a keystore type (jks for a Java KeyStore, or p12 for a PKCS#12 keystore):
sectigo-og keystore add <type> --name <name> --password <password>
Figure 6. Keystore add command syntax with placeholders for type, name, and password.
After making local changes, use Sync Endpoints in SCM so SCM reflects the current state of the gateway. A successfully registered gateway appears with a Connected status.
Figure 7. Selected gateway showing a Connected status after registration; identifiers are redacted.
Need assistance?
Contact our team for help with your purchase or issuing your certificate.
Live chat
Click the button below or click "Chat with an Expert" to start chatting with us now!
