Skip to content
Docs sslbrain sslbrain.com

Akamai CPS

Copy link to the page “Akamai CPS”

← All integrations

Cloud service

Uploads the certificate and chain to a third-party enrollment in Akamai CPS.

The appliance runs the package and connects to Akamai CPS through CPS API over HTTPS on port 443. No agent is installed on Akamai CPS.

What happens

  1. The appliance connects to Akamai CPS through CPS API on port 443.
  2. The certificate must be issued from the destination CPS CSR. The package checks that its public key matches before uploading the certificate and intermediates to the selected enrollment's current change. CPS retains the private key.
  3. The package follows CPS deployment within the time limit and acknowledges offered warnings and changes by default. Automatic acknowledgement can be disabled. An uncertain upload response triggers fresh CPS reads without blindly repeating the one-time upload. If it fails: Rollback only compares current production with the saved prior state. A completed certificate change cannot be restored from this backup; contact Akamai Support for recovery.
  4. Verification: the CPS production certificate fingerprint determines the result. An optional served TLS probe is reported separately and does not change the CPS result.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to CPS API, port 443. No agent is installed.
You need
EdgeGrid client for CPS with client token and API host from .edgerc. Store client_secret and access_token as JSON in the encrypted credential secret for discovery. A plain client secret with a separate rule access token is also supported. Discovery uses contractId.
Platform
Third-party enrollments in CPS
Actions
Discovery, Installation, Verification, Rollback, Removal
Packages
akamai-cps-api 1.1.1
Note
  • akamai-cps-api 1.1.1 requires no local private key. Discovery finds third-party enrollments and their offered public CSRs; the agent does not create enrollments or change their certificate manager.
  • Management TLS is verified by default. MANAGEMENT_TLS_PIN_SHA256, MANAGEMENT_TLS_CA_BUNDLE and explicit opt-out MANAGEMENT_TLS_INSECURE are optional; legacy AKAMAI_TLS_CA_BUNDLE and AKAMAI_TLS_INSECURE are also supported.
  • CERT_NAME is an optional local backup label of up to 64 letters, digits, dots, underscores or hyphens. Enrollment ID selects the destination; follow-up actions do not require the name.
  • The certificate belongs to the enrollment. Undeploy changes nothing; the package does not delete enrollments, cancel changes or affect other enrollments.
  • Keep the deployment backup for later comparison with CPS production. BACKUP_DIR can also be read on Alpine/musl; rollback compares state and does not reinstall a previous certificate.

Get started