Update hub docs

Author: webprofusion-chrisc

docs/hub/guides/ccm.md

@@ -59,19 +59,6 @@ Your *Certify Certificate Manager* install remains much the same as it was befor
 The hub does not currently have global settings that can be pushed to all managed instances etc (such as a single ACME account, or specific stored credential).
 
 ## Other Considerations
-### Ensure Unique Instance IDs
-
-When CCM is installed, an InstanceID value is generated and stored in appsettings.json (on Windows).
-
-**Important:** If you have previously used a VM clone to create a new instance of CCM:
-- You must ensure two instances do not share the same Instance ID
-- Duplicate IDs will cause instances to appear as one, and their communication with the hub will conflict
-- One instance may receive edits intended for the other
-
-Instance IDs must be valid (unique) GUID values. If in doubt:
-1. Delete your `appsettings.json` file (or just the instanceID field)
-2. Restart the Certify background service to let the app create a new one
-
 ## Setting up additional joining keys
 
 If you manage instances across different organizations (e.g. if you are an MSP etc), consider creating multiple joining keys to partition by organization. This allows you to revoke hub access for specific groups without affecting unrelated instances.
@@ -97,6 +84,6 @@ This step may be unnecessary in current versions where it's auto-created.
 3. Select **Managed Instances Service Principle**
 4. Enter **Instance Joining Key** as the title
 5. Select **Management Hub Managed Instance** as the scoped role
-6. **Important:** Click **Add/Remove Role Scope** to add it to the scope list
+   - **Important:** Click **Add/Remove Role Scope** to add it to the scope list
 7. Click **Add** to create the new API token
 8. Copy the **Client ID** and **Secret** values - you'll need these for instance configuration

docs/hub/managedchallenges.md

@@ -35,7 +35,34 @@ Under *Settings > Security > Users*, add a User to represent the consumer (user
 
 Under *Settings > Security > API Access*, select Add API Token, select the required security principle, enter a descriptive title etc for this consumer token so you know why it exists and what it's being used for. To scope the API access token to managed challenges only, select Managed Challenge Consumer from the Role list and click Add/Remove Role Scope, then Save. A new API token will be created and you will need the Client ID and Secret values to access the API and use the managed challenge.
 
+1. In the hub, navigate to **Settings > Security > Users**
+2. Click **Add New Security Principle**
+3. Configure as follows:
+   - **Type**: Application/Service
+   - **Title**: "Managed Challenge User" (for example, to help identify the consumer of the managed challenge)
+   - **Description**: "Managed challenge consumer" (for example)
+4. After adding, click the **Roles icon** (People+ icon) next to the new security principle's ID
+5. Select the `Managed Challenge Consumer` role from Available Roles to assign it.
+6. Click **Save**
+
+### 2. Create an API Key to use the managed challenge
+
+1. Navigate to **Settings > Security > API Access**
+2. Click **Add API Token**
+3. Select **Managed Challenge User** as the security principle.
+4. Enter **Managed Challenge API Key** as the title
+5. Select **Managed Challenge Consumer** as the scoped role
+    - **Important:** Click **Add/Remove Role Scope** to add it to the scope list
+7. Click **Add** to create the new API token
+8. Copy the **Client ID** and **Secret** values - you'll need these for instance configuration
+
+#### Combined Hub joining and Managed Challenge Key
+It is possible to create a combined hub joining key and managed challenge key, which certain clients (such as Certify Certificate Manager) can use by default if they already know the hub joining key. This is provided as an option for convinience but is not configured by default. 
+
+To enable this, add the Managed Challenge Consumer role to the managed instance service principle (or a new service principle), then create a new hub joining key with both the *Hub Managed Instance* role and *Managed Challenge Consumer* role scope.
+
 ### Configure your ACME Client
-Where an ACME client supports Certify Managed Challenges you will follow the normal process for selecting that provider and you will be required to specify the Client ID and Secret from the above configuration, you will also need to specify the Management Hub API Url. When you then perform your certificate order it will call the Management Hub API to complete the DNS updates required.
+Where an ACME client supports Certify Managed Challenges you will follow the normal process used by that client for selecting that provider and you will be required to specify the Client ID and Secret from the above configuration, you will also need to specify the Management Hub API Url. When you then perform your certificate order it will call the Management Hub API to complete the DNS updates required.
 
+In Certify Certificate Manager, under Authorization, select dns-01 as the Challenge Type, and Certify Managed Challenge API as the provider, then add the required credentials.