Creating an intermediate subordinate CA

An intermediate subordinate Certificate Authority (CA):

• Operates under the authority of either a root CA or other intermediate subordinate CA.
• Issues digital certificates for issuing subordinate CAs or for other intermediate subordinate CAs.

See below for how to create an intermediate subordinate CA.

To create an intermediate subordinate CA:

1. Follow the steps described in Accessing your partitions to log into the PKIaaS interface as a user with any of these roles:

   • Owners
   • CA Administrators

2. Click Certificate Authorities in the sidebar.

   

3. In the content pane, select ACTIONS > Create Authority for either:

   • A root CA.
   • An intermediate subordinate CA (as intermediate subordinate CAs can be the parent of other intermediate subordinate CAs).

   Alternatively, you can click the top ADD button and select Intermediate Subordinate Authority in the CA Type list.

   

4. Complete the following values.

   • CA Identifier
   • Friendly Name
   • Parent Authority Identifier
   • Signing Key Details
   • Expiry Date
   • Enable CRL
   • Certificate Profiles
   • Subject

5. Click Create.

6. Check the details of the created CA.

7. If the Parent Authority Identifier corresponds to an external root CA, follow the steps in Certifying a CA with an external root CA.

CA Identifier

Write a unique identifier for the new CA in your PKI hierarchy. This identifier:

• Must be 2-18 characters long
• Can only include lowercase letters, numbers, hyphens (’-’), and underscores (’_')

ℹ After deleting a CA, wait 24 hours before creating a CA with the same identifier.

Friendly Name

Write a descriptive name for the CA in your PKIaaS partition.

Parent Authority Identifier

Select the root or intermediate subordinate CA that will sign the Certificate Signing Certificate of the new intermediate subordinate CA.

ℹ This field is read-only if the parent CA was selected at the start of the intermediate subordinate CA creation.

Signing Key Details

Select a combination of cryptosystem and hash algorithm for the new CA to sign certificates.

ℹ Some of the below combinations are not yet supported on the production release.

Expiry Date

Select an expiration date for the Certificate Signing Certificate of the new CA.

⚠ After the expiration date, the CA becomes unusable unless the certificate has been renewed.

Enable CRL

Check this box to enable the generation of CRLs (Certificate Revocation Lists).

ℹ A Certificate Revocation List (CRL) is a list of digital certificates that the issuing Certificate Authority (CA) revoked before expiration.

Certificate Profiles

Select the profiles the new intermediate subordinate CA will support for issuing subordinate CA certificates.

To select the certificate profiles of an intermediate subordinate CA:

1. Select one or more profile groups.

   • See Authority certificate profiles for a reference of the system profiles for issuing authority certificates.
   • See Managing certificate profiles for how to create custom profiles.

2. Click + to expand the profiles on the selected groups.

3. Mark the boxes of the profiles you want to enable.

Subject

Enter a value for each attribute of the certificate subject. The resulting Distinguished Name will uniquely identify the Certificate Signing Certificate of your new CA — for example:

CN=MyIntermediateCA, O=MyOrganization, L=MyCity, ST=MyState, C=US

ℹ Only the Common Name subject attribute is mandatory.