Creating an issuing subordinate authority

An issuing subordinate Certificate Authority (CA):

• Operates under the authority of either a root CA or an intermediate subordinate CA.

• Issues digital certificates to end entities like servers, devices, or users.

See below for how to create an issuing subordinate CA.

To create an issuing subordinate CA:

1. Follow the steps described in Accessing your partitions to log into the PKIaaS interface as a user with any of these roles:

   • Owners
   • CA Administrators

2. Click Certificate Authorities in the sidebar.

   

3. Click Add and select Certificate Authority.

4. Select Issuing subordinate Authority.

   

5. Complete the following values.

   • CA Identifier
   • Friendly Name
   • Signing Key Details
   • Expiry Date
   • Allowed SAN List
   • Enable CRL
   • Enable OCSP
   • Certificate Profiles
   • Subject

6. Click Add.

7. Check the details of the created CA — for example, the Serial Number of the Certificate Signing Certificate.

CA Identifier

Enter a unique identifier for the new CA in your PKI hierarchy. This identifier:

• Must contain 2-18 characters
• Can only include lowercase letters, numbers, hyphens (’-’), and underscores (’_')

ℹ After deleting a CA, wait 24 hours before creating a CA with the same identifier.

Friendly Name

Write a descriptive name for the CA in your PKIaaS partition.

Parent Authority Identifier

Select the parent authority for the new subordinate authority. The parent authority can be of the following types.

Signing Key Details

Select a combination of cryptosystem and hash algorithm for the new CA to sign certificates.

ℹ The production release does not yet support some of the combinations listed below.

See the table below for the supported Classic keys.

See the table below for the supported Post-Quantum (PQ) keys.

See the table below for the supported Composite keys.

Expiry Date

Select an expiry date for the Certificate Signing Certificate of the new CA.

⚠ After the expiry date, the CA cannot operate if you have not renewed the CA certificate.

Allowed SAN List

Select the list of Subject Alternative Names (SANs) that can be included in the certificates issued by the authority. If no list is selected, all SANs will be allowed.

ℹ See Managing SAN lists for how to create and manage allowed SAN lists.

Enable CRL

This read-only box is always checked as PKIaaS authorities always provide a CRL publishing endpoint.

Enable OCSP

Check this box to enable an OCSP (Online Certificate Status Protocol) service for the new certificate authority.

ℹ This feature requires a subscription that includes the OCSP Service. See Checking your subscriptions for how to check your current subscription.

Certificate Profiles

Select the Subscriber certificate profiles the new issuing subordinate CA will support for issuing certificates to end-entities.

1. Click + to expand the profiles on the selected groups.
2. Select the check boxes of the profiles you want to enable.

ℹ See Customizing subscriber profiles for how to create custom profiles.

Subject

Enter a value for each RFC5280 attribute in the certificate subject’s Distinguished Name (DN).

Alternatively, you can:

1. Toggle the Advanced Subject switch.
2. Type a Distinguished Name (DN) including additional attributes.

The resulting Distinguished Name will uniquely identify the Certificate Signing Certificate of your new CA — for example:

CN=MyRootCA, O=MyOrganization, L=MyCity, ST=MyState, C=US