Creating a root CA

A root Certificate Authority (CA) is the topmost entity in a hierarchy of digital certificates that establishes trust in a Public Key Infrastructure (PKI). The root CA issues and signs certificates for intermediate or issuing subordinate CAs, which in turn can issue certificates to end-users, servers, or devices.

To create a root CA:

1. Follow the steps described in Accessing your partitions to log into the PKIaaS interface as a user with any of these roles:

   • Owners
   • CA Administrators

2. Click Certificate Authorities in the sidebar.

   

3. Click the plus + icon to the right of the Certificate Authorities tab.

4. Select Root Authority in the Create Authority list.

   

5. Complete the following values.

   • CA Identifier
   • Friendly Name
   • Signing Key Details
   • Expiry Date
   • Certificate Profiles
   • Subject

6. Click Create.

7. Check the details of the created CA — for example, the Serial Number of the Certificate Signing Certificate.

CA Identifier

Write a unique identifier for the new CA in your PKI hierarchy. This identifier:

• Must be 2-18 characters long
• Can only include lowercase letters, numbers, hyphens (’-’), and underscores (’_')

ℹ After deleting a CA, wait 24 hours before creating a CA with the same identifier.

Friendly Name

Write a descriptive name for the CA in your PKIaaS partition.

Signing Key Details

Select a combination of cryptosystem and hash algorithm for the new CA to sign certificates.

ℹ Some of the below combinations are not yet supported on the production release.

Expiry Date

Select an expiration date for the Certificate Signing Certificate of the new CA.

⚠ After the expiration date, the CA becomes unusable unless the certificate has been renewed.

Certificate Profiles

Select the profiles the new root CA will support for issuing subordinate CA certificates.

To select the certificate profiles of a root CA:

1. Select one or more profile groups.

   • See Authority certificate profiles for a reference of the system profiles for issuing authority certificates.
   • See Managing certificate profiles for how to create custom profiles.

2. Click + to expand the profiles on the selected groups.

3. Mark the boxes of the profiles you want to enable.

Subject

Enter a value for each attribute of the certificate subject. The resulting Distinguished Name will uniquely identify the Certificate Signing Certificate of your new CA — for example:

CN=MyRootCA, O=MyOrganization, L=MyCity, ST=MyState, C=US

ℹ Only the Common Name subject attribute is mandatory.