Certificate authority instantiation
PKIaaS provides the following Certificate Authority (CA) instantiation capabilities.
CA types
Each customer may have one or more subordinate issuing CAs. You can:
- Create an online root CA and add issuing CAs subordinate to this root CA.
- Add an issuing CA signed by an external root CA – for example, your on-premises Microsoft root CA.
Secure CA key management
Entrust stores all CA private keys in nShield Connect XC High HSMs with FIPS 140-2 Level 3 validation.
CA creation time
CAs are automatically provisioned in ~60 seconds after submitting your request.
CA validity period
CA certificates have a default validity period of 20 years for root CAs and 10 years for subordinate issuing CAs. You can select a different period when creating each CA.
An issuing CA should have a lifespan of at least 3 years to support some features. For example, to automate Intune/MDM enrollment using an Entrust-hosted enrollment workflow, an issuing CA must have at least 3 years of remaining lifespan when you create the workflow.