Server identity

Local certificate authority

{% if authority %}View authority{% endif %}

{% if authority %}

This is the current CA on this server. Other trust tiers run on separate servers. Revoked CAs remain in the archive. Its private key cannot be exported through the console.

{% if block_reason %}

{% endif %}

{% if authority['csr_pem'] %}Download CA CSR{% endif %} {% if authority['state'] == 'active' %} CA certificate CA chain CRL (DER) CRL (PEM) {% endif %}

{% if can_manage('admin') and authority['state'] == 'pending' and not authority['revoked_at'] %}

Activate this CA

Have the parent server sign the downloaded CSR. Import the returned certificate and its parent chain. Verify the root fingerprint through a trusted channel before importing.

{% endif %} {% if can_manage('admin') and authority['state'] == 'active' and authority['role'] != 'root' %}

Parent revocation status

Import a current, signed full CRL from every parent server, immediate issuer first and root last. Missing, expired, or revoked parent status blocks issuance. Re-import before the CRLs expire.

{% endif %} {% elif can_manage('admin') %}

Initialize a CA on this server. Choose a Root CA, or generate a CSR for an Intermediate or Issuing CA whose parent runs on another server. Only one current CA is permitted. After revocation, you can initialize a new CA; the previous CA and its history are retained.

{% else %}

A security administrator must initialize this server's CA.

{% endif %}

Revoked CA archive

Previous local CAs and their public artifacts remain available. Revocation is permanent.

{{ archived_authorities|length }} archived

{% for archived in archived_authorities %}{% endfor %}

Authority	Role	Revoked	Artifacts
{{ archived['name'] }} {{ archived['common_name'] }}	{{ archived['role'] }}	Revoked {{ archived['revoked_at'][:10] }}	{% if archived['state'] == 'active' %} Certificate Chain CRL {% elif archived['csr_pem'] %}CSR{% endif %}

Approval workflow

Request subordinate CA signing

Two-person approval

Submit a CSR generated on the subordinate CA's own server. A different administrator must review and approve the request. No subordinate private key is generated or stored here.

CA signing requests

Most recent 100 requests. Approval signs the exact recorded CSR and policy shown below.

{% for entry in ca_requests %}

#{{ entry['id'] }} · {{ entry['common_name'] }} {{ entry['status'] }}

Requested by {{ entry['requester'] }} · {{ entry['role'] }} · {{ entry['validity_days'] }} days

Signing authority: {{ entry['authority_name'] }}{% if entry['authority_id'] not in active_authority_ids %} Issuer inactive{% endif %}

CSR SHA-256: {{ entry['fingerprint'] }}

Recorded CSR

{{ entry['csr_pem'] }}

{% if entry['status'] == 'pending' and can_manage('admin') and authority and authority['role'] != 'issuing' and entry['authority_id'] == authority['id'] and entry['authority_id'] in active_authority_ids %} {% if entry['requested_by'] != current_user['id'] %} {% else %}

A different administrator must approve your request.

{% endif %} {% endif %}

{% else %}

No CA signing requests.

{% endfor %}

Issued subordinate CA certificates

Public certificates for CAs on other servers. This server holds no private keys for them. Most recent 100 certificates.

{% for entry in issued_authorities %}{% else %}{% endfor %}

Common name	Issuer / role	Status / expires	Artifacts
{{ entry['common_name'] }}	{{ entry['authority_name'] }} {{ entry['role'] }}	{% if entry['revoked_at'] %}Revoked{% elif entry['authority_id'] not in active_authority_ids %}Issuer inactive{% else %}Issued{% endif %} {{ entry['not_after'][:10] }}	Certificate Parent chain {% if can_manage('admin') and not entry['revoked_at'] %} Revoke Reason Permanent. Publish and distribute the updated CRL to the subordinate server and relying parties. {% endif %}
No subordinate certificates issued.