See below for creating a root Certificate Authority (CA) with a self-signed certificate issued by the Certificate Authority solution.

To create a root Certificate Authority instance 

1. Open the following URL in a Web browser. 

   https://<machine>/management-console

   Where <machine> is the IP address or domain name of the machine hosting Cryptographic Security Platform.

2. Log in to the Management Console as one of the users created in Creating Certificate Authority tenants. This user will be the tenant of the new root Certificate Authority.
3. In the content pane, click Manage Solution under Certificate Authority (CA).
   
4. Select Operations in the sidebar.
   
5. Select an organization under Organization List. 

   See Managing organizations for how to create or join an organization.

6. Click New under Certificate Authority.
7. Configure the following settings.
   • CA Type
   • CA Identifier
   • Friendly Name
   • Signing Key Type
   • Certificate Profiles
   • Expiration Date
   • Attributes
   • Auditors
   • Administrators
8. Click Submit to create the new Certificate Authority.
9. Copy the password of the client authentication PKCS #12 created for each new auditor or administrator (if any).
   

   

10. Click Download PKCS12 to download the PKCS #12 files. Each PKCS #12 includes:
    • The certificate of the CA that issues the client certificates. 
    • A client certificate.
    • The private key of the client certificate.
11. Save the PKCS #12 files and passwords in a secure place, as you cannot obtain them later. 

CA Type

Click ​Root Certificate Authority.

Mandatory: Yes.

CA Identifier

Type a unique identifier for the new Certificate Authority within its organization. This identifier:

• Must be 3-18 characters long.
• Can only include lowercase letters, numbers, underscores ("_"), and hyphens ("-").

Mandatory: Yes.

Friendly Name

A friendly name for the new Certificate Authority in the user interface.

Mandatory: No. This optional value defaults to the one assigned to the CA Identifier field.

Signing Key Type

Select a combination of cryptosystem and hash algorithm for the new CA to sign certificates.

• The available algorithms on this list depend on the configured cryptographic module.
• For a testing environment with software cryptography, the list also includes the algorithms described in Post-quantum key types.

Mandatory: Yes. 

Certificate Profiles

The profiles the Certificate Authority will support for issuing certificates. After selecting a profile group in the Certificate Profiles field, click the plus sign (“+”) to view, select, and unselect the profiles in that group.

See a complete reference of these profiles at the Entrust PKIaaS online guide.

Mandatory: Select at least one profile.

Expiration Date

The expiration date for the certificate signing certificate of the Certificate Authority. 

Mandatory: No. This value defaults to the following dates. 

Attributes

The value of each attribute in the Distinguished Name (DN) of the Certificate Authority certificate. 

Mandatory: Set at least the CN attribute of the Distinguished Name. 

Auditors

Enter the names of the users who will have auditor permission on the Certificate Authority. For each name, you can:

• Enter a user name already assigned to another CA so that the user will have permissions on different CAs.
• Enter a new user. 

Mandatory: No. When omitting this value, the Certificate Authority will not have users with only auditing permission.

Administrators

Enter the names of the users who will have administration permission on the Certificate Authority. For each name, you can:

• Enter a user name already assigned to another CA so that the user will have permissions on different CAs.
• Enter a new user. 

Mandatory: Yes. Add the name of at least one administrator.