An intermediate Certificate Authority (CA):

• Operates under the authority of a root or intermediate CA.
• Issues digital certificates for subordinate CAs or for other intermediate CAs.

See below for how to create an intermediate CA.

To create an intermediate Certificate Authority

1. Open the following URL in a Web browser. 

   https://<machine>/management-console

   Where <machine> is the IP address or domain name of the machine hosting Cryptographic Security Platform.

2. Log in to the Management Console as one of the users created in Creating Certificate Authority tenants. This user will be the tenant of the new intermediate Certificate Authority.
3. In the content pane, click Manage Solution under Certificate Authority (CA).
   
4. Select Operations in the sidebar.
   
5. Select an organization under Organizations list. 

   See Managing organizations for how to create or join an organization.

6. Click New under Certificate Authority.
7. Configure the following settings. 
   • CA Type
   • CA Identifier
   • Signing Key Type
   • Certificate Profiles
   • Parent CA Identifier
   • Expiration Date
   • Attributes
   • Auditors
   • Administrators
8. Click Submit to create the new Certificate Authority.
9. Copy the password of the client authentication PKCS #12 created for each new auditor or administrator (if any).

   

10.  Click Download to download the PKCS #12 files. Each PKCS #12 includes:
    • The certificate of the CA that issues the client certificates. 
    • A client certificate.
    • The private key of the client certificate.
11. Save the PKCS #12 files and passwords in a secure place, as you cannot obtain them later. 
12. If the root CA of the new intermediate CA is an external root CA, follow the steps described at Certifying a CA with an external root CA. 
    
    

CA Type

Click Intermediate Subordinate Authority. 

Mandatory: Yes.

CA Identifier

Type a unique identifier for the new Certificate Authority within its organization. This identifier:

• Must be 3-18 characters long.
• Can only include lowercase letters, numbers, underscores ("_"), and hyphens ("-").

Mandatory: Yes.

Signing Key Type

Select a combination of cryptosystem and hash algorithm for the new CA to sign certificates.

• The available algorithms on this list depend on the configured cryptographic module.
• For a testing environment with software cryptography, the list also includes the algorithms described in Post-quantum key types.

Mandatory: Yes. 

Certificate Profiles

The profiles the Certificate Authority will support for issuing certificates. After selecting a profile group in the Certificate Profiles field, click the plus sign (“+”) to view, select, and unselect the profiles in that group.

See a complete reference of these profiles at the Entrust PKIaaS online guide.

Mandatory: Select at least one profile.

Parent CA Identifier

The identifier of the parent Certificate Authority.

Mandatory: Yes.

Expiration Date

The expiration date for the certificate signing certificate of the Certificate Authority. 

Mandatory: No. This value defaults to the following dates. 

Attributes

The value of each attribute in the Distinguished Name (DN) of the Certificate Authority certificate. 

Mandatory: Set at least the CN attribute of the Distinguished Name. 

Auditors

Enter the names of the users who will have auditor permission on the Certificate Authority. For each name, you can:

• Enter a user name already assigned to another CA so that the user will have permissions on different CAs.
• Enter a new user. 

Mandatory: No. When omitting this value, the Certificate Authority will not have users with only auditing permission.

Administrators

Enter the names of the users who will have administration permission on the Certificate Authority. For each name, you can:

• Enter a user name already assigned to another CA so that the user will have permissions on different CAs.
• Enter a new user. 

Mandatory: Yes. Add the name of at least one administrator.