See below for how to create an online root CA for your PKIaaS CA hierarchy.

To create an online root CA

1. Navigate to Administration > PKIaaS Management. 
   
2. In the side pane, click Add Private CA.
3. In Select CA, choose Online Root Certificate Authority.
   
4. Click Next to display the CA information screen.
   
5. Enter the values described below. 
   • Friendly Name
   • Signing Key Details
   • Region
   • Expiry Date
   • Services
   • Service Profiles
   • Distinguished Name Fields
6. Click Next and review the CA information.
   
7. Click Submit.
8. In the confirmation request, click OK to start the CA creation process.
9. When the CA creation completes, check the CA details in the CA grid view.
10. Refresh the grid. You will notice that the status changes to Active.

Friendly Name

Enter an informal name for the new CA.

Mandatory: Yes.

Signing Key Details

Select one of the algorithms described in Certification Authority instantiation.

Mandatory: Yes.

Region

Select the region in which the CA will be hosted.

Mandatory: Yes.

Expiry Date 

Select the expiry date for the CA certificate. Use the date picker or enter a date in the following format.

Mandatory: No. If you do not assign a specific expiry date, the expiry period defaults to 20 years for root CAs. 

Services 

Select a predefined set of certificate profiles.

Mandatory: No. 

Service Profiles

Select the certificate profiles you want to enable in the root CA. See the following table for the certificate profiles included in each service.

Mandatory: No. 

Distinguished Name Fields

Enter a value for each field in the Distinguished Name of the CA certificate.

Mandatory: Only the Common Name certificate field.