Adding a Certificate Authority

From the navigation bar, select Network Control > Service Catalog.

The Service Catalog page is displayed.

Find the Certificate Management tile and click Add.

The Add Certificate Instance page is displayed.

Select Certificate Authorities (CA) from the options under Template Instance Type, then click Next.

The Add Certificate Authority page is displayed.

Select one of the following certificate authority methods:

Generate New Certificate Authority: Creates a new root certificate authority by generating new keys.
Generate New Intermediate Certificate Authority: Creates an intermediate certificate authority that is subordinate to an existing certificate authority.
Upload Existing Root or Intermediate Certificate Authority: Imports the public key and, optionally, the private key of an existing certificate authority.

Complete the settings for the selected method:

Generate New Certificate Authority: Complete the following settings in the Create Root CA section:
- Certificate Authority Name: Enter the name of the certificate authority.
- Common Name: Enter the publicly visible name of the certificate authority.
  Note: The Common Name is the publicly visible name of the certificate authority. It is recommended to include Root CA and a version identifier when applicable (such as “Sample Corp Root CA I”).
- Description: Enter a brief description.
Generate New Intermediate Certificate Authority: Complete the following settings in the Create Intermediate CA section:
- Certificate Authority: Select the parent certificate authority from the drop-down list.
  Note: The selected parent certificate authority must exist before you create an intermediate certificate authority.
Complete the following settings in the Create Root CA section:
- Certificate Authority Name: Enter the name of the intermediate certificate authority.
- Common Name: Enter the publicly visible name of the intermediate certificate authority.
  Note: The Common Name is the publicly visible name of the certificate authority. It is recommended to include Intermediate CA and a version identifier when applicable (such as “Sample Corp Intermediate CA I”).
- Description: Enter a brief description.

For a new root or intermediate certificate authority, configure the following sections:

Validity Period: Specify the certificate validity period.
Certificate authorities are normally valid for 20 years. The default start date is backdated by one month to avoid potential system-clock issues.
- Start Date: Select a start date from the calendar. By default, the start date is one month before the current date.
- Expiration Date: Select an expiration date from the calendar.
CA Strength: The following properties determine the strength of the certificate authority:
- Key Length: Configure the key length by dragging the slider. Valid values range from 2048 through 4096.
  Note: The Key Length setting does not apply to certificates generated through Chromebook enrollment or from manually added certificate signing requests (CSRs).
- Algorithm: Select SHA-256, SHA-384, or SHA-512 from the drop-down list.
CA Properties: The following properties are embedded in the certificate authority. Follow your organization’s guidelines when specifying these values:
- Organization: Enter the name of the organization.
- Organization Unit: Enter the name of the organizational unit or department.
- Email Address: Enter the email address associated with the organization.
  Note: You can enter only the following characters in the Email Address field: letters, numbers, periods (.), hyphens (-), and underscores (_). If you enter any other special characters, a validation error is displayed.
- Title: Enter the title.
- Locality: Enter the name of the locality.
- State: Enter the name of the state.
- Country: Enter the name of the country.

Complete the following settings in the Upload CA section if you selected Upload Existing Root or Intermediate Certificate Authority:

Public Key: Drag and drop the public key file into the upload area, or click Browse to select and upload the file.
(Optional) Private Key: Drag and drop the private key file into the upload area, or click Browse to select and upload the file.
Note: The Private Key is required only if you plan to issue certificates using this certificate authority. If the private key is password-protected, enter the Private Key Password.
(Optional) Private Key Password: Enter the password for the private key if the uploaded private key is password-protected.

Click Add.

The certificate authority is added and displayed on the Certificate Authorities tab of the Certificate Management page.

The Certificate Authorities tab displays the following information:

Name: Displays the name of the certificate authority.
Templates: Displays the number of certificate templates that use the certificate authority.
Common Name: Displays the common name of the certificate authority.
SHA Fingerprint: Displays the unique identifier created by the Secure Hash Algorithm (SHA) for the certificate authority.
Expires: Displays the expiration date of the certificate authority.

You can customize which fields appear in the table by clicking the icon and selecting or deselecting the desired column names. Drag and drop individual column names up or down the list to customize the left‑to‑right column display in the table. Optionally, you can click Reset to default to have the default subset of columns appear in the table. Use the Clear Filters option to remove all applied filters.

You can use the Search option to display only the table entries matching the specified Name, Common Name, or SHA Fingerprint; enter a minimum of two characters.

(Optional) Click the certificate authority name to view the CA details.

The Certificate Authority Details sidebar is displayed, containing the following expandable sections:

Certificate Authority Information
View & Upload
Sub CAs
Certificate Templates

(Optional) Expand Certificate Authority Information to view the following information:

CA Name: Displays the name of the certificate authority.
Common Name: Displays the publicly visible name of the certificate authority.
Parent CA: Displays the parent certificate authority for an intermediate certificate authority.
SHA Fingerprint: Displays the SHA fingerprint of the certificate authority.
Organization: Displays the organization associated with the certificate authority.
Organization Unit: Displays the organizational unit associated with the certificate authority.
Email Address: Displays the email address associated with the certificate authority.
Locality: Displays the locality associated with the certificate authority.
State: Displays the state associated with the certificate authority.
Country: Displays the country associated with the certificate authority.
Usages: Displays the supported certificate authority usages, such as client authentication, server authentication, and Online Certificate Status Protocol (OCSP) signing.
Start Date: Displays the start date of the certificate authority.
Expires: Displays the expiration date of the certificate authority.
Key Length: Displays the key length of the certificate authority.
Key Usage: Displays the permitted key usages, such as digital signature, key encipherment, data encipherment, certificate signing, and certificate revocation list (CRL) signing.
Algorithm: Displays the algorithm used by the certificate authority.
Serial Number: Displays the serial number of the certificate authority.
Description: Displays the certificate authority description.

To view the certificate authority, click View Certificate Authority.

(Optional) Expand View & Upload to access the following options:

Public Key: Click View to view the public key.
Chain: Click View to view the certificate chain.
Private Key: Click View to view the private key.
Delete: Deletes the uploaded private key.

(Optional) Expand Sub CAs to view any intermediate certificate authorities that are subordinate to the selected certificate authority.

(Optional) Expand Certificate Templates to view the certificate templates associated with the selected certificate authority.